Zero Days Are An Ongoing Event

A recent Java exploit prompted an interested article title – Zero Day Season Isn’t Over. The Java exploit is typical, a vulnerability in the Java runtime environment allows for code to execute as if it were trusted, bypassing the security measures normally in place. This is a particularly nasty type of exploit as it’s a design issue not some buffer overflow that you can mitigate through techniques like ASLR or DEP. You simply run the applet and the applet gains access to your system. (See this article if you’re a Linux user looking to protect yourself.)

It reminded me of another article I’d read entitled Consistently Vulnerable Systems. (http://www.rationallyparanoid.com/articles/consistently-vulnerable-systems.html) The article, by rationallyparanoid, highlights that there is no ‘season’ for 0day malware. If you look at the most common user applications and the time it takes for patches to come out we’re actually vulnerable for a very sizable amount of the year, a full 45% of the year is spent in a state where the user can be exploited by unpatched vulnerabilities. Consider that most users take at least a few days to patch and some even take months (especially in the case of Java, which has a notoriously broken updater) and it’s quite plain to see that users are vulnerable to these attacks for most of the year.

Because of this it’s important to stay on top of a proactive approach to security. Yes, patching is incredibly important but it’s clear that it alone can’t protect you. Approaches like EMET) and sandboxing should be looked at by both users and developers to keep ahead of attacks.

Unfortunately there is a lack of native tools that can really prevent an attack like this for Windows. So be on your best behavior; don’t run Java on a website that’s never asked for it before or one that you’ve never visited before, check for updates daily, run a secure browser like Chrome or Firefox with NoScript, and keep your antivirus up to date.