What is a zero-day exploit?
Overview
Network intrusions and software exploits that go undetected after being discovered by a potential hacker because of a vulnerability in the network or software are known as zero-day exploits. An attack is launched after the exploit is found, and the victim organization has zero days to fix the issue, hence the name "zero-day" exploit.
Control flow
The following terminology is necessary for understanding the control flow of a zero-day exploit:
- Exploit/vulnerability: This is an unseen bug in the software. A backdoor that provides access to private information or a loophole that bypasses security measures set in place.
- Hacker: The person who discovers an exploit or a vulnerability in the software/network.
- Attacker: The entity which uses the exploit against the interest of the vulnerable organization. It is not necessarily the same person as the hacker.
- Victim: The victim is usually a network/software organization with valuable data that can be used against itself or its users.
Attack phase
The attack phase comprises the following steps:
- The hacker persistently probes and bypasses the security measures and defenses set in place by the target by finding bugs that can be used as a loophole or a backdoor. This allows them access to data that is meant to be kept private or some other exploit that can launch a DOS attack on the target software/network.
- The hacker then has the choice to either inform the vulnerable organization about the exploit or to sell it on the dark web.
- The attacker incorporates the Zero-Day Exploits into their attack, and once the program/payload is concocted, the attack is launched. Since Zero-Day Exploits are previously unknown, they include the element of surprise for the victim. However, some attacks may go unnoticed until the targeted organization finds them.
Defense phase
The defense against a zero-day attack would comprise the following:
- The organization first detects the vulnerability or the exploit. This step is followed by a thorough analysis of the event that led the organization to believe there was a security breach.
- The timestamp when the breach occurs, and the process that caused it are identified using various techniques (mentioned below).
- The exploit or the vulnerability is patched with the organization’s joint efforts and a cyber security firm.
- The attack’s methodology is made public to prevent other organizations from falling for the same episode.
Prominent zero-day exploits
Some examples of prominent zero-day attacks are as follows::
- Zoom: The exploit allowed attackers to remotely execute code on a host machine via memory corruption in Windows 7.
- Microsoft Word: When we open a Word Document, it triggers a server to download malicious HTML code on the host machine. The HTML application introduced malware into the host system.
- Apple iOS: An exploit in iOS allowed attackers to remotely access and control the user's device and compromise information.
Countermeasures and prevention
Auditing and intrusion detection techniques can be used to identify and block the attack. Keeping logs for activities on a system makes it easier for the organization to lead back to the cause of the attack. Cyber security specialists and analysts can use data provenance graphs for this purpose. They eventually lead back to the reason that resulted in the attack. Therefore, the exploit is identified and patched.
Some other helpful prevention techniques include using
