3 ms·

>0-day attacks that rely on vulnerabilities known to the vendor for a long while. Could someone clarify the meaning of a 0-day attack? From what I understood,

>0-day attacks that rely on vulnerabilities known to the vendor for a long while. Could someone clarify the meaning of a 0-day attack? From what I understood, it's an attack that happens on the day it was discovered - with, often times, the discovery happening soley because of the attack. If the vulnerability was known to the vendor for a long while is it still a 0-day attack?

fragmede 16y ago
Not really. 0-day refers to the number of days the vendor had to patch the vulnerability before it was actively being exploited. http://en.wikipedia.org/wiki/Zero-day_attack http://en.wikipedia.org/wiki/Zero-day_attack ('Bricking' is another term of late that's undergone abuse, let's not even get started on 'hacking')
jjguy 16y ago
An "0-day" is generally any "non-public" vulnerability. Any "0-day attack" is an any attack that uses an 0-day. If only the security researcher and vendor know of the vulnerability details, it is still an 0-day. Once the vendor releases a patch, bindiff will (usually) point very rapidly to the root cause. Thus, the details are considered public, regardless of previous disclosure details. These capture the imagination and frustrate system administrators because 0-day -- due to their unknown nature and nearly infinite possibility -- cannot be simply "fixed." This has been a core frustration of mine in the network defense community for years: our procedures are too narrowly focused on protection -- keeping bad guys out. This is necessary but insufficient. We must assume bad guys will get in and focus on how we detect, respond and recover. Unfortunately, these last three steps get ignored too often -- resulting in bad guys never being detected once they're inside the gates.
- JoachimSchipper 16y ago
  You seem to totally ignore historical data - i.e. you install software that had 300 vulnerabilities last year, then assume it will get hacked. Restricting yourself to software with, say, at most one vulnerability in the last five years helps a lot. (Yes, I know this can be "impractical". But then you deserve what you get.)
InclinedPlane 16y ago
"0-day" means nothing more than "unpatched". It's a silly terminology in my opinion.

fragmede 16y ago

Not really. 0-day refers to the number of days the vendor had to patch the vulnerability before it was actively being exploited. http://en.wikipedia.org/wiki/Zero-day_attack http://en.wikipedia.org/wiki/Zero-day_attack ('Bricking' is another term of late that's undergone abuse, let's not even get started on 'hacking')

jjguy 16y ago

An "0-day" is generally any "non-public" vulnerability. Any "0-day attack" is an any attack that uses an 0-day. If only the security researcher and vendor know of the vulnerability details, it is still an 0-day. Once the vendor releases a patch, bindiff will (usually) point very rapidly to the root cause. Thus, the details are considered public, regardless of previous disclosure details. These capture the imagination and frustrate system administrators because 0-day -- due to their unknown nature and nearly infinite possibility -- cannot be simply "fixed." This has been a core frustration of mine in the network defense community for years: our procedures are too narrowly focused on protection -- keeping bad guys out. This is necessary but insufficient. We must assume bad guys will get in and focus on how we detect, respond and recover. Unfortunately, these last three steps get ignored too often -- resulting in bad guys never being detected once they're inside the gates.

JoachimSchipper 16y ago
You seem to totally ignore historical data - i.e. you install software that had 300 vulnerabilities last year, then assume it will get hacked. Restricting yourself to software with, say, at most one vulnerability in the last five years helps a lot. (Yes, I know this can be "impractical". But then you deserve what you get.)

InclinedPlane 16y ago

"0-day" means nothing more than "unpatched". It's a silly terminology in my opinion.