Zero-day Vulnerabilities Research Articles

A framework for zero-day vulnerabilities detection and prioritization

Nowadays highly-skilled attackers can find the vulnerabilities of many networked applications. Meanwhile, the risk of a data breach increases dramatically as a software or application vulnerability always remains without a patch. By exploiting such vulnerability (called zero-day), hackers gain entry to the target network and can steal sensitive data. It is challenging to detect zero-day with traditional defenses because signature information in zero-day attacks is unknown. Consequently, a novel security solution is required that will discover zero-day attacks and estimate the severity of identified zero-day vulnerability. In this paper, we propose a framework that constitutes an integrated approach for detection and prioritization (based on likelihood) of zero-day attacks. The proposed framework follows a probabilistic approach for identification of the zero-day attack path and further to rank the severity of identified zero-day vulnerability. It is a hybrid detection-based technique that detects unknown flaws present in the network that are not detected yet. To evaluate the performance of the proposed framework, we adopted it in the network environment of Vikram university campus, India. The framework is very promising as experimental results showed detection rate of 96% for zero-day attacks with 0.3% false positive rate.

Finding Sands in the Eyes: Vulnerabilities Discovery in IoT With EUFuzzer on Human Machine Interface

In supervisory control and data acquisition (SCADA) systems or the Internet of Things (IoT), human machine interface (HMI) performs the function of data acquisition and control, providing the operators with a view of the whole plant and access to monitoring and interacting with the system. The compromise of HMI will result in lost of view (LoV), which means the state of the whole system is invisible to operators. The worst case is that adversaries can manipulate control commands through HMI to damage the physical plant. HMI often relies on poorly understood proprietary protocols, which are time-sensitive, and usually keeps a persistent connection for hours even days. All these factors together make the vulnerability mining of HMI a tough job. In this paper, we present EUFuzzer, a novel fuzzing tool to assist testers in HMI vulnerability discovery. EUFuzzer first identifies packet fields of the specific protocol and classifies all fields into four types, then using a relatively high efficiency fuzzing method to test HMI. The experimental results show that EUFuzzer is capable of identifying packet fields and revealing bugs. EUFuzzer also successfully triggers flaws of actual proprietary SCADA protocol implementation on HMI, which the SCADA software vendor has confirmed that four were zero-day vulnerabilities and has taken measures to patch up.

A Value Set Analysis Refinement Approach Based on Conditional Merging and Lazy Constraint Solving

Value set analysis is a common static binary program analysis approach. Value set analysis attempts to identify a tight over-approximation of the program state at any given point in the program and can be used to detect vulnerability. Existing memory corruption detection analysis technologies based on value set analysis have a high false positive rate, because value set analysis suffers from a lack of accuracy. We observed that two main sources of imprecision in value set analysis are merge operation and failed branch conditions tracking. In order to address above problems, in this paper, we propose a value set analysis refinement approach based on conditional merging and lazy constraint solving. We propose a variable dependence analysis algorithm to divide program paths into subsets and only merge the states which satisfy the condition that the states are from the same subset, which reduces the imprecision from the merging operation. We collect path predicates as path constraint and solve the path constraint using Satisfiability Modulo Theories (SMT) solver lazily to get a tighter number range of the variable when a variable need be refined, which reduces the imprecision from the failed branch conditions tracking. We implement a prototype system RVSA based on the proposed approach and verify its effectiveness according to experimentation. Compared with state-of-the-art approach, the experimental results demonstrate that the false positive rate is reduced by 12.9%. Furthermore, using our proposed approach, 25 zero-day vulnerabilities are found in the Netgear httpd binary.

