Zero-day (computing)

For 0-day cracked software, see Warez.

A zero-day (also known as zero-hour or 0-day) vulnerability is a disclosed computer-software vulnerability that hackers can exploit to adversely affect computer programs, data, additional computers or a network.[1] It is known as a "zero-day" because once the flaw becomes known, the software's author has zero days in which to plan and advise any mitigation against its exploitation (for example, by advising workarounds or by issuing patches).[2]

Attacks employing zero-day exploits are often attempted by hackers before or on the day that notice of the vulnerability is released to the public; sometimes before the author is aware or has developed and made available corrected code.[3] Zero-day attacks are a severe threat.[4]

Name Origins

There are two main origins of the name "zero-day".

When a vulnerability was found in software, it would take a number of days before an exploit was created, whilst the software vendor (and anti-virus vendors) would attempt to find a way to patch the vulnerability. White hats would contact the software vendors and black hats would attempt to create an exploit for the vulnerability. As hackers became more sophisticated and capable, the windows of "days to patch release" would decrease.

Attack vectors

Malware writers can exploit zero-day vulnerabilities through several different attack vectors. Sometimes, when users visit rogue Web sites, malicious code on the site can exploit vulnerabilities in Web browsers. Web browsers are a particular target for criminals because of their widespread distribution and usage. Cybercriminals can also send malicious e-mail attachments via SMTP, which exploit vulnerabilities in the application opening the attachment.[5] Exploits that take advantage of common file types are numerous and frequent, as evidenced by their increasing appearances in databases like US-CERT. Criminals can engineer malware to take advantage of these file type exploits to compromise attacked systems or steal confidential data.[6]

Vulnerability window

Zero-day attacks can occur because a vulnerability window exists between the time a threat is released and the time security vendors release patches.

For viruses, Trojans and other zero-day attacks, the vulnerability window follows this timeline:

This process can often last hours, during which networks experience the vulnerability window. One report estimates the 2006 vulnerability window at 28 days.[7]

Protection

Zero-day protection is the ability to provide protection against zero-day exploits. Since zero-day attacks are generally unknown to the public, it is often difficult to defend against them. Zero-day attacks are often effective against "secure" networks and can remain undetected even after they are launched. Thus, users of so-called secure systems must also exercise common sense and practice safe computing habits.[8]

Many techniques exist to limit the effectiveness of zero-day memory corruption vulnerabilities, such as buffer overflows. These protection mechanisms exist in contemporary operating systems such as OS X, Windows Vista (see also: Security and safety features new to Windows Vista), Solaris, Linux, Unix, and Unix-like environments; Windows XP Service Pack 2 includes limited protection against generic memory corruption vulnerabilities[9] and previous versions include even less. All operating systems are working to improve their security over time. Desktop and server protection software also exists to mitigate zero-day buffer overflow vulnerabilities. Typically these technologies involve heuristic termination analysis—stopping them before they cause any harm.

It has mistakenly been suggested that a solution of this kind may be out of reach because it is algorithmically impossible in the general case to analyze any arbitrary code to determine if it is malicious, as such an analysis reduces to the halting problem over a linear bounded automaton, which is unsolvable. It is, however, unnecessary to address the general case (that is, to sort all programs into the categories of malicious or non-malicious) under most circumstances in order to eliminate a wide range of malicious behaviors. It suffices to recognize the safety of a limited set of programs (e.g., those that can access or modify only a given subset of machine resources) while rejecting both some safe and all unsafe programs. This does require the integrity of those safe programs to be maintained which may prove difficult in the face of a kernel level exploit. Symantec's SONAR technology attempts to identify non-malware software by using an algorithm that detects traits of known-good software. Any newly installed program that does not meet the algorithm's criteria is flagged as potential malware.[10]

The Zeroday Emergency Response Team (ZERT) was a group of software engineers who worked to release non-vendor patches for zero-day exploits.

Worms

Zero day worms take advantage of a surprise attack while they are unknown to computer security professionals. Recent history shows an increasing rate of worm propagation. Well designed worms can spread within minutes (some say even seconds) with devastating consequences to Internet and otherwise.

