What is a zero-day attack?

In order to understand the term “zero-day attack,” it is first important to understand the essence of “zero-day vulnerability” as it applies to software programs.

Software programs can have inherent, unintentional flaws or “holes” that can leave them exposed to attack, that give a cybercriminal a back door to access data that is otherwise secure. It is part of the job for software programmers to be on the lookout for such vulnerabilities, size them up, and fix them with a “patch” that is issued in a new release of the same software. 

The fact remains that this process can be time-consuming, during which the flaw becomes known, leaving the flank exposed for cybercriminals everywhere to take a stab at it. Software developers are basically just racing against time, having zero days to plug the hole. If a hacker successfully exploits this  “zero-day vulnerability,” the feat (and it is one!) is referred to as a “zero-day attack.”

Most well-known zero-day attacks so far

One of the most recent zero-day attacks was on a software giant- Microsoft Windows, nonetheless, in June 2019. The vulnerable area targeted in this case was the local escalation privileges. The attack was put into action via malware, a type of phishing attack. 

Another attack affected Android services from Google. Hackers exploited a vulnerability called Kernel privilege escalation by means of malicious apps that sent out emails asking users to download the same. 

One of the most legendary zero-day attacks by Russian hackers led to the release of data about the Democratic National Committee (DNC) in 2019. As part of this attack, there have been around six zero-day exploited vulnerabilities in Adobe Flash, MS Windows, and Java. The hackers deployed a spear-fishing campaign targeted at specific individuals connected to the DNC. They sent out emails containing tiny.cc and bit.ly hidden URLs which, when clicked upon, shifted the control of the computer as well as the DNC network to the hackers. The passwords of individuals connected to the DNC were also exposed to hackers.  

Why are zero-day attacks so deadly?

Zero-day vulnerabilities can take a variety of forms. They can show up as any kind of broader vulnerability within the software, such as missing data encryption or authorizations, broken algorithms, password security issues, URL redirects or bugs. This ends up making them hard to detect by both software programmers and hackers alike. But once found by either party, it is a race against time to either fix or exploit them. Developing a fix can take days through months, leaving users with no other options than to continue working with compromised software, leaving their devices as well as personal data exposed. Moreover, people often keep postponing installing new updates, thus raising the risk factor.  

What happens to a business hit by a zero-day attack?

Zero-day attackers usually chase after the big fish, i.e. high-value targets such as- 

• Large organizations
• Government agencies
• IoT devices, associated hardware/firmware
• Political targets
• National security threats
• Individuals with access to confidential or high-value information
  

‍

Despite the predilection for big targets in zero-day attacks, smaller business units are not exempt. Small enterprises can be pawns or collateral damage in bigger heists. For instance, attacks that are not specifically targeted, such as lifting the data of multiple users for botnets render everyone’s personal data vulnerable. It is also of value to hackers. 

Can you believe that something as innocuous as the smart office coffee maker could be the loophole for a zero-day attack? The reality is that a significant number of devices, IoT devices, in particular, will never ever get patched. Therefore, an everyday item like a  smart coffee maker may end up being the back door through which hackers can access other machines on the same wi-fi network. Patches or software updates of coffee makers and other everyday devices may simply never even happen. 

How to prevent zero-day attacks

Given the severe time crunch in holding off a zero-day attack, the danger level is never zero, so to speak. However, there are some prudent practices you can apply to your business that at least minimize the risk of it being subjected to a zero-day attack.

• Keeping your code safe is paramount. Your software lifecycle development practices must be kept secure and watertight as much as possible. 
• Limit security access to the least number of users 
• Institute multi-layered security controls
• Make vulnerability management a high priority. Keep performing vulnerability scanning and sweeps so as to not miss out on any vulnerabilities. 
• Stay on the radar for any announcements that concern zero day exploits
• Spare no time in applying patches once available
• Test your software or code for weaknesses using penetration testing techniques
• Input fields on websites or apps are a vulnerable entry point: perform input validation and sanitization to keep input safe
• Firewalls and intrusion detection systems will give you the power of rapid response or instant blocking if under attack.
• Web Application Software protects the website and helps identify the attacks
• Don’t skimp on Internet Security: get the full suite with smart anti-virus, heuristic file analysis, sandboxing techniques, and default-deny protection.
• Reward those who successfully detect vulnerabilities in your code or software
  

‍

When scoping the code for a zero-day vulnerability, these are the typical red flags that developers typically are on the lookout for:

• Software is behaving abnormally: 

Exploits or attacks may change the way applications function, therefore, studying how apps behaved after exploits and the patterns that emerge are quite valuable in preventing future zero-day attacks.

• Analyzing zero-day attack patterns and trends: 

Timing matters: attacks are likely to happen immediately after the release of a  security update, particularly with Microsoft as the company has a predetermined monthly update cycle. This awards the cybercriminals a cool month to milk their exploit before it has a chance of getting patched and plugged. Therefore software developers are extra vigilant during an update cycle, keeping an eye out for volumes of data being moved during an attack or any odd spikes of inactivity. 

• Scanning for signatures: Vulnerabilities can be scanned for “signatures,” or recurring characteristics and which point developers to their existence.

No single method is the gold standard. They are most effective when applied together. 

How to recover from a zero-day attack:

As with everything, the adage “An ounce of prevention is worth a pound of cure” holds true with zero-day attack scenarios as well. When defenses fall, the more rapid the damage control, the better. In the best-case scenarios, the most critical applications of the business would have been designated and the appropriate protections built around them well in advance. Field tests must be run on backup and recovery strategies to test their efficacy. General backups without first identifying the core applications serve no purpose against a zero-day attack which will cause IT operations to collapse.

Every business unit with a digital presence must have in place comprehensive disaster recovery plans. This includes backup plans that bring about the instant restoration of the website after an attack. CodeGuard is one such example. Downtime due to zero-day attacks can cause major financial or operational damage or result in critical equipment being taken offline. 

Thus, the winning strategy for bouncing back after a zero-day attack is actually a combination of effective defenses and rapid recovery systems.