1 00:00:00,090 --> 00:00:01,020 In this lesson, 2 00:00:01,020 --> 00:00:04,320 we're going to cover zero-day vulnerabilities and exploits. 3 00:00:04,320 --> 00:00:06,990 First, we have a zero-day vulnerability. 4 00:00:06,990 --> 00:00:09,540 A zero-day vulnerability is any vulnerability 5 00:00:09,540 --> 00:00:11,310 that's discovered or exploited 6 00:00:11,310 --> 00:00:13,680 before the vendor can issue a patch for it. 7 00:00:13,680 --> 00:00:15,360 For example, if there's some kind 8 00:00:15,360 --> 00:00:17,370 of a flaw in the Windows operating system 9 00:00:17,370 --> 00:00:19,050 and Microsoft doesn't know about it, 10 00:00:19,050 --> 00:00:21,330 but an attacker was able to figure it out, 11 00:00:21,330 --> 00:00:24,060 this would be considered a zero-day vulnerability 12 00:00:24,060 --> 00:00:25,590 because the vulnerability exists 13 00:00:25,590 --> 00:00:28,110 but the manufacturer, in this case, Microsoft, 14 00:00:28,110 --> 00:00:30,480 is not aware of that vulnerability. 15 00:00:30,480 --> 00:00:33,360 Now, if a threat actor discovers a zero-day vulnerability, 16 00:00:33,360 --> 00:00:35,370 this means they could develop an attack 17 00:00:35,370 --> 00:00:38,940 or an exploit to target and victimize that vulnerability. 18 00:00:38,940 --> 00:00:41,580 This is known as a zero-day exploit. 19 00:00:41,580 --> 00:00:45,300 Now, a zero-day exploit is any unknown exploit in the wild 20 00:00:45,300 --> 00:00:47,790 that exposes a previously unknown vulnerability 21 00:00:47,790 --> 00:00:49,440 in the software or hardware 22 00:00:49,440 --> 00:00:51,600 and this can create complicated problems for us 23 00:00:51,600 --> 00:00:54,843 as cybersecurity professionals well before anyone realizes 24 00:00:54,843 --> 00:00:56,460 that something is wrong. 25 00:00:56,460 --> 00:00:58,770 When we're dealing with a zero-day vulnerability, 26 00:00:58,770 --> 00:01:01,110 this is something that somebody found out in the wild 27 00:01:01,110 --> 00:01:03,030 and they said, "Ah, I found a new way 28 00:01:03,030 --> 00:01:04,349 to break into something." 29 00:01:04,349 --> 00:01:06,900 And so as a technician, we are not going to be able 30 00:01:06,900 --> 00:01:08,790 to detect that or stop it 31 00:01:08,790 --> 00:01:10,320 because that attacker knows 32 00:01:10,320 --> 00:01:12,960 there's a vulnerability in the system before we do. 33 00:01:12,960 --> 00:01:15,480 This is why it's called a zero-day vulnerability, 34 00:01:15,480 --> 00:01:18,030 zero-day exploit, or zero-day attack 35 00:01:18,030 --> 00:01:21,120 because the attack will actually happen on day zero 36 00:01:21,120 --> 00:01:22,470 or the first day 37 00:01:22,470 --> 00:01:25,020 that this malicious code is being discovered. 38 00:01:25,020 --> 00:01:27,000 This becomes a really big problem 39 00:01:27,000 --> 00:01:28,590 because our traditional antivirus 40 00:01:28,590 --> 00:01:31,590 and anti-malware software products don't have the signatures 41 00:01:31,590 --> 00:01:33,390 to match up with that exploit yet 42 00:01:33,390 --> 00:01:35,670 because it's brand new, it's the first time 43 00:01:35,670 --> 00:01:37,350 that anybody has ever been targeted 44 00:01:37,350 --> 00:01:39,300 with this type of an attack. 45 00:01:39,300 --> 00:01:40,830 Now, when you're working in the field, 46 00:01:40,830 --> 00:01:43,380 you'll often hear people use the term zero-day 47 00:01:43,380 --> 00:01:45,000 in multiple different cases, 48 00:01:45,000 --> 00:01:48,840 such as to refer to the vulnerability, the exploit, or both. 49 00:01:48,840 --> 00:01:51,210 In the old days, zero-day simply referred 50 00:01:51,210 --> 00:01:52,920 to the vulnerability itself. 51 00:01:52,920 --> 00:01:55,080 But in recent years, people have started 52 00:01:55,080 --> 00:01:57,720 to use the term zero-day to refer to this specific type 53 00:01:57,720 --> 00:02:01,020 of malware that exploits a zero-day vulnerability. 54 00:02:01,020 --> 00:02:03,840 You may see either term being used on the exam, 55 00:02:03,840 --> 00:02:06,300 and when they talk about zero-day on the exam, 56 00:02:06,300 --> 00:02:09,000 they may be talking about the vulnerability, the exploit, 57 00:02:09,000 --> 00:02:10,380 or the malware. 58 00:02:10,380 --> 00:02:12,030 So it's really important for you 59 00:02:12,030 --> 00:02:13,440 to read the question in order 60 00:02:13,440 --> 00:02:17,040 to understand the proper context of what they're describing. 61 00:02:17,040 --> 00:02:18,660 Now, the next thing we have to think about 62 00:02:18,660 --> 00:02:20,670 when we talk about this zero-day malware 63 00:02:20,670 --> 00:02:22,830 is how serious is it? 64 00:02:22,830 --> 00:02:26,310 Well, zero-day exploits are really big business. 65 00:02:26,310 --> 00:02:28,110 These things cost a lot of money 66 00:02:28,110 --> 00:02:29,910 and a lot of time to develop. 