Zero-day attack: Difference between revisions
Content deleted Content added
Magioladitis (talk | contribs) see also: |
Deku-shrub (talk | contribs) ←Redirected page to Zero-day (computing) |
||
| Line 1: | Line 1: | ||
#REDIRECT [[Zero-day (computing)]] |
|||
{{Cleanup|date=April 2006}} |
|||
{{otheruses4|the technology-related term|the 2003 film|Zero Day}} |
|||
A '''zero-day''' (or '''zero-hour''') '''attack''' is a computer threat that exposes undisclosed or unpatched [[computer application]] vulnerabilities. Zero-day attacks can be considered extremely dangerous because they take advantage of computer security holes for which no solution is currently available. |
|||
0-day [[Exploit (computer security)|exploits]] are released before, or on the same day the [[vulnerability (computing)|vulnerability]] — and, sometimes, the vendor patch — are released to the public. The term derives from the number of days between the public advisory and the release of the exploit. <ref>[http://netsecurity.about.com/od/newsandeditorial1/a/aazeroday.htm About Zero Day Exploits]</ref> This definition leaves something to be desired as the name itself is an indication of the vendor patch being available, i.e. the vulnerability affected unpatched systems for zero days. |
|||
The terms can also be used to describe [[warez]]-group releases of pirated software on or before the release of the software. |
|||
==Attack vectors== |
|||
[[Malware]] writers can exploit zero-day vulnerabilities through several different attack vectors. Sometimes, when users visit rogue Web sites, malicious code on the site can exploit vulnerabilities in Web browsers. Web browsers are a particular target for criminals because of their widespread distribution and usage. Cybercriminals can also send malicious e-mail attachments via [[SMTP]], which exploit vulnerabilities in the application opening the attachment.<ref>[http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9005117 ''SANS sees upsurge in zero-day Web-based attacks'', ''Computerworld'']</ref> Exploits that take advantage of common file types are numerous and frequent, as evidenced by their increasing appearances in databases like [[US-CERT]]. Criminals can engineer malware to take advantage of these file type exploits to compromise attacked systems or steal confidential data.<ref>"E-mail Residual Risk Assessment" Avinti, Inc., p. 2 http://www.avinti.com/download/case_studies/whitepaper_email_residual_risk.pdf</ref> |
|||
==Vulnerability window== |
|||
Zero-day attacks can occur because a [[vulnerability]] window exists between the time a threat is released and the time security vendors release patches. |
|||
For viruses, Trojans and other zero-day attacks, the vulnerability window follows this timeline:- |
|||
* Release of new threat/exploit into the wild |
|||
* Detection and study of new exploit |
|||
* Development of new solution |
|||
* Release of patch or updated signature pattern to catch the exploit |
|||
* Distribution and installation of patch on user's systems or updating of virus databases |
|||
This process can often last hours, during which networks experience the vulnerability window. One report estimates the 2006 vulnerability window at 28 days.<ref>"Internet Security Threat Report" Symantec Corp, Vol. X, Sept. 2006, p. 12</ref> |
|||
==Protection== |
|||
0-day protection is the ability to provide protection against 0-day exploits. Since 0-day attacks are generally unknown to the public, it is often difficult to defend against them. 0-day attacks are often effective against "secure" networks and can remain undetected even after they are launched. Thus, users of so-called secure systems must also exercise common sense and practice safe computing habits. <ref>[http://what-is-what.com/what_is/zero_day_exploit.html What is a Zero-Day Exploit?]</ref> |
|||
Many techniques exist to limit the effectiveness of 0-day memory corruption vulnerabilities, such as [[buffer overflows]]. These protection mechanisms exist in contemporary operating systems such as [[Apple_Computer|Apple's]] [[Mac OS X]], [[Microsoft]] [[Microsoft Windows|Windows]] [[Windows Vista|Vista]] (see also: [[Security_and_safety_features_new_to_Windows_Vista]]), [[Sun Microsystems]] [[Solaris Operating System|Solaris]], [[Linux]], [[Unix]], and Unix-like environments; [[Microsoft]] [[Microsoft Windows|Windows]] XP Service Pack 2 includes limited protection against generic memory corruption vulnerabilities <ref>[http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2mempr.mspx Changes to Functionality in Microsoft Windows XP Service Pack 2]</ref> and previous versions include even less. All operating systems are working to improve their security over time. Desktop and server protection software also exists to mitigate 0-day buffer overflow vulnerabilities. Typically these technologies involve [[heuristic (computer science)|heuristic termination analysis]] -- stopping them before they cause any harm. |
|||