ЗАЩИТА ВНЕШНЕГО ИНФОРМАЦИОННОГО ПЕРИМЕТРА ОРГАНИЗАЦИИ ОТ ЦЕЛЕВОГО ФИШИНГА

Spear phishing is one of the social engineering techniques. In case of spear phishing the email text is compiled taking into account the knowledge about a particular company and rather often about the employee using sociology and psychology in such a way that cause the desire to open the attached file or to click on the link. The main difficulty of protection against such e-mails is that the methods of automated analysis do not guarantee its detection, as modern cyber criminals use new text formulations, zero-day vulnerabilities, as well as automation tools to inject exploits into files, which reduces the effectiveness of signature analysis of anti-virus programs. Each of the existing detection technologies alone does not provide protection against spear phishing. However, the combination of technologies (spam filtering, firewalls, anti-viruses), with the mandatory organizational measures, including training and testing of personnel, allows to protect the external information perimeter of the company from the spear phishing. The paper presents a detailed analysis of the technology of spear phishing implemented by two typical methods: the launch of the exploit when clicking on the link and when one runs an executable file. An overview of the vulnerability used in 2016-2017 for the attacks is presented. Modern technologies of protection and their comparative analysis are given. It is noted that each of the technologies used separately does not allow an effective protection against spear phishing. On the basis of comparative analysis and analysis of modern information threats the most effective modern methods of protection are proposed.

Research on Microkernel-based Power Dedicated Secure Operating System

Industrial security situation is increasingly serious; operating system security is an important basis for the entire information security. In the industrial security systems, industrial control terminal at the operating system level, lack of a comprehensive security system, unable to adapt to the security situation under the new situation. To effectively solve the above problems, self-controlled safety technology operating system research was critical needed. In the industrial operating system security, operating system security kernel integrity is an important guarantee. Based on NARIsecOS, this paper proposed kernel integrity protection program, and part of the work carried out formal verification. Secure operating system can bring the following goodness: 1) Trojan virus immunity, and against hacker attacks; 2) Greatly reduce the zero-day vulnerabilities; 3) Decentralized management, effectively circumvent a dominant right; 4) Enhance industrial endpoint security protection.

A Study of Ajax Template Injection in Web Applications

Cyber-attacks are becoming increasingly frequent, causing a lot of damage. Cyber-attacks have crippled our economic infrastructure both directly and indirectly. Attackers steal our valuable data by compromising web application security loopholes. Developers can prevent cyber-attacks using latest web technologies. Since web technologies are becoming more secure, cyber attackers are getting more incursive to find out the zero day vulnerability of the targeted system to breach the security. Nowadays most damaging attacks are done using zero-day vulnerability. An Ajax template injection is such an attack: An unauthenticated attacker dumps database table credentials by intercepting server response. Owing to the damage caused by an Ajax template injection, it can be counted among the OWASP top ten web application vulnerabilities in the near future. This paper discusses the idea of an Ajax template injection and its impact on Ajax-based web applications. This paper also provides statistical data about the percentage of Ajax-based web application vulnerabilities in Bangladesh.

An Automated Vulnerability Detection and Remediation Method for Software Security

As hacking techniques become more sophisticated, vulnerabilities have been gradually increasing. Between 2010 and 2015, around 80,000 vulnerabilities were newly registered in the CVE (Common Vulnerability Enumeration), and the number of vulnerabilities has continued to rise. While the number of vulnerabilities is increasing rapidly, the response to them relies on manual analysis, resulting in a slow response speed. It is necessary to develop techniques that can detect and patch vulnerabilities automatically. This paper introduces a trend of techniques and tools related to automated vulnerability detection and remediation. We propose an automated vulnerability detection method based on binary complexity analysis to prevent a zero-day attack. We also introduce an automatic patch generation method through PLT/GOT table modification to respond to zero-day vulnerabilities.

Sugar

Modern personal computers have embraced increasingly powerful Graphics Processing Units (GPUs). Recently, GPU-based graphics acceleration in web apps (i.e., applications running inside a web browser) has become popular. WebGL is the main effort to provide OpenGL-like graphics for web apps and it is currently used in 53% of the top-100 websites. Unfortunately, WebGL has posed serious security concerns as several attack vectors have been demonstrated through WebGL. Web browsers» solutions to these attacks have been reactive: discovered vulnerabilities have been patched and new runtime security checks have been added. Unfortunately, this approach leaves the system vulnerable to zero-day vulnerability exploits, especially given the large size of the Trusted Computing Base of the graphics plane. We present Sugar, a novel operating system solution that enhances the security of GPU acceleration for web apps by design. The key idea behind Sugar is using a dedicated virtual graphics plane for a web app by leveraging modern GPU virtualization solutions. A virtual graphics plane consists of a dedicated virtual GPU (or vGPU) as well as all the software graphics stack (including the device driver). Sugar enhances the system security since a virtual graphics plane is fully isolated from the rest of the system. Despite GPU virtualization overhead, we show that Sugar achieves high performance. Moreover, unlike current systems, Sugar is able to use two underlying physical GPUs, when available, to co-render the User Interface (UI): one GPU is used to provide virtual graphics planes for web apps and the other to provide the primary graphics plane for the rest of the system. Such a design not only provides strong security guarantees, it also provides enhanced performance isolation.

