5 ms·

It may seem pedantic, but since this vulnerability is publicly known since months back, and furthermore has been exploited in the wild (according to description

by etiam 6y ago

It may seem pedantic, but since this vulnerability is publicly known since months back, and furthermore has been exploited in the wild (according to description in the target article), is it not per definition not a 0day.

tinus_hn 6y ago
Not if the definition is ‘a known security issue with no patch’
- qeternity 6y ago
  Which it isn’t...
  - FreshFries 6y ago
    Which I thought was wrong, but even Wikipedia agrees with you: "A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who should be interested in mitigating the vulnerability (including the vendor of the target software)." Personally I have always used it as "there is not mitigation / patch available". Thanks for pointing me in the proper direction. Edit: I am old and stubborn, I still use 'hacker' as a compliment.
qeternity 6y ago
It seems that 0d has since become a synonym by some for unpatched exploit.
- Scuds 6y ago
  It feels l33t to appropriate the terminology of a professional - like "We need to control the optics of the situation" "I flashed my cellphone but it failed and now it's bricked." but the unsophisticated public gets it wrong and now here we are, every recent unpatched exploit is now 0day
  - segfaultbuserr 6y ago
    > I flashed my cellphone but it failed and now it's bricked. It doesn't sound wrong to me, both "flash" and "brick" are correct in an appropriate context. It's not "updating the system" but "flashing" if the process uses some low-level recovery mode, and it would be "bricked" if can no longer be recovered by usual means.
    - gruez 6y ago
      Most of the time "flashing" a phone (presumably referring to androids) involves using the recovery, which is basically a stripped down version of android. In that sense it's not any lower level than booting off a USB drive to fix your computer.
      - segfaultbuserr 6y ago
        According to your standard: to "flash" something, at least you need to use the bootloader itself, or possibly at a lower level? Well, calling the process of uploading a firmware image to an embedded device during early boot via U-Boot as "firmware flashing" is well established, so we can start from here... thus, uploading a new Android image in Android Recovery is not "flashing", but uploading a "recovery" image in Android bootloader is? Now, would you call firmware uploading via iOS's DFU mode "flashing" too? Or do you believe that the DFU mode is end-user accessible, thus not low-level enough? Then, would you accept that uploading the firmware to the baseband processor (which I believe uses its own EEPROM) via DFU "flashing"? I guess the definition varies, it was what I meant by "an appropriate context".
        gruez 6y ago
        >thus, uploading a new Android image in Android Recovery is not "flashing", but uploading a "recovery" image in Android bootloader is? Now, would you call firmware uploading via iOS's DFU mode "flashing" too? Or do you believe that the DFU mode is end-user accessible, thus not low-level enough? Then, would you accept that uploading the firmware to the baseband processor (which I believe uses its own EEPROM) via DFU "flashing"? The difference is that the recovery is almost a full blown operating system. It can mount filesystems, has various shell utilities installed, and there's a user interface (through ADB and on-screen). This in contrast to fastboot which has noneof those things, and only allows you to flash/erase partitions with the help of a computer.
- ASalazarMX 6y ago
  The days can be reasonably counted since the release of a fix: 0-day would be an exploit for which there is no defense, and a n-day would be an (old) exploit patched since n-days. The most valuable time of an exploit is not the time of discovery, but the time of resolution.
