What is a Zero-day Attack

One of the most feared types of application attacks is a zero-day attack. A zero-day vulnerability, is a flaw in software, hardware or firmware that is unknown to the party or parties responsible for patching or otherwise fixing the flaw. Zero day may refer to the vulnerability itself, or it may refer to a zero-day exploit, an attack that uses the zero-day vulnerability to attack vulnerable systems.

Zero-day attacks gained their name because they are attacks that occur before the vulnerability is announced, thus there are zero days of warning about the attack. Unlike vulnerabilities that are announced by vendors after they have discovered the issue themselves or have been notified of it by third parties, there will be no patch available for a zero-day exploit when it occurs.

The fact that organizations don’t know about zero-day vulnerabilities and thus can’t patch or otherwise protect against them is why they are one of the most feared issues that an application can have. Zero-day exploits tend to be very difficult to detect. By definition, these exploits are previously unknown, which means signature-based security tools such as antimalware software, and some intrusion detection systems (IDSes) and intrusion prevention systems (IPSes) are completely ineffective at detecting the exploit, because no attack signature exists.



Defending Against Zero-day Attacks

Zero-day exploits are difficult to defend against because they are so difficult to detect. Many current zero-day attacks are aimed at web browsers and web browser plugins. Attackers combine existing exploits and one or more zero-day attacks that target Java, Flash, and other common tools, and their attack scripts try each attack in turn against the web browsers that visit sites that they have infected with their code. In several instances in the past few years, attackers have used web-based ad networks that sell advertising space. After the attackers get access by buying or stealing ad space, they then then insert their attacks in ways that look like legitimate ads when users visit the site.

For now, your best bet to avoid zero-days is to remain in a constant state of vigilance. Follow these simple steps, and though you may never be 100% safe from the threat of zero-days, at the very least you can still reduce the possibility of running into one while trudging around all the less-reputable destinations the web has to offer.

There are often short-term ways to limit the exposure of vulnerable services or applications, such as by disabling browser plugins or blacklisting specific infected sites. In addition, subscriptions via third-party vendors can provide quick protection by leveraging intrusion protection rules or anti-malware packages.

Effective patch management and software updates play a vital role in protecting the organization's assets from zero day attack. Though zero day vulnerabilities are unknown to the vendor and there are no patch available, updated software might limit the scope of the attack thereby minimizes the further damage caused by the attack. So it is must to ensure that all patches and updates relevant to the organization’s environment are installed in a timely fashion.

Traditional anti-virus programs with signature based and statistical based detection features might not detect zero day attacks as they look for particular signature or file. But a good anti-virus solution with heuristic analysis will not only look for signatures but also analyzes what a program does during its execution. This technique does not require prior knowledge of zero day attacks and can detect these attacks in its early phase. So it is recommended to use an advanced anti-virus solution to detect and contain the attack from causing further damage.

Continuing on this thread, never forget to keep the firmware of your home router up to date, as networking equipment continues to be one of the highest prized targets for malicious actors looking for the next big zero-day attack.

Always check and install all available updates for Windows and programs you are using.

Even a great information security infrastructure cannot guarantee a full protection against unknown attacks. Since there is no reliable mechanism to completely protect assets against zero day attack, it is highly advised to keep a well-trained group of people who can respond promptly and correctly to the incidents. Organizations must ensure that the duties between the individuals in response team are segregated and they respond quickly when called upon to perform recovery and containment actions.



Did you find this tutorial helpful? Don’t forget to share your views with us.