It has mistakenly been suggested that a solution of this kind may be out of reach because it is algorithmically impossible in the general case to analyze any arbitrary code to determine if it is malicious, as such an analysis reduces to the [[halting problem]] over a [[linear bounded automaton]], which is unsolvable. It is, however, unnecessary to address the general case (that is, to sort all programs into the categories of malicious or non-malicious) under most circumstances in order to eliminate a wide range of malicious behaviors. It suffices to recognize the safety of a limited set of programs (e.g., those that can access or modify only a given subset of machine resources) while rejecting both some safe and all unsafe programs. This does require the integrity of those safe programs to be maintained which may prove difficult in the face of a kernel level exploit. [[Symantec]]'s SONAR technology attempts to identify non-malware software by using an algorithm that detects traits of known-good software. Any newly installed program that does not meet the algorithm's criteria is flagged as potential malware. <ref>[http://www.infoworld.com/article/07/01/17/HNsymantecsonar_1.html Symantec unveils SONAR to find zero-day attacks]</ref> |
|||
The Zeroday Emergency Response Team, or ZERT <ref>[http://www.isotf.org/zert/ Zeroday Emergency Response Team]</ref> is a group of software engineers who work to release non-vendor patches for 0-day exploits. |
|||
==Worms== |
|||
[[Zero day]] [[computer worms|worms]] take advantage of a surprise attack while they are unknown to [[computer security]] professionals. [[Notable computer viruses and worms|Recent history]] shows an increasing rate of worm propagation. Well designed worms can spread within minutes (some say even seconds) with devastating consequences to [[Internet]] and otherwise. |
|||
==Ethics== |
|||
Differing ideologies exist around the collection and use of 0-day vulnerability information. Many computer security vendors perform research on 0-day vulnerabilities in order to better understand the nature of vulnerabilities and their exploitation by individuals, computer worms and viruses. Alternatively, some vendors purchase vulnerabilities to augment their research capacity. An example of such a program is [http://www.zerodayinitiative.com TippingPoint's Zero Day Initiative]. While selling and buying these vulnerabilities is not technically illegal in most parts of the world there is a lot of controversy over the method of disclosure. A 2006 German decision to include Article 6 of the [http://conventions.coe.int/Treaty/en/Treaties/Html/185.htm Convention on Cybercrime] and the EU Framework Decision on Attacks against Information Systems may make selling or even manufacturing vulnerabilities illegal. |
|||
Most formal programs follow some form of Rain Forest Puppy's disclosure guidelines or the more recent [http://www.oisafety.org/guidelines/secresp.html OIS Guidelines for Security Vulnerability Reporting and Response]. In general these rules forbid the public disclosure of vulnerabilities without notification to the vendor and adequate time to produce a patch. |
|||
==Pirated software== |
|||
'''Zero day warez''' refers to software, videos, music, or information unlawfully released or obtained on the day of public release. Items obtained pre-release are sometimes labeled ''Negative day'' or ''-day''. 0-day software, games, videos and music refers to the content that has been either illegally obtained or [[copyright infringement|illegally copied]] on the day of the official release. These are usually works of a hacker or an employee of the releasing company. |
|||
== See also == |
|||
* [[Access Control]] |
|||
* [[Network Access Protection]] |
|||
* [[Network Access Control]] |
|||
* [[Network Admission Control]] |
|||
* [[Targeted attacks]] |
|||
== References == |
|||
* Messmer, Ellen, [http://www.pcworld.com/article/id,130455/article.html ''Is Desktop Antivirus Dead?''], ''PC World'', April 6, 2007. |
|||
* Naraine, Ryan, [http://securitywatch.eweek.com/virus_and_spyware/antivirus_is_dead_dead_dead.html ''Anti-Virus Is Dead, D-E-A-D, Dead!''], ''eWeek'', December 1, 2006. |
|||
== External links == |
|||
* [http://research.eeye.com/html/alerts/zeroday/index.html Zero Day Tracker] |
|||
* [http://www.wormblog.com/ Worm Blog] |
|||
* [http://www.us-cert.gov US-CERT vulnerability database] |
|||
*Examples of zero-day attacks: |
|||
**[http://www.infoworld.com/article/07/02/15/HNzerodayinword_1.html Attackers seize on new zero-day in Word] from InfoWorld |
|||
**[http://www.foxnews.com/story/0,2933,204953,00.html PowerPoint Zero-Day Attack May Be Case of Corporate Espionage] from FoxNews |
|||
**[http://www.eweek.com/article2/0,1895,2068786,00.asp Microsoft Issues Word Zero-Day Attack Alert] from eWeek |
|||
== Footnotes == |
|||
{{reflist}} |
|||
[[Category:Security exploits]] |
|||
[[Category:Warez]] |
|||
[[Category:Computer network security]] |
|||
[[fr:Zero day]] |
|||
[[it:0-day]] |
|||
[[zh:0day]] |
|||
Revision as of 19:29, 17 May 2015
Redirect to: