Zero day attack

From Wikipedia, the free encyclopedia

This article is about unpatched technical vulnerabilities. For other uses, see Zero day (disambiguation).

A zero-day (or zero-hour) attack or threat is a computer threat that tries to exploit unknown, undisclosed or unpatched computer application vulnerabilities. The term Zero Day is also used to describe unknown or Zero day viruses.

Zero-day exploits are released before the vendor patch is released to the public. Zero-day exploits generally circulate through the ranks of attackers until finally being released on public forums. The term derives from the age of the exploit. A zero-day exploit is usually unknown to the public and to the product vendor ^[1].

The term zero-day can also be used to describe warez-group releases of pirated software on or before the release of the software.^[2]

1 Attack vectors
2 Vulnerability window
3 Protection
4 Ethics
5 Pirated software
6 See also
7 Footnotes
8 References
9 External links

[edit] Attack vectors

Malware writers are able to exploit zero-day vulnerabilities through several different attack vectors. For example, when users visit rogue (or black hat) Web sites, code on the site may exploit vulnerabilities in Web browsers. Web browsers are a particular target because of their widespread distribution and usage. Hackers can also send e-mail attachments via SMTP, which exploit vulnerabilities in the application opening the attachment^[3]. Exploits that take advantage of common file types are numerous and frequent, as evidenced by their increasing appearances in databases like US-CERT. Users with malicious intent can engineer malware to take advantage of these file type exploits to compromise attacked systems or steal confidential data^[4].

[edit] Vulnerability window

Zero-day attacks occur when a vulnerability window exists between the time a threat is released and the time security vendors release patches.^{[citation needed]}

For viruses, Trojans and other zero-day attacks, the vulnerability window follows this timeline:

Release of new threat/exploit into the wild
Detection and study of new exploit
Development of new solution
Release of patch or updated signature pattern to catch the exploit
Distribution and installation of patch on user's systems or updating of virus databases^{[citation needed]}

This process can last hours or days, during which networks experience the so-called vulnerability window. One report estimates the 2006 vulnerability window at 28 days^[5].

[edit] Protection

Zero-day protection is the ability to provide protection against zero-day exploits. Zero-day attacks also can remain undetected after they are launched^[6].

Many techniques exist to limit the effectiveness of zero-day memory corruption vulnerabilities, such as buffer overflows.^{[citation needed]} These protection mechanisms exist in contemporary operating systems such as Apple's Mac OS X, Microsoft Windows Vista [1], Sun Microsystems Solaris, GNU/Linux, Unix, and Unix-like environments; Microsoft Windows XP Service Pack 2 includes limited protection against generic memory corruption vulnerabilities^[7]. Desktop and server protection software also exists to mitigate zero-day buffer overflow vulnerabilities.^{[citation needed]}

The use of Port knocking or Single Packet Authorization daemons may provide effective protection against zero-day exploits. However these techniques are not suitable for environments with a large number of users.

The Zeroday Emergency Response Team, or ZERT^[8] is a group of software engineers who work to release non-vendor patches for zero-day exploits.

Another method to avoid zero day attacks is to wait for a reasonable period of time before upgrading the product. Exploits are often addressed in a timely manner by the software vendor. The fix can then be included as part of the upgrade/update process.

[edit] Ethics

Differing views surround the collection and use of zero-day vulnerability information. Many computer security vendors perform research on zero-day vulnerabilities in order to better understand the nature of vulnerabilities and their exploitation by individuals, computer worms and viruses. Alternatively, some vendors purchase vulnerabilities to augment their research capacity. An example of such a program is TippingPoint's Zero Day Initiative. While selling and buying these vulnerabilities is not technically illegal in most parts of the world there is a lot of controversy over the method of disclosure. A recent German decision to include Article 6 of the Convention on Cybercrime and the EU Framework Decision on Attacks against Information Systems may make selling or even manufacturing vulnerabilities illegal.

Most formal efforts follow some form of RFPolicy disclosure guidelines or the more recent OIS Guidelines for Security Vulnerability Reporting and Response. In general these rules forbid the public disclosure of vulnerabilities without notification to the vendor and adequate time to produce a patch.

[edit] Pirated software

Zero day warez refers to software, videos, music, or information unlawfully released or obtained on the day of public release. Items obtained pre-release are sometimes labeled Negative day or -day. Zero-day software, games, videos and music refers to the content that has been either illegally obtained or illegally copied on the day of the official release. These are usually works of a hacker or an employee of the releasing company.