Last updated at Wed, 14 Nov 2018 20:39:54 GMT

Something wicked this way comes ... this week’s Whiteboard Wednesday!

As a security professional, you don’t need a haunted house to feel spooked on Halloween—just start exploring your environment in search of vulnerabilities. Fortunately, Solutions Manager for Vulnerability Management and Offensive Security Products Justin Buchanan is using this week’s Whiteboard Wednesday to discuss four common vulnerabilities or vulnerability types and which Halloween costumes fit them best.

MS08-067

If you’re looking for a classic Halloween costume, you can’t go wrong with dressing as a ghost by tossing a white sheet over your head. Attackers have their own classic vulnerability they’ve loved to exploit since 2008: MS08-067. This buffer overflow vulnerability is known for its ability to provide unauthenticated remote code execution and for its involvement in the spread of the Conficker worm. Be sure to block off some time on your calendar in two weeks to celebrate(?) this vulnerability’s 10th birthday!

SQLi

According to our recent “Under the Hoodie” report, SQL injections (SQLi) are one of the most used web hacking techniques among our penetration testers and attackers in general. SQLi, which use the input field of an application to view or manipulate the contents of a database, are similar to last-minute, quickly assembled mice or angel costumes because they’re pretty easy to cobble together with the right materials.

Spectre (and Meltdown)

Affecting computer chips, Spectre gives low-level users access to sensitive information across many processor types. Its widespread impact is not unlike walking into a party and discovering all of your friends have gone in on a group Smurf costume, leaving you surrounded in a blue-hued horror movie come to life. And, of course, we have to give a special shout-out to Spectre and Meltdown for winning this year’s Awkward Couples Costume Award.

EternalBlue

This SMB exploit was made popular by its involvement with the WannaCry ransomware attack. The new fad, it’s what everyone is going to be using right now—just like everyone who boosted Eggo sales recently by dressing up as Eleven from “Stranger Things,” or wrenched a stuffed dragon out of a child’s hands to be Khaleesi from “Game of Thrones.” Who knows what the next big thing will be, but for now, EternalBlue is shining as bright as Joyce Byers’ living room.

Want to know whether these vulnerabilities are haunting your environment? Learn more about vulnerability management programs, and try InsightVM for free.

As always, if there is a topic you would like to see us cover on Whiteboard Wednesday, shoot us a tweet (@Rapid7) and use the hashtag #WBW. Thanks, and Happy Halloween!