  - qeternity 6y ago
    This isn’t a guessing game. Zero day has a very specific meaning. Just because something isn’t patched doesn’t mean it can’t be mitigated (i.e. disable the service) so no, patching is not the most important. Disclosure is.
    - ASalazarMX 6y ago
      By defense I meant patch or mitigation. When using the sysadmin hat, I don't care when the bug was discovered or disclosed, I only care about when was it fixed, or how can it be mitigated. Sorry my reply came so late.
albntomat0 6y ago
It was an 0-day at one point in time though. Unless you're the one using it, an exploit is only ever an 0-day in the past. An alternative title could include "actively used" or similar to maybe be more clear.
- cortesoft 6y ago
  So then every exploit is a zero day?
  - verroq 6y ago
    They all begin as a zero day.
    - tremon 6y ago
      Not true, some exploits are written by examining the holes fixed by a vendor security patch, then writing an exploit to target the systems that haven't been patched yet. Those are not zero-day exploits.
      - verroq 6y ago
        Usually we say vulnerabilities are 0-days instead of 0-day exploits.
  - albntomat0 6y ago
    Every one that is initially found and used by an attacker, up until it is detected. The exploit was a 0-day at one point in time. Furthermore, I'd argue that the perspective of the one talking also matters. If Microsoft etc know about it, but haven't patched it or made anything public, it's definitely a 0-day if used against me, as I haven't had any opportunity to defend against it.
kjaftaedi 6y ago
The reason it is considered a 0day is because it is being exploited in the wild. This wasn't discovered by a security researcher looking for holes. This was discovered by a virus scanning company that realized people were actively being attacked using this method.
- saagarjha 6y ago
  It was a 0-day at that point. Right now it is a 90-day.
  - albntomat0 6y ago
    Only to Project Zero and Microsoft. Everyone else has known about it for exactly 2 hours.
    - saagarjha 6y ago
      Days are counted by how long a vendor has known about a bug, not the general public.
      - albntomat0 6y ago
        My understanding of the term is days are counted in the view of "the defender," which is more than Microsoft
        saagarjha 6y ago
        Microsoft would always be the first to know of the defenders–any other defender would just tell them. It then makes sense to count from there, rather than have multiple counts for each level of people learning of the vulnerability.
        albntomat0 6y ago
        I think your argument makes sense when the day counts are close to each other. There really isn't any difference between a 55-day and a 57-day, nor does it make sense to account for some sysadmin who took a vacation day. I still think that your usage of "0-day" breaks down precisely in the case we're in currently, where the vulnerability has been exploited in the wild and Microsoft has known about it for some time, but there is not a patch available, and the general public (everyone who has to defend against the exploit) found out about it today.
vmception 6y ago
Now using the concept of language, what distinction does that give you? What message does that convey to anyone better? 0-day versus "publicly disclosed unpatched vulnerability" doesnt help anyway
- mindslight 6y ago
  "0-day ... still not fixed" makes it sound like someone is expecting Microsoft to have created a patch for a new exploit with same day turnaround. And therefore what's the big deal that they haven't? If you want to use the "day" framing, the appropriate headline is "90-day exploit still not fixed". The entire point is that it's an old exploit that is still unpatched, and not some new discovery.
lmm 6y ago
The patch was released (less than) 0 days ago; that's the definition, no?

