The truth about zero-day vulnerabilities in web application security
Zero-Day Vulnerabilities are highly regarded in legitimate bug bounty programs and have earned bounties of up to $ 2 million. Since there are no patches or fixes, 0-day attacks / exploits are popular even in underground markets and the dark web. They are sold to the highest bidder within hours of their discovery on the black market.
And why not! Zero-Day vulnerabilities provide an unprotected gateway for threat actors to create exploits and use them to attack the organization. Because security defenses are ineffective or not in place, the likelihood of successful attacks is high.
In this article, we take a look at what zero day means in web applications as opposed to systems and networks, and the general security required to protect against zero day attacks.
Vulnerabilities, exploits and zero-day attacks
Zero-Day Vulnerabilities are gaps / configuration errors / security weaknesses / flaws / bugs in software, hardware, firmware or code that are previously unknown to the parties involved – users, organizations, vendors and security teams. They are only known to developers and organizations when a successful zero-day attack takes place or is discovered by security researchers.
Zero-day exploits are codes and / or methods developed by threat actors by exploiting the 0-day vulnerability. The threatening actor, instead of leading the attack immediately, can strategically wait for the best time to deploy it.
This is a zero-day exploit before and on the day the organization / seller is made aware of its existence. From day zero, the organization / vendor starts working on the exploit fix.
When threat actors use the zero-day exploit, the result is a zero-day attack. This is usually when the vulnerability is recognized by the organization and the public. Typical attack vectors are web browsers, email attachments, exploit kits, phishing / spear-phishing emails, 0-day malware, etc.
Zero-Days in General Cyber Security vs Web Application Security
Zero-Days in cybersecurity
Zero-day cybersecurity attacks (network security, endpoint security, system security, etc.) are particularly dangerous. Here’s why.
If a zero day is discovered in the firmware, physical devices could be compromised. There isn’t much organizations can do to prevent attacks, other than ban USB drives, block the attack vector, and configure firewalls until the vendor recognizes and fixes the problem. One example is the Stuxnet virus which targeted computers used for manufacturing purposes. This computer worm has been used to disrupt Iran’s nuclear program by sabotaging machinery used in enrichment factories.
If a zero-day vulnerability is detected in your operating system or any other software, your systems / browsers / IT infrastructure will remain exposed to attackers until the software vendor discovers the vulnerability, develops a patch and releases it to a software update. The longer it takes for the vendor to discover and resolve the problem, the longer your systems are exposed and the greater the associated risks.
For example, attackers exploited an unpatched vulnerability in Adobe Flash Player in 2011 to attack security company RSA. The attackers sent phishing emails with the subject line “Recruitment Plan 2011” containing Excel spreadsheet attachments to a small group of employees. The malware in the attachment exploited the Flash zero-day vulnerability to install the backdoor – the Poison Ivy remote administration tool – to take control of the computer. Using the backdoor, attackers snooped inside inside information and then exported it. They stole sensitive information related to the company’s SecurID two-factor authentication products and compromised its effectiveness.
Zero-Days in Web Application Security
Zero-days in web application security are typically found in newly deployed code. The likelihood is higher in in-house developed and customized business systems and applications. There is no way for anyone to know in advance or report the vulnerability. In the latter case, there is less chance of security breaches being reported since only one organization uses the application.
In cases where the zero-day vulnerability is in newly deployed code or in custom internal applications, no external vendor will provide the fix. The responsibility for discovering and correcting shortcomings (before attackers) rests with the organization and its IT security team. They need to incorporate smart scanning tools equipped with automated penetration testing capabilities like AppTrana into SDLC steps to identify vulnerabilities and security breaches and fix them as early as possible.
There are also exceptions. Organizations can use popular web apps or open source libraries, themes and frameworks, third-party components, etc. to create applications. In such cases, the vendor will need to patch the vulnerabilities.
But what if it’s a legacy system, an end-of-support product, or a non-operating vendor? How does zero-day protection in web application security work in such cases? The virtual patch is useful in cases like this. It provides protection to the application and IT infrastructure when patches are no longer issued or too expensive to deploy (e.g. IoT devices).
The path to follow
Due to their nature, it is impossible for automated scan tools and scanners based on the now obsolete signature scan models to discover zero-day vulnerabilities. For effective detection and protection against attacks and zero-day exploits in web applications, a modern, managed and intuitive web application firewall (WAF) such as AppTrana is required.
Learn more about how AppTrana protects web applications against zero days.
The article The Truth About Zero-Day Vulnerabilities in Web Application Security first appeared on Indusface.
*** This is an Indusface Security Bloggers Network syndicated blog written by Ritika Singh. Read the original post at: https://www.indusface.com/blog/the-truth-about-zero-day-vulnerabilities-in-web-application-security/