מהו ניצול יום אפס? התקפות האבטחה המסוכנות ביותר, הסביר

There are errors (bugs) and security vulnerabilities in the code of almost all software. The more extensive the code, the more there are. Many of these security flaws are discovered over time by users or even by the manufacturer itself and plugged with a patch or the next update. Some, however, are first tracked down by criminal hackers who first keep this knowledge to themselves. They then either use the security hole themselves to penetrate other people’s systems, or they sell their find, often for horrendous sums.

What is a zero day flaw?

Such newly discovered security vulnerabilities are called zero days, sometimes also spelled 0 יום. This refers to the amount of time the manufacturer has to close the gap. “Zero days” means that the company has no time at all to develop a patch and publish it. This is because the hackers are already actively exploiting the vulnerability. To do so, they use a zero-day exploit, i.e. a method specially developed for this vulnerability, and use it to carry out a zero-day attack.

As soon as the software manufacturer learns about the vulnerability, it can develop a patch that specifically changes the responsible part of the code. Or it publishes an update, i.e. a revised and cleaned-up version of his program. As soon as a patch or an update exists, the exploit is no longer effective, the zero-day threat is officially over.

However, since many users do not apply patches immediately, but only after a few days or weeks delay, the danger posed by the vulnerability remains for a while.

Zero-day attacks are among the most dangerous of all. Because as long as the vulnerability is unknown to manufacturers and users, they do not take any preventive protective measures. For days, sometimes weeks or months, the attackers can scout out other people’s computer systems unnoticed, obtain higher rights, download confidential data, or install malware. Anti-virus tools are designed to detect such activities. Nevertheless, attackers succeed time and again in disguising themselves so well that they sometimes remain undetected.

לקריאה נוספת: תוכנת האנטי-וירוס הטובה ביותר עבור מחשבי Windows

Coveted secret information: Prizes of a million and more

A zero-day security vulnerability has a high value on the black market. Six- to seven-figure sums are offered on the dark web for a newly detected and not yet patched security hole in Windows. But it is not only criminals who are interested in the vulnerabilities. In the past, secret services also exploited the gaps to carry out attacks on databases and infrastructure of other states.

The best-known example is Stuxnet: A computer worm reportedly developed by Israel and the USA was infiltrated into the systems of the Iranian nuclear program. Through several previously unknown security holes in Windows, it managed to take root in the system. It then manipulated the control of centrifuges for the production of fissile material so that they were defective after a short time, but did not issue an error message.

Governments and companies also use zero-day vulnerabilities for industrial espionage, i.e. to tap into plans for new developments, company data, and contact addresses. And finally, hacktivists also resort to this means to draw attention to their political or social goals.

Due to the high danger potential of zero-day flaws and the high sums paid for their disclosure, several large software companies have launched bug bounty programs. This “bounty for bugs” is paid by manufacturers like Microsoft for newly discovered security holes and other bugs in their operating systems and applications. The bounties are mostly based on the severity of the bug and range from three to six figures.

תשומת הלב: 5 התקפות ה-Wi-Fi המסוכנות ביותר, וכיצד להילחם בהן

How to detect zero-day attacks

When searching for malware, modern antivirus programs work not only with virus signatures, but also with heuristic methods and artificial intelligence. The manufacturers train them with the behavioral patterns of known malware in order to be able to detect new variants. However, this only works to a limited extent, as zero-day exploits always use different attack methods.

Behavior-based security solutions are often used in companies. Intrusion detection systems monitor log files and system information such as CPU utilization to identify conspicuous activities within a network and on individual computers. In this case, they issue a warning message or send an e-mail to the administrator. Intrusion prevention systems go one step further and automatically trigger countermeasures such as changes to the firewall configuration. However, such applications are very expensive and only suitable for businesses.

How to protect yourself from zero-day exploits

Zero-day attacks are not only directed against companies. Hacker groups sometimes also try to lure private users to malicious websites via widely distributed phishing attacks by e-mail, or to persuade them to install software with zero-day exploits, sometimes via scammy Google ads.

You can protect yourself with a few simple measures:

• Install patches and updates as soon as they appear. Windows does this automatically by default, so you should not change anything. Use tools like סומו to search for available updates for Windows applications.
• Only download software from trustworthy sources such as the manufacturer’s website.
• Only install the programs you actually need. The more software there is on the computer, the more potential vulnerabilities there are.
• Use a firewall. The Windows firewall is switched on by default and should not be deactivated.
• לגלות על typical phishing tricks used by criminals.

מאמר זה תורגם מגרמנית לאנגלית והופיע במקור באתר pcwelt.de.