5 ms·
Interesting article, but I don't see why it's titled '0-day' when he references a research paper from 2012. "Although these are old, they are classified as zer
by lilboiluvr69 6y ago
Interesting article, but I don't see why it's titled '0-day' when he references a research paper from 2012.
"Although these are old, they are classified as zero-day attacks because there is no solution."
They are?
- ltbarcly3 6y agoSo back a long time ago, we counted days from the time an exploit was 'known'. Now people seem to use it for the time since a patch has been released? I don't know, but every time I ask I get downvoted.
- judge2020 6y agoA 0-day generally means either one person, a single organization, or a small group of people, know about the exploit in question. As soon as an exploit is widely known or published, it's not a 0-day since anyone can find it, even if the exploit is for abandoned software that'll never receive a security fix.
- ltbarcly3 6y agoYep, that's what I said I think (by 'known' I meant publicly). Once it's widely known, it's a 0 day for 24 hours, then it's not anymore. That's what we used to mean by 0-day anyway. Other people will tell you that it's a 0-day until there is a patch against it. I think different people use this this phrase so divergently that using it isn't a useful way to communicate anymore.
- neltnerb 6y agoWhat is it called after there is a patch against it? Does it just stay at like a 27-day if it takes 27 days to patch? I feel like in common parlance calling something a 0-day would imply that it is something the manufacturer didn't expect and has no solution for which is a big problem. I guess whatever communicates information best. I kind of feel like we just use 0-day to mean big problems, everything else is just a bug that has some age, and then fixed stuff doesn't get remembered. Right? That seems fairly useful, at least in communicating to the general tech media.
- aj3 6y agoIf you know about the bug, but manufacturer does not provide any patches, you can still mitigate it, put in place detection measures or just stop using that software. You can't (necessarily) do those if you don't even know about the bug yet as it hasn't been published. That's why 0day is a useful term.
- waheoo 6y agoNot "known", but "disclosed" to the public, or at least those responsible for a patch. Zero days are known, exploited and used all the time by all sorts of black hats, govt institutions etc.
- cheschire 6y agoUsername checks out.
- bawolff 6y agoAt this point bloggers seem to mostly use 0-day to mean: i havez cool 1337 hackorz skillz, regardless of merit.
- dtho 6y agoIt started out as a 0-day in 2012, and since it has remained unpatched, it continues to be called a 0-day. That is how it is commonly used.
- tptacek 6y agoNo, that's not how the term is used.
- deleted 6y ago[deleted]
- AmericanChopper 6y agoKnown vulnerabilities or weaknesses that don’t have patches are not 0-days. A 0-day is a vulnerability that you don’t know exists yet. That’s how the term is used in risk management and threat modelling. You don’t have 0-days that you’ve known about for 8 years. They’re just known risks.
- varenc 6y agoDisagree. An 0-day is only a 0-day for 1 day after public disclosure. (and before) It's a useful distinction. 0-days are special because your target has no idea such a vulnerability even exists. This makes them very different than known but still unpatched vulnerabilities.
- dtho 6y agoHow does that make them very different? The latest version of the software is still exploitable in either case. In my opinion, that is why it's useful to call them 0-days until they are patched.
- varenc 6y agoOne difference: With an 0-day you know your target can't have done anything to specifically mitigate that vulnerability. If a vulnerability is well known but still unpatched by the vendor, a potential target can take their own steps to protect themselves. For example, if you're running some ancient mailing list software that you know has an unpatched XSS vulnerability, you can have your front end servers scan for attempts to exploit that and abort the requests. Or lock it down with a CSP policy. Or if you know your image manipulation library has tons of vulnerabilities, you could run it in a locked-down sandboxed environment where exploitation doesn't get the attacker much of anything.
- tptacek 6y agoThey are not. Zero counts from the time the vulnerability is disclosed, not when it's fixed. This is not a "zero day" vulnerability.
- tifadg1 6y agoSo if 10 years passed and this can still be exploited using tactics discussed a decade ago, how to classify this?
- bawolff 6y agoYou classify it as a threat that is outside the threat model that tor can defend against. Tor is a tool like any other. It has certain strengths and certain weaknesses. When you're evaluating any security product you always have to determine if the security properties the tool provides match up with the security properties you need. Tor is no different.
- DyslexicAtheist 6y agoit's a "known issue" maybe it should be mentioned in the documents with more clarity. it seems the author of this post stumbled over what is well known to many people and then went on a diatribe. looks like he hit a nerve so maybe it's really an issue with documentation. on the other hand people should learn about how to think via threat models. not sure if the tor project should be expected to cover every hypothetical scenario, and if they did would people study it?
