What is 0day exploit. Overview.

[DronVR]

What 0 day exploit. Overview.

0 day vulnerability also known as 0 computer day, these are flaws or vulnerabilities in software, hardware or firmware, to an unknown party or parties.

0day may relate to the vulnerability itself, or may relate to an exploit with 0 day, which uses the vulnerability to attack vulnerable systems.

How does it work 0 day exploit?
Exploit with 0 day is an attack that exploits a previously unknown security vulnerability. An attack with 0day is also sometimes defined as an attack that exploits a security vulnerability on the same day that the vulnerability becomes well known. In other words, the time between vulnerability detection and the first attack is “ 0 day. "

Historically, vulnerabilities that cause attacks 0 day, were triggered by unsafe software development practices. To mitigate these vulnerabilities, developers must create and release patches, and users, especially enterprises, must install patches in a timely manner.

When a researcher discovers a security vulnerability in an operating system, application, or any other code or system, the researcher or their company often notifies the supplier or manufacturer of the erroneous system, so you can take measures to eliminate the deficiency with a patch or suggestions to mitigate the vulnerabilities.

Security researchers collaborate with vendors and usually agree to keep secret all details of vulnerabilities with 0 day for a reasonable period of time before publishing this data. For example, Google Project Zero follows industry guidelines that give vendors up to 90 days to fix a vulnerability before a researcher who finds a vulnerability publicly reveals a flaw. For vulnerabilities that are considered “critical”, Project Zero gives only 7 days for the vendor to fix it before the vulnerability is published; if the vulnerability is actively exploited, Project Zero can reduce the time for a response from the supplier to less than seven days.

Detection 0 exploit day.
Operations with 0 day is usually very difficult to detect. By definition, these exploits are previously unknown, which means that signature-based security tools such as antivirus software, as well as some intrusion detection systems (IDSes) and intrusion prevention systems (IPSes) are completely ineffective in detecting an exploit because there is no attack signature.

One effective attack detection technique with 0 day is user behavior analytics. Most objects that have access to networks show certain patterns of use and behavior that are considered normal. Actions beyond the normal scope of operations may be an indicator of attack. 0 day ..

For example, a web application server typically responds to requests that are considered normal for that application; the application, in turn, responds to these requests in a certain way. If outbound packets are detected coming from the port assigned to this web application and these packets do not match what is normally generated by the application, this is a good sign that an attack is underway.

Exploit Period 0day
After 0 The day vulnerability became public, it will be referred to as the n-day vulnerability (also known as the one-day vulnerability).

These n-day vulnerabilities continue to function and are also used after the vulnerabilities have been fixed or fixed by other providers. For example, the Equifax credit bureau was hacked in 2017 by cybercriminals using an exploit targeting the vulnerability of the Apache Struts web infrastructure. Attackers used the vulnerability in Apache Struts, which was reported earlier this year, were amended; Equifax failed to fix this vulnerability, and was hacked by cybercriminals using a non-filtered vulnerability.

Similarly, researchers continue to find vulnerability during the day in the Block Message Server protocol, which has been used in Windows for many years. Once a zero-day vulnerability becomes public, users must fix their systems, but attackers continue to exploit vulnerabilities on the Internet as long as unsecured systems remain vulnerable.

Protection from 0day attacks.
It's too hard to defend against 0 day attacks because they are so hard to spot. Vulnerability checker software uses malware scan signatures to compare suspicious code with signatures of known malware; when malware uses a 0day exploit that has never been seen before, such vulnerability scanners will not be able to block malicious malware.

Insofar as 0 The day vulnerability cannot be known in advance; there is no way to defend against a particular exploit until it is detected and entered into the signatures of antivirus programs. However, companies can reduce their risk by doing the following:

• Use virtual LANs to separate some areas of the network or use dedicated physical or virtual network segments to isolate sensitive traffic between servers.
• Implement IPsec, an IP security protocol, to apply encryption and authentication to network traffic.
• Apply IDS or IPS. Although signature-based IDS and IPS security products cannot identify an attack, they can alert your computer-protecting programs of suspicious activity that occurs as a side effect of an attack.
• Use a network access control tool to prevent malicious machines from accessing critical parts of the corporate environment.
• Block wireless access points and use a security scheme such as Wi-Fi 2 secure access for maximum protection against attacks via wireless networks
• Keep all systems updated. Despite the fact that patches do not prevent a 0day attack, keeping the functionality updated with full network resources can make it difficult for attacks to achieve their goals. When the 0day patch becomes available, apply it as soon as possible.
• Perform regular vulnerability scanning for corporate networks and block detected vulnerabilities.

Despite the fact that maintaining a high level of information security cannot be prevented and does not hinder everyone 0 day attacks, but it can help prevent 0 day attacks that will be performed after the vulnerabilities have been fixed.

Examples 0 day attacks.
Multiple 0 Day attacks usually occur every year. For example, in 2016 there was 0 day attack (CVE-2016-4117), which exploited a previously undetected flaw in Adobe Flash Player. Also in 2016, more than 100 organizations fell into error 0 day (CVE-2016-0167), which was used to increase the privilege of an attack that targets mainly Microsoft Windows.

In 2017, it was discovered 0 day vulnerability (CVE-2017-0199), in which it was shown that a Microsoft Office document in an expanded text format could trigger the execution of a visual base script containing PowerShell commands when opened. Another 2017 exploit (CVE-2017-0261) used encapsulated PostScript as a platform to initiate malware infection.

Stuxnet worm was devastating 0 day exploit, which was aimed at monitoring and data acquisition systems (SCADA) the first attack of computers running Windows operating system. Stuxnet used four different 0 day vulnerabilities in Windows also spread through infected USB drives, which made it possible to remotely infect both Windows and SCADA systems without attacking them through the network. It has become well known that the Stuxnet worm is the result of the joint efforts of American and Israeli intelligence agencies to curb the Iranian nuclear program.

Source @Kevin Mitnick