Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
221

I was the one who wrote the comment you quoted. Quick answer: A 0day is burned when the exploit is used too often or haphazardly, resulting it in being discovered and patched. Virtually every time a 0day is used, it risks being burned. Using a 0day more sparingly and cautiously can increase its shelf life. The idiom intends to compare a 0day to a non-...


159

It's more likely that you'll burn a 0day by using it than by sitting on it. There's a fine balance between sitting on a 0day so long that it gets discovered by someone else and patched, and using it too early and unnecessarily, burning it. The balance tends to weigh in favor of waiting longer, since a good 0day is going to be obscure enough that it won't be ...


113

A zero-day is a vulnerability that is unknown by the software manufacturer and for which no patch exists. When using a zero-day vulnerability against a remote server, it may give away how it works. The administrators of the application may notice they have been hacked, look in the logs and discover the vulnerability that was used to hack them. If they then ...


71

Zero-days are found in exactly the same ways as any other kind of hole. What makes a security hole a "zero day" relies exclusively on who is aware of the existence of the hole, not on any other technical characteristic. Holes are found, usually, by inquisitive people who notice a funky behaviour, or imagine a possible bug and then try out to see if the ...


46

A zero-day attack is an attack that relies on an undisclosed vulnerability in the design or implementation of a system in order to violate its security. Most commonly, such attacks consist of using zero-day exploits to access information systems or execute code on privileged systems. Such exploits are called 'zero-day' because security administrators have ...


44

The person who discovers a security issue often reports it to the software vendor or developer first. This gives the software vendor time to fix the issue before publication. Then, after it is fixed, the bug is publicly disclosed. This process is called responsible disclosure. Sometimes, someone doesn't disclose the zero-day to the software vendor but uses ...


42

The 0 day depends on another vulnerability being discovered to be effectively used. For example you can't use a privilege escalation if you don't have code execution in the first place. This can also work the other way where you'd like another 0 day to chain after the one you currently have. The attacker doesn't have a worthy target to use it on. I'll also ...


37

You should request a CVE ID from MITRE (https://cve.mitre.org/cve/request_id.html), which is the responsible CNA for this. You can then disclose it on security mailing lists like Bugtraq or FullDisclosure. Security magazines and news sites might also be interested in the vulnerability. You can contact them directly and ask if they are interested to publish ...


34

Apple apparently takes this seriously, since they "disabled Java" in users' computers, which is a rather drastic move. This actually smells like a pretext to kill off the technology, as part of a wider strategy. For this specific hole, there are a few details there. It is all about the Java applet model. To understand: Java is a programming language and a ...


34

When a 0day is published, how can an administrator secure his application/website between the time the 0day is published and the patch is developed ? They use temporary workarounds until a patch rolls out. When news of a 0day comes out, there are often various workarounds that are published which break the exploit by eliminating some prerequisite for ...


27

Because the old ways are the best. Why blow an expensive 0-day when you can just use a sweet SMBv1 attack or SQLi that will give you the same result? Using an 0-day can result in discovery from a forensics response reducing value and eliminating the number of targets it will be effective against.


23

Security researches find exploits. The day they report it is day Zero because developers will start work on patching it. Good Security researchers (as in white hat) will publish the zero day to the developers before they publish it to the rest of the community. In many cases they only publish it to the community because the people in charge of the code ...


21

From the standpoint of the attacker, a zero-day exploit is a valuable resource because it is not publicly known. This gives the attacker the element of surprise when it is actually deployed, as the target will not be able to proactively defend against it. Each time a zero-day is used, there's a chance it'll be discovered by the target and the vulnerability ...


20

To add to the excellent answer of Thomas Pornin, usually zero-day vulnerabilities are found through source code auditing, reverse engineering, and fuzzing (or fuzz testing). The choice of the technique usually depends upon the information available at hand. For example, if the software is open source, then sifting through the source code and looking for ...


