Software vulnerabilities

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes a software vulnerability?

A Any program that runs slowly on a device

B A flaw or bug in code or settings that an attacker could use

2. A programmer forgets to check how long a user's input is, and this lets an attacker crash the app. What is this?

A A feature that makes the app more secure

B A coding mistake that creates a vulnerability

3. A router ships with the admin password set to 'admin' for every customer. What type of vulnerability is this?

A An insecure default setting

B A hardware fault in the cables

4. True or false: a vulnerability only exists once an attacker has already used it.

A False: it exists as soon as the flaw is there

B True: it only counts after an attack

5. Why do large programs with millions of lines of code tend to have more vulnerabilities?

A More code gives more places for bugs to hide

B Big programs are always written by careless people

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1password = "admin123" # default login		AAny program can have vulnerabilities. Though more code usually means more places for bugs, even small apps have flaws.
2for i in range(11): items[i] = 0		BA coding mistake: the loop writes past the end of a 10-item list, which is a bug an attacker might exploit
3A software vulnerability can be a flaw in a program's settings, not just its code		CA vulnerability is the weakness (a bug or bad setting). The attack is what happens when someone uses it.
4A coding mistake is a vulnerability when the program trusts input it never checked		Dallow_guest_access = True # default
5Thinking: "Only big programs have vulnerabilities, so my small app is safe."		Equery = "SELECT * FROM users WHERE name='" + name + "'"
6Thinking: "A vulnerability is the attack itself, such as a hacker stealing data."		FAn insecure default setting: a well-known password left in place that attackers can easily guess

Definitions

software vulnerability

Fill in the Blanks

Complete each line of code by filling in the missing parts.

debug = _____ # off on live sites

if ___(name) <= 20: print(name)

bugs = _____ * rate

password = "admin" if ________ == "admin": print("Change the default!")

newpass = _____("Set a new one: ")

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A def login(user, pw):

B if True:

C return True

D return False

Question 2

A admin_pw = "admin"

B save("admin", admin_pw)

C print("Change password now")

Question 3

A cfg = load_defaults()

B cfg["debug"] = False

C cfg["guest_login"] = False

D cfg["remote_admin"] = True

Question 4

A age = input("Age: ")

B if not age.isdigit():

C pass

D print("Age saved")

Question 5

A old_features = ["beta_api"]

B for f in old_features:

C enable(f)

Answer Key

Software vulnerabilities

Section A: Quick Questions

B — A flaw or bug in code or settings that an attacker could use

B — A coding mistake that creates a vulnerability

A — An insecure default setting

A — False: it exists as soon as the flaw is there

A — More code gives more places for bugs to hide

Section B: Match the Pairs

password = "admin123" # default login → An insecure default setting: a well-known password left in place that attackers can easily guess

for i in range(11): items[i] = 0 → A coding mistake: the loop writes past the end of a 10-item list, which is a bug an attacker might exploit

A software vulnerability can be a flaw in a program's settings, not just its code → allow_guest_access = True # default

A coding mistake is a vulnerability when the program trusts input it never checked → query = "SELECT * FROM users WHERE name='" + name + "'"

Thinking: "Only big programs have vulnerabilities, so my small app is safe." → Any program can have vulnerabilities. Though more code usually means more places for bugs, even small apps have flaws.

Thinking: "A vulnerability is the attack itself, such as a hacker stealing data." → A vulnerability is the weakness (a bug or bad setting). The attack is what happens when someone uses it.

Section C: Definitions

software vulnerability — A flaw or bug in a program's code or settings, such as a coding mistake or an insecure default, that an attacker could use to get access or cause damage.

Section D: Fill in the Blanks

debug = False # off on live sites

if len(name) <= 20:
    print(name)

bugs = lines * rate

password = "admin"
if password == "admin":
    print("Change the default!")

newpass = input("Set a new one: ")

Section E: Spot the Error

B — This coding mistake means the password is never checked, so anyone can log in. It should be: if check_hash(user, pw):

A — A default password that is easy to guess is an insecure default setting. Attackers try these first. It should be a random password: make_random_pw()

D — Turning remote admin on by default is an insecure default setting that gives attackers a way in. It should be False unless it is needed.

C — The program should stop when the input is not a number. Using pass lets bad input through, which is a coding mistake attackers can use. It should be exit().

C — Unused old code should be turned off or removed. The more code that is running, the more bugs it can hide. It should be disable(f).