- 0xggus 6y agoA whole set of mitigations were published on Tor Project's blog in 2018. https://blog.torproject.org/announcing-vanguards-add-onion-services https://blog.torproject.org/announcing-vanguards-add-onion-s...
- Darkstryder 6y agoAs a PhD student my main topic was the period of time just after the disclosure of a vulnerability. This is the most threatening stage of its life cycle as mitigations are not disseminated in the community yet (a patch may be available but nobody installed it yet, etc.). We struggled to find a commonly accepted term for vulnerabilities at this stage of their life cycle, but we finally settled on n-day vulnerability. This term have been relatively well accepted by the vulnerability research community. The exact length of this period is completely dependent on the velocity of the community to adopt a mitigation such as a patch. Heartbleed and Shellshock had been massively mitigated in a matter of days or weeks, but EternalBlue based-attacks still caught a lot of production systems off-guard more than a year after its disclosure.
- athrowaway3z 6y agoI've always understood it to mean : time/version since the software is vulnerable. 0 day ,from first release of the software, meaning all versions are vulnerable. Which was/is more relevant when commercial software is updated at most once ever year or two But it appears no one can agree anymore, making the term useless.
- varenc 6y agoHold the line! Let's make the term useful. An 0-day is an 0-day before public disclosure and for 24 hours after.
- fattire 6y agoAt one point in history a "0day" referred to a pirated release of software on/before it hit the shelves (and/or the crack that was released simultaneous to protected software aka "warez"). It was years later that a "0day" went from a copy protection removal/crack ("0day warez") to its more general modern usage in computer security. See: https://www.google.com/books/edition/_/8ETRQhDytIsC?hl=en&gbpv=1&bsq=warez%200-day https://www.google.com/books/edition/_/8ETRQhDytIsC?hl=en&gb...
- rrobukef 6y agoI see a consistent definition for the arguments of others: "You have zero days until this can and will be exploited. You have zero days until you need this patched." A zero day starts with it's exploit or public disclosure and ends with a released patch. It's not a zero day for private disclosure. Edited based on child comment about clarity
- tptacek 6y agoFor clarity: "private disclosure", even to the vendor, doesn't mean anything. At the point a vulnerability is publicly disclosed, patch or no patch, users can mitigate it (if only by ceasing their use of the affected software). "Zero" refers to the interval elapsed since the public, meaningful, disclosure of the vulnerability. If I find an RCE in Cisco IOS and report it Cisco, who sits on it for a few dozen months, and you later find the same RCE and circulate it amongst your friends, who exploit it, your friends are exploiting a zero-day vulnerability.
- deleted 6y ago[deleted]
- wp381640 6y agoHere is a technique that is used to uncover hidden services: 1. purchase VPS products at a bunch of providers who accept bitcoin / crypto 2. ddos your target 3. see if you notice any of your hosted boxes go down 4. once you know the provider pop them (they're usually running some shitty WHMCS or similar homebrew solution, old Cpanel, etc. etc. and they're almost always resellers and amateurs) and move laterally to your target When the feds do it against online drug markets (and they have been for years) they have the bonus of having decent network insight / view by working with backbone providers There is just no way to hide multi-Gb of traffic
- deleted 6y ago[deleted]
- londons_explore 6y agoThat's why you split your drug empire into a server for images and static stuff, and another server to run the rest. The server for the rest can be proxied through the image server, and through another tor connection. That way the feds only find your image server...
- pstuart 6y agoAnd perhaps throw some needles of steganography into the haystack.
- wp381640 6y agoMost of them do that now - the better markets have gateways that are CAPTCHA'd and spread out over other providers that then proxy to the real hidden service (you can do this with a second step over Tor again) Checkout this project which is now being more widely deployed to prevent a lot of these attacks: https://github.com/onionltd/EndGame https://github.com/onionltd/EndGame
- chromedev 6y agoPretty cool, but you'd think they would just have a Dockerimage ready to be deployed and a network driver or something similar for these types of challenges.
- st_goliath 6y agoThis is the same person who had a blog post on the front page ~2 months back, rambling about a JavaScript scroll bar issue, the fact that an ISP could block entry node traffic, and a few other things along those lines ("omg, 0 day!"): https://news.ycombinator.com/item?id=23929312 https://news.ycombinator.com/item?id=23929312 Both blog posts probably ended up on the front page and got quite a bit of attention because the words "0 day" and "tor" were used in close proximity, something the author is apparently very fond of doing (the posts are part of a series titled "Tor 0day").
- ingen0s 6y agoGot us reading so that's good