17

First, I'm not a lawyer. Second, this completely depends on your local laws. I can only speak for my limited experience with UK and US law. In most countries, you're covered by free speech laws, assuming the information you're releasing isn't protected by some form of non-disclosure agreement, and isn't classified as a military secret. If you found the 0day ...


16

Highly customized and patched hypervisors, sandboxes around said hypervisors to mitigate breakouts, and heavy monitoring. Of course, any given server only hosts so many VMs, so a breakout is fundamentally limited to a finite number of guests, if it's able to get past the protections outside the hypervisor. For example, QEMU can be compiled with a hardened ...


13

Amazon advisory links to the original XEN advisory on which one can read: Systems running only x86 PV guests are not vulnerable. So no problem for the PV instances. Regarding the HVM ones, Amazon explains that for performance reasons they managed to replace the HVM hardware drivers by the PV ones for storage and network operations (see PV on HVM). ...


12

Go to CVE Details' Product or Vendor pages. There is "Vulnerability Feeds & Widgets" link there. It allows you to subscribe to CVEs about selected vendor/product.


12

The term Zero Day or Zero Hour can apply to any type of attack. It's really just a classification given to the time period at which a vulnerability has just been discovered by a person or organization but has not yet been disclosed publically. Some definitions also include the first day or "Day Zero" of a vulnerabilities announcement and the race between ...


12

Maybe an attacker with a 0day is waiting for a good opportunity. Most targets have their highs and lows. If one's goal is to wreck havoc, and make as much dammages as possible, then using a 0day immediately after uncovering it might not be the best idea. Some targets have frozen periods, where they lack manpower and must not touch their critical ...


11

Here are several steps you could take to encourage security researchers to disclose vulnerabilities to you: Waive liability. Promise not to sue researchers who disclose vulnerabilities to you in a responsible fashion. Currently, many researchers report worrying that reporting a vulnerability to a company could get them sued, and so sometimes they just don'...


11

I've found a nice post from a Cisco Support Engineer regarding to the ASA: However, if you are trying to find the OpenSSL version for an ASA (Adaptive Security Appliance), you can determine this version from the ASA release notes. Simply examine the "Open Source" notes that are located in the release notes of the particular ASA image you are concerned ...


10

When a zero-day is released or published, it comes with more than just a fancy name and icon. There are details about how the zero-day is used to exploit the system. Those details form the basis of the defender's response, including how the patch needs to be designed. For example, with WannaCry/EternalBlue, the vulnerability was found by the NSA and they ...


10

If you want to disclose a vulnerability I would suggest to contact the right CNA. You can find a list under this link. Now you can request a CVE ID and everything goes on if this vulnerability is really existing.


9

This just brings into the public eye something which has been happening for ages: everything is vulnerable. SCADA kit used to be safer as it generally wasn't connected directly to public networks and was considered obscure, however the targets are juicy, and the security levels generally pitifully low so attackers have always researched ways to exploit them. ...


9

Specifically focusing on your question about how burning a 0day can be an expensive thing: With literal monetary value, CaffeineAddiction's answer covered that very well. There is another type of value that I haven't seen mentioned - when it's purposely released to the public to allow a community to get around a manufacturer's rules. An example of this is ...


8

A 0-day exploit is a vulnerability not known to the public and more particular, the programmers of a particular application. You don't want to get that confused with bad coding. If someone created a button that said "Click here for admin access", and it would grant admin access, this would not be a 0-day vulnerability. Most programmers would agree that ...


8

A zero-day vulnerability is, by definition, one that has not been announced.


8

I think that the answers you get here are mostly speculations. But the question is interesting nevertheless. I see the following main reasons: Other usual attack vectors like Java or ActiveX were harder to exploit because the relevant functionality was either switched off or layers of interaction were added (i.e. click to play, warnings with unsigned code ...


8

Microsoft have now provided an analysis of the exploits which were released in this dump. Their analysis shows that the exploits included all have patches available for them, on suported versions of Windows. So if a user is up to date with their patches and using a supported version of Windows these exploits should have no effect. Where these exploits ...


Only top voted, non community-wiki answers of a minimum length are eligible