By Hiranmayi Pai Neeraj Jain Zero-day Attacks By Hiranmayi Pai Neeraj Jain

Table of Contents Introduction Evolution of Vulnerabilities and Threats Propagation of Zero-Day Threats Characteristics of Zero-day attack Detecting a Zero-Day Compromise Prevention of Zero Day Infections Conclusion

Introduction What is a Zero-day attack? A zero-day or zero-hour  attack or threat is an attack that exploits a previously unknown vulnerability in a computer application The developer creates software containing an unknown vulnerability. The attacker finds the vulnerability before the developer does. The attacker writes and distributes an exploit while the vulnerability is not known to the developer The developer becomes aware of the vulnerability and starts developing a fix.

Evolution of Vulnerabilities and Threats In the past, IT security professionals, researchers and developers would publicly announce they found a vulnerability, primarily to motivate the vendor to release a patch. The average time to identify a vulnerability using reverse engineering techniques is only nine days from the time the patch is released. But, attackers are becoming more efficient, creative and faster at creating exploits these days.

Propagation of Zero-Day Threats Example 1(Windows 2000 dll) The earliest known zero-day exploit was discovered in March 2003 when the military realized one of their web servers had been compromised. The exploit involved an unchecked buffer overflow in the Windows 2000 dynamic link library, Ntdll.dll

Propagation of Zero-Day Threats Example 2 (Internet Explorer) In October 2003, a zero-day exploit known as the Qhosts Trojan surfaced. The exploit attacked the Internet Explorer Object Data Remote Execution vulnerability. The Trojan horse would automatically be downloaded and executed on an unsuspecting victim’s system only when specific code embedded in a banner ad was accessed with Internet Explorer.

Propagation of Zero-Day Threats Example 3(Adobe Reader) Cybercriminals are using a new PDF exploit that bypasses the sandbox security features in Adobe Reader X and XI, in order to install banking malware on computers. The attack fails in Google Chrome because Chrome provides additional protection for the Adobe Reader component, while the attack is successful using IE or Firefox

Propagation of Zero-Day Threats Example 4(Java Zero day ) When a compromised page is accessed, it forces the system to download an arbitrary payload, for example, a keylogger or calc.exe, without requesting any prior confirmation.

Propagation of Zero-Day Threats Example 5 (Internet Explorer) The attacks install the Poison Ivy backdoor Trojan when unsuspecting people browse a compromised website using a fully patched version of Windows XP running the latest versions of IE 7 or IE 8 and the Trojan hijacks the system.

Propagation of Zero-Day Threats Example 6 (RSA)  In March RSA revealed that their data related to their SecurID™ product was stolen. This stolen data was then used in further attacks against a number of military contractors.  The attachment contained an embedded Flash file which exploited CVE-2011-0609 in order to install a Backdoor program. Once the attackers had backdoor access they were able to install the PoisonIvy remote access tool in order to iterate through the network gathering credentials and eventually getting to the target machine which contained the sought-after data.

Characteristics of zero-day attack The most dangerous and likely vector of propagation for zero-day threats is a blended threat. Blended threats combine the characteristics of viruses, worms, Trojan Horses, and malicious code with server and Internet vulnerabilities to initiate, transmit, and spread an attack.

Characteristics of zero-day attack Causes harm Propagates by multiple methods Attacks from multiple points Spreads without human intervention Exploits vulnerabilities

Detecting a Zero-Day Compromise Behavior-based systems (IDS and IPS) alerts Antivirus software alerts as a result of heuristic scanning Unusual events in the system log files (i.e. failed logons) Poor system performance Unexplained system reboots Network traffic on unexpected ports, especially on ports known to be backdoor ports for known blended threats (i.e. MyDoom: TCP ports 3127 through 3198) Increased network traffic on a legitimate port Increased scanning activity Unusual SMTP traffic, especially originating from systems that should not be using SMTP

Prevention of Zero Day Infections

Prevention of Zero Day Infections Border Protection System Hardening Antivirus Software Patch Management Vulnerability Management Application Hardening Blocking Attachments Honeypots

Conclusion Zero-day threats are only in the beginning stages. If the history of vulnerabilities and exploits is any indicator, zero-day threats will progressively get worse and present the biggest challenge to guard against. New technologies that actively protect against Zero-day threats need to be developed by vendors.

THANK YOU 