Cyberthreats are extremely multi-faceted and constantly evolving to disguise themselves and find new system vulnerabilities to exploit. This is why cybersecurity teams and managed service providers (MSPs) need to keep abreast of the latest intelligence relating to threats and vulnerabilities to better support and protect their clients.
One such threat that poses a significant problem for MSPs is a zero-day vulnerability.
Overview of a zero-day vulnerability
Zero-day refers to a cybersecurity vulnerability that has been recently discovered, allowing hackers to infiltrate a system or network. More precisely, a zero-day vulnerability refers to a security flaw that is yet to be discovered or has only recently been discovered by a developer or vendor, meaning they have ‘zero days’ to resolve the issue.
This presents cybercriminals with an opportunity to exploit the vulnerability before developers or security teams have the chance to fix it. These types of vulnerabilities do not match any known malware signatures, meaning developers have to work against the clock before an attack takes place.
A zero-day vulnerability is not the same as a zero-day exploit or attack; let’s quickly describe the differences.
- Zero-day vulnerability: Refers to a vulnerability that’s discovered by an attacker before the vendor or developer is to create a patch to fix the issue. This means the chances of an attack succeeding are very high.
- Zero-day exploit: A method of attack used by a hacker to target a recently discovered vulnerability.
- Zero-day attacks: Refers to the execution of the attack method, allowing the cybercriminal to access the network, steal sensitive information, damage systems and more.
Why are zero-day vulnerabilities so hard to protect against?
The main reason zero-day vulnerabilities are so hard to protect against is because they’ve gone undetected, meaning security teams are not actively on the lookout for them.
Furthermore, cybercriminals could potentially exploit such vulnerabilities hundreds of times before anyone notices an issue. In some cases, a zero-day vulnerability can go undetected for months or even years, allowing hackers to repeatedly access networks or steal information.
Even when a zero-day attack has been detected, the vulnerability may still be difficult to identify and fix. This can be a major issue for organizations that have multiple systems, meaning an implicated MSP needs to work quickly to locate the problem and create a patch.
What is there to gain from a zero-day attack?
Like most attacks, the key driver is monetary gain. This can be achieved in several ways:
- Stealing sensitive information: Many hackers attempt to access systems to steal financial data and banking information. This can be used directly to steal from the business or its customers, or sold on to a third party.
- Holding a business to ransom: Another tactic is to use ransomware or distributed denial of service (DDoS) attacks to hold a company’s data and systems to ransom, requiring the victim to pay a fee to have their systems reinstated.
- Targeting customers: Cybercriminals may also try to access MSP databases to target customers, using their information for additional fraudulent activity. In the long run, this can seriously damage the reputation of your organization.
Examples of zero-day vulnerabilities and attacks
1. The 2021 Google Chrome hack
Back in April 2021, an update was released for the Google Chrome Browser on Windows, Linux and Mac devices. One of the reasons for this was to fix a zero-day vulnerability known as CVE-2021-21224.
Although the exact details are vague, it is understood that this vulnerability allowed hackers to run code in Chrome’s sandbox environment via a custom HTML page.
2. The 2016/17 Microsoft Word attack
In 2016, a zero-day vulnerability was identified within Microsoft Word known as CVE-2017-0199, allowing attackers to install malware on the user’s device when they downloaded a Word document. Unfortunately, this led to millions of online bank accounts being breached before a patch was released in 2017.
3. Heartbleed
The Heartbleed bug was first identified back in 2014 and affected versions of OpenSSL via a simple programming error. This allowed hackers to reveal the contents of secured messages, including messages that contained banking and credit card details.
4. Shellshock
Also identified in 2014, the Shellshock attack targeted a vulnerability in the Unix shell and command language, Bash. This enabled attackers to execute commands with high-level privileges, potentially allowing them to take over the entire system.
What can security teams and MSPs do to protect themselves and their clients?
Here are six things security teams and MSPs can do to protect their clients and help prevent zero-day attacks.
1. Penetration testing
Penetration testing is a type of authorized and simulated attack performed on a computer system or network to evaluate the level of its security and identify weaknesses and vulnerabilities. This is achieved using a range of tools, techniques and processes that may be used by potential attackers.
2. Use behavioral analytics
Machine learning tools can be used to detect suspicious activity and spot unusual patterns or trends on a network. These tools analyze common behaviors of network users so they can quickly detect any abnormal usage.
3. Install only essential applications
Reduce the chances of network vulnerabilities by removing any unnecessary applications, ensuring only essential applications that employees regularly use are on the system.
4. Patches and updates
Ensure the operating system and every application on the system(s) are patched regularly, updating to the latest versions as soon as they are released by the vendor.
5. Educate users
Human error is one of the main vulnerabilities on any network, which is why cybersecurity training and education are essential to protect your organization. Ensuring employees stick to best practices and understand the importance of online security is one of the best ways to protect against a cyberattack.
6. Use a comprehensive antivirus solution
Ensure your system is protected by reputable and regularly updated antimalware, antivirus and firewall software. Recommended options include Bitdefender, Malwarebytes and Trend Micro.
Sherweb can help your MSP improve clients’ security posture
MSPs must stay on top of the latest cybersecurity intelligence, including zero-day vulnerabilities, if they are to effectively protect their clients and keep their reputations intact. Establishing strong communication with clients to keep them informed of potential vulnerabilities is also essential, ensuring direct action can be taken should a breach occur.