by etiam 6y ago

tinus_hn 6y ago

Not if the definition is ‘a known security issue with no patch’

qeternity 6y ago
Which it isn’t...
- FreshFries 6y ago
  Which I thought was wrong, but even Wikipedia agrees with you: "A zero-day (also known as 0-day) vulnerability is a computer-software vulnerability that is unknown to those who should be interested in mitigating the vulnerability (including the vendor of the target software)." Personally I have always used it as "there is not mitigation / patch available". Thanks for pointing me in the proper direction. Edit: I am old and stubborn, I still use 'hacker' as a compliment.

qeternity 6y ago

It seems that 0d has since become a synonym by some for unpatched exploit.

Scuds 6y ago
It feels l33t to appropriate the terminology of a professional - like "We need to control the optics of the situation" "I flashed my cellphone but it failed and now it's bricked." but the unsophisticated public gets it wrong and now here we are, every recent unpatched exploit is now 0day
- segfaultbuserr 6y ago
  > I flashed my cellphone but it failed and now it's bricked. It doesn't sound wrong to me, both "flash" and "brick" are correct in an appropriate context. It's not "updating the system" but "flashing" if the process uses some low-level recovery mode, and it would be "bricked" if can no longer be recovered by usual means.
  - gruez 6y ago
    Most of the time "flashing" a phone (presumably referring to androids) involves using the recovery, which is basically a stripped down version of android. In that sense it's not any lower level than booting off a USB drive to fix your computer.
    - segfaultbuserr 6y ago
      According to your standard: to "flash" something, at least you need to use the bootloader itself, or possibly at a lower level? Well, calling the process of uploading a firmware image to an embedded device during early boot via U-Boot as "firmware flashing" is well established, so we can start from here... thus, uploading a new Android image in Android Recovery is not "flashing", but uploading a "recovery" image in Android bootloader is? Now, would you call firmware uploading via iOS's DFU mode "flashing" too? Or do you believe that the DFU mode is end-user accessible, thus not low-level enough? Then, would you accept that uploading the firmware to the baseband processor (which I believe uses its own EEPROM) via DFU "flashing"? I guess the definition varies, it was what I meant by "an appropriate context".
      - gruez 6y ago
        >thus, uploading a new Android image in Android Recovery is not "flashing", but uploading a "recovery" image in Android bootloader is? Now, would you call firmware uploading via iOS's DFU mode "flashing" too? Or do you believe that the DFU mode is end-user accessible, thus not low-level enough? Then, would you accept that uploading the firmware to the baseband processor (which I believe uses its own EEPROM) via DFU "flashing"? The difference is that the recovery is almost a full blown operating system. It can mount filesystems, has various shell utilities installed, and there's a user interface (through ADB and on-screen). This in contrast to fastboot which has noneof those things, and only allows you to flash/erase partitions with the help of a computer.
ASalazarMX 6y ago
The days can be reasonably counted since the release of a fix: 0-day would be an exploit for which there is no defense, and a n-day would be an (old) exploit patched since n-days. The most valuable time of an exploit is not the time of discovery, but the time of resolution.
- qeternity 6y ago
  This isn’t a guessing game. Zero day has a very specific meaning. Just because something isn’t patched doesn’t mean it can’t be mitigated (i.e. disable the service) so no, patching is not the most important. Disclosure is.
  - ASalazarMX 6y ago
    By defense I meant patch or mitigation. When using the sysadmin hat, I don't care when the bug was discovered or disclosed, I only care about when was it fixed, or how can it be mitigated. Sorry my reply came so late.

albntomat0 6y ago

It was an 0-day at one point in time though. Unless you're the one using it, an exploit is only ever an 0-day in the past. An alternative title could include "actively used" or similar to maybe be more clear.

cortesoft 6y ago
So then every exploit is a zero day?
- verroq 6y ago
  They all begin as a zero day.
  - tremon 6y ago
    Not true, some exploits are written by examining the holes fixed by a vendor security patch, then writing an exploit to target the systems that haven't been patched yet. Those are not zero-day exploits.
    - verroq 6y ago
      Usually we say vulnerabilities are 0-days instead of 0-day exploits.
- albntomat0 6y ago
  Every one that is initially found and used by an attacker, up until it is detected. The exploit was a 0-day at one point in time. Furthermore, I'd argue that the perspective of the one talking also matters. If Microsoft etc know about it, but haven't patched it or made anything public, it's definitely a 0-day if used against me, as I haven't had any opportunity to defend against it.

kjaftaedi 6y ago

The reason it is considered a 0day is because it is being exploited in the wild. This wasn't discovered by a security researcher looking for holes. This was discovered by a virus scanning company that realized people were actively being attacked using this method.

saagarjha 6y ago
It was a 0-day at that point. Right now it is a 90-day.
- albntomat0 6y ago
  Only to Project Zero and Microsoft. Everyone else has known about it for exactly 2 hours.
  - saagarjha 6y ago
    Days are counted by how long a vendor has known about a bug, not the general public.
    - albntomat0 6y ago
      My understanding of the term is days are counted in the view of "the defender," which is more than Microsoft
      - saagarjha 6y ago
        Microsoft would always be the first to know of the defenders–any other defender would just tell them. It then makes sense to count from there, rather than have multiple counts for each level of people learning of the vulnerability.
        albntomat0 6y ago
        I think your argument makes sense when the day counts are close to each other. There really isn't any difference between a 55-day and a 57-day, nor does it make sense to account for some sysadmin who took a vacation day. I still think that your usage of "0-day" breaks down precisely in the case we're in currently, where the vulnerability has been exploited in the wild and Microsoft has known about it for some time, but there is not a patch available, and the general public (everyone who has to defend against the exploit) found out about it today.

vmception 6y ago

Now using the concept of language, what distinction does that give you? What message does that convey to anyone better? 0-day versus "publicly disclosed unpatched vulnerability" doesnt help anyway

mindslight 6y ago
"0-day ... still not fixed" makes it sound like someone is expecting Microsoft to have created a patch for a new exploit with same day turnaround. And therefore what's the big deal that they haven't? If you want to use the "day" framing, the appropriate headline is "90-day exploit still not fixed". The entire point is that it's an old exploit that is still unpatched, and not some new discovery.

lmm 6y ago

The patch was released (less than) 0 days ago; that's the definition, no?