Hot answers tagged zero-day
31
Apple apparently takes this seriously, since they "disabled Java" in users' computers, which is a rather drastic move. This actually smells like a pretext to kill off the technology, as part of a wider strategy.
For this specific hole, there are a few details there. It is all about the Java applet model. To understand:
Java is a programming language and a ...
12
First, I'm not a lawyer. Second, this completely depends on your local laws. I can only speak for my limited experience with UK and US law.
In most countries, you're covered by free speech laws, assuming the information you're releasing isn't protected by some form of non-disclosure agreement, and isn't classified as a military secret. If you found the 0day ...
8
I think the most likely outcome would be delayed patches to fixes at the behest of friendly governments. Consider:
Deliberately introducing flaws is not an easy thing. Anyone from the organization could look at the code and see the flaw - so the details might leak.
Continuing point one, if the flaw causes an issue for customers, that would be bad rep for ...
5
A 0-day exploit is a vulnerability not known to the public and more particular, the programmers of a particular application.
You don't want to get that confused with bad coding. If someone created a button that said "Click here for admin access", and it would grant admin access, this would not be a 0-day vulnerability.
Most programmers would agree that ...
5
Interesting question. There's a couple of areas that are possible controls for this.
The obvious first place is patching things like Java. It's commonly overlooked in patching processes but with the level of attacks need to get patched as soon as possible.
The next one is hardening. Java applet functionality (which it likely what was exploited here) ...
5
Your organisation might want to subscribe to Java for Business:
With the announcement of Java for Business customers and partners running Java applications on older release families (1.4, 5.0, 6) now have a choice of either migrating to a newer release or subscribing to Java for Business to continue receiving critical reliability, availability and ...
5
The linked CNET article refers to CVE-2013-0422 "Oracle Java 7 Security Manager Bypass Vulnerability" (Oracle, US-CERT, NVD/NIST). From the Oracle link: "Affected product releases and versions: JDK and JRE 7 Update 10 and earlier".
"The vulnerability on the Java sandbox exists in both 7u10 and 7u11"
is incorrect. 7u10 is vulnerable. 7u11 is not. The update ...
5
You are almost correct - .lnk files should be a shortcut to a file, but here the .lnk itself is crafted to effectively autorun an exploit rather than calculate the shortcut to the intended file.
The Microsoft Security Advisory from 2010 gives more information along with the fix in MS10-046 so this is not a zero day.
4
Targeting sandboxed platforms like Flash and Java will be excessively difficult if you're just starting out, so I suggest you learn to walk before you try to run.
Some stuff you'll want to know:
How to code in a low level language like C.
What the stack, registers, heap, etc. do, and what happens when you overflow them in various ways.
At least basic x86 ...
3
The Department of Homeland Security (DHS), US-CERT and the National Security Authority in Norway recommended disabling Java as a quick fix because exploit code was present in the wild. It was not a move against Java. After the patch came out it was just advised to apply the patch.
On the other hand, there's Apple who has a more aggressive stance against ...
3
Some more thoughts, based around your PDF viewer:
Ensure your PDF viewer is configured not to execute code.
Ensure your PDF viewer is patched and up to date.
Use a less popular PDF viewer, since malware writers will tend to target vulnerabilities in the more popular viewers.
Use a different OS than your boss, so if the malware has code compiled ...
3
First off, virtually all AV companies have several "fly traps" or "honeypots". A fly trap is a network of desktop computers with Internet access and zero protection that exist to "catch" malware. Bot-scripts on the computers crawl the web looking for risky sites, and break all the rules for safe browsing that are drilled into us normal people. As a result, ...
3
Check out Fuzzing with DOM Level 2 and 3
"Overview
Fuzzing techniques proved to be very effective in finding vulnerabilities in web browsers.
Over time several valuable fuzzers have been written and some of them (mangleme, cross_fuzz) have became a "de-facto" standard, being widely adopted by the security research community.
The most common ...