Security Measurement for Unknown Threats Based on Attack Preferences

Security measurement matters to every stakeholder in network security. It provides security practitioners the exact security awareness. However, most of the works are not applicable to the unknown threat. What is more, existing efforts on security metric mainly focus on the ease of certain attack from a theoretical point of view, ignoring the “likelihood of exploitation.” To help administrator have a better understanding, we analyze the behavior of attackers who exploit the zero-day vulnerabilities and predict their attack timing. Based on the prediction, we propose a method of security measurement. In detail, we compute the optimal attack timing from the perspective of attacker, using a long-term game to estimate the risk of being found and then choose the optimal timing based on the risk and profit. We design a learning strategy to model the information sharing mechanism among multiattackers and use spatial structure to model the long-term process. After calculating the Nash equilibrium for each subgame, we consider the likelihood of being attacked for each node as the security metric result. The experiment results show the efficiency of our approach.

RETRACTED: A hybrid layered architecture for detection and analysis of network based Zero-day attack

A Zero-day (0-day) susceptibility is an undisclosed computer software or application vulnerability that could be exploited to affect hardware, applications, data, or networks negatively. The main objectives of a Zero-day attack are for hackers or attackers to be able steal sensitive information, legal documents, enterprises data, and other information. We have analyzed the lifecycle of Zero-day vulnerabilities and different detection methodologies. In this paper, we propose a novel hybrid layered architecture framework for Zero-day attack detection and analysis in real-time, which is based on statistics, signatures, and behavior techniques. To enhance our architecture, we used an SVM approach in order to provide unsupervised learning and minimize false alarm detection capabilities. In this paper, we also present the different experimental comparisons we made between our approach and various standard parameters and our result shows a high detection rate of Zero-day attacks

Time between vulnerability disclosures: A measure of software product vulnerability

Time between vulnerability disclosure (TBVD) for individual analysts is proposed as a meaningful measure of the likelihood of finding a zero-day vulnerability within a given timeframe. Based on publicly available data, probabilistic estimates of the TBVD of various software products are provided.Sixty-nine thousand six hundred forty-six vulnerabilities from the National Vulnerability Database (NVD) and the SecurityFocus Vulnerability Database were harvested, integrated and categorized according to the analysts responsible for their disclosure as well as by the affected software products. Probability distributions were fitted to the TBVD per analyst and product. Among competing distributions, the Gamma distribution demonstrated the best fit, with the shape parameter, k, similar for most products and analysts, while the scale parameter, θ, differed significantly. For forecasting, autoregressive models of the first order were fitted to the TBVD time series for various products. Evaluation demonstrated that forecasting of TBVD on a per product basis was feasible. Products were also characterized by their relative susceptibility to vulnerabilities with impact on confidentiality, integrity and availability respectively.The differences in TBVD between products is significant, e.g. spanning differences of over 500% among the 20 most common software products in our data. Differences are further accentuated by the differing impact, so that, e.g., the mean working time between disclosure of vulnerabilities with a complete impact on integrity (as defined by the Common Vulnerability Scoring System) for Linux (110 days) exceeds that of Windows 7 (6 days) by over 18 times.

