Blog

In March 2021, The Citizen Lab at the University of Toronto determined that a Saudi activist’s phone had been infected with Pegasus spyware. Researchers also discovered that Pegasus exploited a vulnerability in Apple’s image rendering library to launch “zero-day attacks.”

The exploit – dubbed FORCEDENTRY – is a zero-click zero-day exploit that affects iMessage in the latest Apple devices. Pegasus and FORCEDENTRY circumvented Apple’s BlastDoor security and allowed attackers to access a target’s device without the target’s interaction. It was only in September that Apple finally released an update to patch the vulnerability. 

Zero Day Exploits Explained

A zero day exploit is an unknown software vulnerability that hackers take advantage of to launch a cyberattack. The term “zero day” means that developers have “zero days” to fix the problem because hackers have already exploited the system or network to:

• Access enterprise systems

• Steal data, credentials or identities

• Corrupt files

• Take remote control of devices

• Access customer information

• Install spyware for corporate espionage

Such “zero day attacks” leave little or no opportunity for detection, much less prevention.

It’s critical to mitigate zero day exploits as soon as possible to minimize the potential for damage.

Anyone could be the victim of a zero day exploit, including:

• Individuals

• Businesses or organizations

• Non-governmental organizations

• Institutions, e.g. universities

• Government agencies

Types of Zero Day Vulnerabilities

FORCEDENTRY is just one of the many zero day exploits currently used by attackers. Zero day vulnerabilities come in many forms, including:

• Unencrypted data

• Insecure passwords

• Broken algorithms

• Missing authorizations

• SQL injections

• Cross Site Scripting (XSS)

• Bugs

• Buffer overflows

• URL redirects

Regardless of the type, what makes an exploit zero day is that an official patch or update to fix it doesn’t exist yet, which leaves the door open for cybercriminals to attack. To take advantage of these vulnerabilities, hackers write exploit codes or purchase them from the dark web and then deliver them via phishing emails or social engineering attacks.

Strategies to Minimize the Threat of Zero Day Exploits

More often than not, zero day vulnerabilities are only detected when they’re exploited. But the good news is that it’s not impossible to identify such vulnerabilities.

Organizations can detect and address zero day vulnerabilities by:

• Installing network intrusion protection system (NIPS) to monitor network traffic for unusual activity

• Blocking suspicious activity with a firewall

• Limiting the number of applications used in the enterprise

• Patching all software, including operating systems, and keeping them up-to-date

Organizations can also implement other strategies to minimize the threat – and possible damage – of zero day exploits, such as:

• Integrating anti-malware software to detect and remove malware proactively

• Applying antivirus software that can identify malicious intent from learned behaviours within the enterprise IT system

• Using security tools to review historical breaches and identify open vulnerabilities before they are exploited

• Implementing a security policy based on the Principle of Least Privilege (PoLP) so that each user only has access to the systems needed to do their job

In addition, security teams should stay up-to-date on their knowledge of zero day exploits. They should also proactively look for zero day exploits by conducting penetration testing and taking fast action to discover such flaws. Finally, they should regularly back up data to prevent major or long-lasting damage if a zero day attack does occur.

Conclusion

Zero day exploits are potentially catastrophic because they can cause massive damage in very little time. That’s why it’s important for organizations to take a more proactive stance to zero day exploit discovery and mitigation. And one of the best ways to put this proactive approach into practice is with penetration testing.

Pen tests go beyond testing for known vulnerabilities and mimic what a real-world attacker could do with a zero day exploit. The pen testers at Packetlabs leverage a mix of cutting-edge tools, technologies and advanced expertise to find and prevent zero day exploits.

Click here to know more about our tried-and-tested pen testing approach and how we can help strengthen your organization’s IT security posture.