Exploits, Tools & Data Recovery · How Bugs Become Attacks · Lesson 1 of 5

Vulnerabilities, Exploits & Patches

Learn how a bug becomes a security hole, and how one update closes it for everyone.

Bugs, holes and exploits

Every app and operating system is written by people, and people make mistakes. This course is about what happens when one of those mistakes matters for security, and how it gets fixed.

Start with three words that often get mixed up in the news.

• A bug is any mistake that makes software behave differently than its makers intended. Most bugs are just annoying: a button that does nothing, or an app that crashes when you rotate the screen.
• A vulnerability is a bug that someone could use to break a security rule, such as reading data they shouldn't, running code they shouldn't, or knocking a service offline. The CVE Program describes it as a weakness that can be exploited to harm confidentiality, integrity or availability. Those are the classic goals of security: keep data secret, keep it unaltered, and keep things working.
• An exploit is the method or code that actually takes advantage of a vulnerability. The vulnerability is the unlocked window. The exploit is someone climbing through it.

On a modern phone, one vulnerability is rarely enough. You saw in Mobile Malware that spyware like Pegasus used an exploit chain, several exploits used one after another, each getting past a different layer of protection. Roughly: one flaw gets code running inside the part of an app that opens a file, a second escapes that app's sandbox, and a third takes control of the core of the operating system. Phones are built in layers on purpose, so an attacker needs a working flaw for each layer.

That layering is good news for defenders. If even one link in the chain is fixed, the whole chain stops working, and the attacker has to find a replacement for that link.

Last, a patch is the fix: changed code that removes the vulnerability. Patches reach your phone inside software updates, and a single update can carry dozens of them.

Not every vulnerability is equally useful to an attacker. Some need the phone in hand, some need you to install a bad app, and a few need nothing from you at all. The next module shows how vendors rate that.

From discovery to fix

A vulnerability has a life cycle. Knowing the stages helps you read security news calmly.

• Discovery. Someone finds the flaw. It might be the vendor's own engineers, an outside researcher, or an attacker.
• Report. A researcher usually reports it privately to the vendor, often through a bug bounty program. You met this coordinated disclosure process in Mobile Malware.
• Fix. The vendor confirms the problem, writes a patch and tests it so it doesn't break anything else. This can take days or months.
• Release. The patch ships in an update, along with a public note, a security bulletin, listing what was fixed.
• Adoption. People install the update. This is the slowest and least predictable stage, because it depends on millions of separate choices.

The order matters most when an attacker finds the flaw first. Then the vendor may learn about it only after attacks are already happening, and everyone is racing.

Release also starts a new clock. You saw in iOS Internals that a fix can hint at where the hole was. Once a patch is public, skilled attackers can compare the old code with the new code and work backward to the flaw. A phone that hasn't updated is now running software with a publicly known hole.

That's why updating matters so much. A patch fixes the flaw on every phone that installs it, the same way changing a building's lock protects every tenant at once. You don't need to know which of the 40 fixes in an update affected you. You install the update, and they're all closed.

The flip side: a patch does nothing for a phone that never installs it. Many real attacks use flaws that were fixed long ago, aimed at devices that were never updated.

Good habits follow directly. Turn on automatic updates, install security updates within days rather than months, and restart when the phone asks, since many updates only take effect after a restart.