Ethics

Differing ideologies exist relative to the collection and use of zero-day vulnerability information. Many computer security vendors perform research on zero-day vulnerabilities in order to better understand the nature of vulnerabilities and their exploitation by individuals, computer worms and viruses. Alternatively, some vendors purchase vulnerabilities to augment their research capacity. An example of such a program is TippingPoint's Zero Day Initiative. While selling and buying these vulnerabilities is not technically illegal in most parts of the world there is a lot of controversy over the method of disclosure. A 2006 German decision to include Article 6 of the Convention on Cybercrime and the EU Framework Decision on Attacks against Information Systems may make selling or even manufacturing vulnerabilities illegal.

Most formal programs follow some form of Rain Forest Puppy's disclosure guidelines or the more recent OIS Guidelines for Security Vulnerability Reporting and Response. In general these rules forbid the public disclosure of vulnerabilities without notification to the vendor and adequate time to produce a patch.

Viruses

A zero-day virus (also known as zero-day malware or next-generation malware) is a previously unknown computer virus or other malware for which specific antivirus software signatures are not yet available.[11]

Traditionally, antivirus software relies upon signatures to identify malware. This can be very effective, but cannot defend against malware unless samples have already been obtained, signatures generated and updates distributed to users. Because of this, signature-based approaches are not effective against zero-day viruses.

Most modern antivirus software still use signatures, but also carry out other types of analysis.

Code analysis

In code analysis, the machine code of the file is analysed to see if there is anything that looks suspicious. Typically, malware has characteristic behaviour and code analysis attempts to detect if this is present in the code.

Although useful, code analysis has significant limitations. It is not always easy to determine what a section of code is intended to do; particularly if it is very complex and has been deliberately written with the intention of defeating analysis. Another limitation of code analysis is the time and resources available. In the competitive world of antivirus software, there is always a balance between the effectiveness of analysis and the time delay involved.

Emulation

One approach to overcome the limitations of code analysis is for the antivirus software to run suspect sections of code in a safe sandbox and observe their behaviour. This can be orders of magnitude faster than analysing the same code.

Generic signatures

Generic signatures are signatures that are specific to certain behaviour rather than a specific item of malware. Most new malware is not totally novel, but is a variation on earlier malware, or contains code from one or more earlier examples of malware. Thus the results of previous analysis can be used against new malware.

Competitiveness in the antivirus software industry

It is generally accepted in the antivirus industry that the signature-based protection of most vendors is identically effective. If a signature is available for an item of malware, then every product (unless dysfunctional) should detect it. However, some vendors are significantly faster than others at becoming aware of new viruses and/or updating their customers signature databases to detect them.

There is a wide range of effectiveness in terms of zero-day virus protection. The German computer magazine c't found that detection rates for zero-day viruses varied from 20% to 68%.[12] It is primarily in the area of zero-day virus performance that manufacturers now compete.

See also

References

  1. ↑ Compare: "What is a Zero-Day Vulnerability?". pctools. Symantec. Retrieved 2016-01-20. A zero day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it—this exploit is called a zero day attack.
  2. ↑ Flash Vulnerabilities Causing Problems
  3. ↑ About Zero Day Exploits
  4. ↑ THE MAN WHO FOUND STUXNET – SERGEY ULASEN IN THE SPOTLIGHT published on November 2, 2011
  5. ↑ SANS sees upsurge in zero-day Web-based attacks, Computerworld
  6. ↑ "E-mail Residual Risk Assessment" Avinti, Inc., p. 2 http://www.avinti.com/download/case_studies/whitepaper_email_residual_risk.pdf
  7. ↑ "Internet Security Threat Report" Symantec Corp, Vol. X, Sept. 2006, p. 12
  8. ↑ What is a Zero-Day Exploit?
  9. ↑ Changes to Functionality in Microsoft Windows XP Service Pack 2
  10. ↑ Symantec unveils SONAR to find zero-day attacks
  11. ↑ "Cyberhawk - zero day threat detection review". Kickstartnews. Retrieved 29 December 2013.
  12. ↑ Goodin, Dan (21 December 2008). "Anti-virus protection gets worse". The Channel. Retrieved 29 December 2013.

External links

This article is issued from Wikipedia - version of the Saturday, May 07, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.