3
Symantec's virus submission portal:
http://www.symantec.com/security_response/submitsamples.jsp?inid=us_sr_flyout_contact_submit
I have seen this kind of infection before over the years in various forms.
Was the 'driving itself' computer the same as the infected one, or a different computer? If it is different, you will have to nuke all machines and start ...
3
There are lots of libraries that relate to the Internet Explorer functionality, and it's probably the case that anything making use of it uses others that I don't know.
Two that are signs, though, are definitely shdocvw.dll and mshtml.dll. If you see an application loading either of those libraries, you can feel pretty comfortable that it's making use of ...
2
If you are looking for the vulnerability reports and databases, I've already answered this in this stackoverflow answer.
Copy-pasting again for easy reference:
Common Vulnerabilities and Exposures project (CVE)
http://seclists.org/fulldisclosure
http://packetstormsecurity.org/
http://www.securityfocus.com/bid/ (BugTraq)
http://www.exploit-db.com/
...
2
If you want to keep yourself about the latest discovered security vulnerabilities, BugTraq would probably be your best bet.
If you want to keep track of security breaches of organisations, the news would be your best bet. There is no consolidated resources that provide immediate feedback about such matters that I know of.
2
Finding people who can get a clearance and program is going to become a priority, just like in the Aerospace/Defence industry, getting people who can do engineering and get a clearance is a priority.
Dead wood people who have a clearance will have job security.
Some kind of certification (of people) and "flight certification" of software will be common, ...
2
If you can't disable java from chrome://plugins, you can use the -disable-java startup switch. Example:
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -disable-java
Navigating to http://java.com/en/download/help/testvm.xml after a restart of the browser should give the message:
No working Java was detected on your system. Install Java ...
2
Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there.
It allows you to subscribe to CVEs about selected vendor/product.
2
In that specific case, as far as I understand, the initial compromise was traced back to a compromised system at cPanel. The breach allowed the indirect attack of some systems which use cPanel, and the attacker was on the habit of installing a rootkit which put a backdoor in SSH.
The general methodology for understanding what happened and whodunnit is the ...
1
A zero-day (or zero-hour or day zero) attack or threat is an attack that exploits a previously unknown vulnerability in a computer application, meaning that the attack occurs on "day zero" of awareness of the vulnerability.[1] This means that the developers have had zero days to address and patch the vulnerability. Zero-day exploits (actual software that ...
1
You can install NoScript Firefox Extension and add the websites on which you want to allow Java to the whitelist. It will block Java (among other things) on all other websites. You will probably want to globally allow JavaScript (in NoScript), otherwise most websites will be broken. Install it and see the available options. Read documentation too.
...
1
I believe a good hids or aplication layer firewall can cut your response time otherwise required in deep analysis like forensics. I also believe in case of complicated attack no one box forensics is enough depending the scope of investigation all the systems included network devices , dns and redundant servers be put for the same. Sometimes clues are left at ...
1
secunia makes a commercial product that does exactly what you want.
"The Secunia VIM lets you create specific vulnerability management reports for different product categories across your entire IT infrastructure by filtering criteria. So you only get vulnerability alerts and intelligence relevant to your specific needs."
1
It's actually not that uncommon at all, in my experience. It's possible that you have an 0day but I would suspect that it's far more likely that you have a known virus that has been obfuscated. Correction: if the computer is 'driving itself' you most likely have a root-kit installed. Bad mojo. :-( Everything below applies but it's more academic and ...
1
Again I'm not a lawyer or anything, but I know that in the UK and under the Computer Misuse Act 1990 Section 3a:
3a: Making, supplying or obtaining articles for use in offence under section 1 or 3
A person is guilty of an offence if he makes, adapts, supplies or
offers to supply any article intending it to be used to commit, or to
assist in ...
1
It depends on where you are, but overall no. In Germany you could theoretically be accused of a crime, not just sued, although it's extremely unlikely it would happen. In most of the world nothing would happen to you besides being flamed, castigated, and vilified. After all, this has happened before, numerous times, and although you'd probably get a load of ...
Only top voted, non community-wiki answers of a minimum length are eligible