Mining trends and patterns of software vulnerabilities

Zero-day vulnerabilities continue to be a threat as they are unknown to vendors; when attacks occur, vendors have zero days to provide remedies. New techniques for the detection of zero-day vulnerabilities on software systems are being developed but they have their own limitations; e.g., anomaly detection techniques are prone to false alarms. To better protect software systems, it is also important to understand the relationship between vulnerabilities and their patterns over a period of time. The mining of trends and patterns of vulnerabilities is useful because it can help software vendors prepare solutions ahead of time for vulnerabilities that may occur in a software application. In this paper, we investigate the use of historical patterns of vulnerabilities in order to predict future vulnerabilities in software applications. In addition, we examine whether the trends of vulnerabilities in software applications have any significant meaning or not. We use the National Vulnerability Database (NVD) as the main resource of vulnerabilities in software applications. We mine vulnerabilities of the last six years from 2009 to 2014 from NVD. Our results show that sequences of the same vulnerabilities (e.g., buffer errors) may occur 150 times in a software product. Our results also depict that the number of SQL injection vulnerabilities have decreased in the last six years while cryptographic vulnerabilities have seen an important increase. However, we have not found any statistical significance in the trends of the occurrence of vulnerabilities over time. The most interesting finding is that the sequential patterns of vulnerability events follow a first order Markov property; that is, we can predict the next vulnerability by using only the previous vulnerability with a recall of approximately 80% and precision of around 90%.

Dynamic symbolic execution approach based on tabu search

Software vulnerabilities are one of the root causes of network security problem,and software vulnerability detection is currently a hot topic in the field of network security. Dynamic symbolic execution is one of the most studied approaches for vulnerability detection recently. Aimed at the problem that existing dynamic symbolic approaches produced a large number of duplicate or near-duplicate test cases,we proposed a novel dynamic symbolic execution approach based on tabu search,and implemented a corresponding tool named Sword SE. The proposed approach took advantage of the tabu search algorithm's ability of global optimization,it can do optimized seed selection by establishing an evaluation function,and can avoid duplicate path search by establishing a tabu list. Experiment results show that Sword SE's path search efficiency is significantly better than those of existing tools,and has detected four zero-day vulnerabilities until now.

A Hybrid Real-time Zero-day Attack Detection and Analysis System

A zero-day attack poses a serious threat to the Internet security as it exploits zero-day vulnerabilities in the computer systems. Attackers take advantage of the unknown nature of zero-day exploits and use them in conjunction with highly sophisticated and targeted attacks to achieve stealthiness with respect to standard intrusion detection techniques. Thus, it's difficult to defend against such attacks. Present research exhibits various issues and is not able to provide complete solution for the detection and analysis of zero-day attacks. This paper presents a novel hybrid system that integrates anomaly, behavior and signature based techniques for detecting and analyzing zero-day attacks in real-time. It has layered and modular design which helps to achieve high performance, flexibility and scalability. The system is implemented and evaluated against various standard metrics like True Positive Rate (TPR), False Positive Rate (FPR), F- Measure, Total Accuracy (ACC) and Receiver Operating Characteristic (ROC) curve. The result shows high detection rate with nearly zero false positives. Additionally, the proposed system is compared with Honeynet system.

Power System Reliability Evaluation With SCADA Cybersecurity Considerations

As information and communication networks are highly interconnected with the power grid, cyber security of the supervisory control and data acquisition (SCADA) system has become a critical issue in the electric power sector. By exploiting the vulnerabilities in cyber components and intruding into the local area networks of the control center, corporation, substations, or by injecting false information into communication links, the attackers are able to eavesdrop critical data, reconfigure devices, and send trip commands to the intelligent electronic devices that control the system breakers. Reliability of the power system can thus be impacted by various cyber attacks. In this paper, four attack scenarios for cyber components in networks of the SCADA system are considered, which may trip breakers of physical components. Two Bayesian attack graph models are built to illustrate the attack procedures and to evaluate the probabilities of successful cyber attacks. A mean time-to-compromise model is modified and adopted considering the known and zero-day vulnerabilities on the cyber components, and the frequencies of intrusions through various paths are estimated. With increased breaker trips resulting from the cyber attacks, the loss of load probabilities in the IEEE reliability test system 79 are estimated. The simulation results demonstrate that the power system becomes less reliable as the frequency of successful attacks on the cyber components increases and the skill levels of attackers increase.