67 00:02:29,910 --> 00:02:32,610 For example, if you become a bug bounty hunter 68 00:02:32,610 --> 00:02:34,410 in the cybersecurity field later on 69 00:02:34,410 --> 00:02:37,110 and you're able to discover a zero-day vulnerability, 70 00:02:37,110 --> 00:02:39,660 you can actually get a lot of money for turning that over 71 00:02:39,660 --> 00:02:42,090 to the company that developed the original software, 72 00:02:42,090 --> 00:02:44,820 because they don't want those zero-days to be known about 73 00:02:44,820 --> 00:02:46,500 and be on the open market. 74 00:02:46,500 --> 00:02:50,070 Instead, they want to identify that, patch it, fix it, 75 00:02:50,070 --> 00:02:52,440 and then make their software more secure. 76 00:02:52,440 --> 00:02:54,510 Additionally, these zero-day vulnerabilities 77 00:02:54,510 --> 00:02:57,630 and exploits are also sold to other government agencies, 78 00:02:57,630 --> 00:02:59,010 law enforcement agencies, 79 00:02:59,010 --> 00:03:01,950 and even to criminals on the dark web. 80 00:03:01,950 --> 00:03:05,160 For example, some zero-day exploits in the past have sold 81 00:03:05,160 --> 00:03:07,590 for hundreds or thousands of dollars. 82 00:03:07,590 --> 00:03:10,410 Some have even sold for over a million dollars, 83 00:03:10,410 --> 00:03:11,820 like one zero-day exploit 84 00:03:11,820 --> 00:03:15,420 that was targeting Apple iPhones in earlier versions of iOS. 85 00:03:15,420 --> 00:03:17,790 Now, as you can see, zero-day vulnerabilities 86 00:03:17,790 --> 00:03:19,590 and their associated zero-day exploits 87 00:03:19,590 --> 00:03:21,690 can be a really big business. 88 00:03:21,690 --> 00:03:24,750 Now, because these zero-days cost so much money to acquire, 89 00:03:24,750 --> 00:03:26,640 most threat actors will only exploit 90 00:03:26,640 --> 00:03:30,150 a zero-day vulnerability for a very high-value attack. 91 00:03:30,150 --> 00:03:31,650 Basically, they're going to save 92 00:03:31,650 --> 00:03:33,210 and stockpile these zero-days 93 00:03:33,210 --> 00:03:34,740 for a rainy day when they're going 94 00:03:34,740 --> 00:03:37,890 after a really, really important target and not just going 95 00:03:37,890 --> 00:03:39,810 after your grandmother's laptop. 96 00:03:39,810 --> 00:03:42,120 Instead, most threat actors are going to try 97 00:03:42,120 --> 00:03:44,970 to target known vulnerabilities first by using generic 98 00:03:44,970 --> 00:03:46,710 or off-the-shelf malware. 99 00:03:46,710 --> 00:03:49,560 If that attempt isn't successful on their desired target, 100 00:03:49,560 --> 00:03:52,050 then they may choose to use one of their zero-days 101 00:03:52,050 --> 00:03:54,030 against that target instead. 102 00:03:54,030 --> 00:03:55,530 This is why it is so important 103 00:03:55,530 --> 00:03:58,020 to always have an up-to-date antivirus software 104 00:03:58,020 --> 00:04:00,000 on your system because those attempts 105 00:04:00,000 --> 00:04:01,800 to exploit the known vulnerabilities 106 00:04:01,800 --> 00:04:03,660 that they're trying first are going to be caught 107 00:04:03,660 --> 00:04:05,670 by the antivirus and blocked. 108 00:04:05,670 --> 00:04:06,600 This will give you a warning 109 00:04:06,600 --> 00:04:08,400 that someone is targeting your system, 110 00:04:08,400 --> 00:04:10,260 and that way you can better prepare yourself 111 00:04:10,260 --> 00:04:12,240 to fend off a future attack. 112 00:04:12,240 --> 00:04:14,040 Often, countries and nation states 113 00:04:14,040 --> 00:04:15,900 are stockpiling these zero-days, 114 00:04:15,900 --> 00:04:17,579 so they can use them as part of their spying 115 00:04:17,579 --> 00:04:19,709 or espionage operations or other things 116 00:04:19,709 --> 00:04:22,560 that are considered a high strategic value for them. 117 00:04:22,560 --> 00:04:26,010 So keep in mind when we talk about zero-day vulnerabilities 118 00:04:26,010 --> 00:04:28,740 and zero-day exploits, you're talking about a vulnerability 119 00:04:28,740 --> 00:04:31,680 that is being exploited before the developer knows about it 120 00:04:31,680 --> 00:04:33,150 and can release a software patch 121 00:04:33,150 --> 00:04:35,970 or security fix for that vulnerability. 122 00:04:35,970 --> 00:04:37,950 This makes them extremely destructive 123 00:04:37,950 --> 00:04:40,530 because they cannot be stopped by traditional antivirus 124 00:04:40,530 --> 00:04:42,000 or anti-malware solutions 125 00:04:42,000 --> 00:04:44,040 because the signatures haven't been written yet 126 00:04:44,040 --> 00:04:46,140 for those pieces of software. 127 00:04:46,140 --> 00:04:49,260 Now, remember, when it comes to a zero-day, this means 128 00:04:49,260 --> 00:04:52,290 that your system can be vulnerable for days, weeks, 129 00:04:52,290 --> 00:04:54,930 or even years without you even knowing it 130 00:04:54,930 --> 00:04:57,330 because the software developer themself doesn't know 131 00:04:57,330 --> 00:04:58,620 that vulnerability exists 132 00:04:58,620 --> 00:05:00,920 and therefore, they can't make a patch for it.