Internal Access Controls

Every day seems to bring news of another dramatic and high-profile security incident, whether it is the discovery of longstanding vulnerabilities in widely used software such as OpenSSL or Bash, or celebrity photographs stolen and publicized. There seems to be an infinite supply of zero-day vulnerabilities and powerful state-sponsored attackers. In the face of such threats, is it even worth trying to protect your systems and data? What can systems security designers and administrators do?

COMPREHENSIVE MULTILEVEL SECURITY RISK ASSESSMENT OF DISTRIBUTED INFORMATION SYSTEMS

The paper suggests the multilevel approach to the risk assessment that is based on the system of security metrics and techniques for their calculation. Proposed techniques are based on attack graphs and service dependencies. They allow evaluating security of network topologies, malefactors and attack characteristics, and integral security properties and characteristics calculated on the basis of the cost-benefit and zero-day vulnerability analysis. Classification of these characteristics and separation of the security information on static, dynamic and historical allows defining different assessment levels. The paper considers the main issues and recommendations for using the risk assessment techniques based on the suggested approach.

A New Strategy for Reducing the Threat of Dangerous day Sales to Global Security and the Economy

Zero-day (“Oday”) vulnerabilities are defects in software that are unknown to computer users and software manufacturers. They can be “exploited” for cyber espionage and cybercrime purposes or even “weaponized” to execute commands that cause our nation’s computer systems — including those deployed by critical infrastructure sectors — to malfunction. In recent years, the market for these vulnerabilities has proliferated worldwide. Since the global market is unregulated and many companies do not screen their customers, criminals, terrorists, rogue governments, the Chinese People’s Liberation Army, and other nations and individuals seeking to exploit these vulnerabilities for “malicious cyber activities” may be gaining unprecedented access to them.This report provides recommendations for mitigating the threat emanating from this global, unregulated market. It acknowledges the immense challenge of regulation and proceeds from the premise that eliminating dangerous Oday sales is virtually impossible. Such transactions are “intangible” and often anonymous, and determined buyers and sellers could frequently circumvent regulations. The threat of dangerous Oday sales to buyers seeking to deploy them for malicious purposes is also one of the most global threats that exist today. Oday discoverers, exploiters, purchasers, brokers, perpetrators, software vendors, and victims reside in nations throughout the world and therefore no single country can mitigate the threat acting alone. While acknowledging these challenges, this report proposes initial measures that would begin to mitigate the current threat, rendering it more difficult and costly to sell Odays to those who seek us harm.

Analysis of a Delayed Internet Worm Propagation Model with Impulsive Quarantine Strategy

Internet worms exploiting zero-day vulnerabilities have drawn significant attention owing to their enormous threats to Internet in the real world. To begin with, a worm propagation model with time delay in vaccination is formulated. Through theoretical analysis, it is proved that the worm propagation system is stable when the time delay is less than the thresholdτ0and Hopf bifurcation appears when time delay is equal to or greater thanτ0. Then, a worm propagation model with constant quarantine strategy is proposed. Through quantitative analysis, it is found that constant quarantine strategy has some inhibition effect but does not eliminate bifurcation. Considering all the above, we put forward impulsive quarantine strategy to eliminate worms. Theoretical results imply that the novel proposed strategy can eliminate bifurcation and control the stability of worm propagation. Finally, simulation results match numerical experiments well, which fully supports our analysis.

Supporting secure programming in web applications through interactive static analysis

Many security incidents are caused by software developers’ failure to adhere to secure programming practices. Static analysis tools have been used to detect software vulnerabilities. However, their wide usage by developers is limited by the special training required to write rules customized to application-specific logic. Our approach is interactive static analysis, to integrate static analysis into Integrated Development Environment (IDE) and provide in-situ secure programming support to help developers prevent vulnerabilities during code construction. No additional training is required nor are there any assumptions on ways programs are built. Our work is motivated in part by the observation that many vulnerabilities are introduced due to failure to practice secure programming by knowledgeable developers. We implemented a prototype interactive static analysis tool as a plug-in for Java in Eclipse. Our technical evaluation of our prototype detected multiple zero-day vulnerabilities in a large open source project. Our evaluations also suggest that false positives may be limited to a very small class of use cases.