Zero Day Threats, Part 1: What They Are, and What They're Not

During the past seven years at McAfee Avert Labs, I’ve had the opportunity to fill several roles. More recently I’ve stepped away from day-to-day threat processing and focused on mid- and long-term threat intelligence. Namely this includes threat forecasting; gathering and analyzing threat trends and upcoming influential factors to forecast what may lie ahead. The resulting data is being used by customers to help them plan for the future, invest more wisely, and mitigate risk. The information also helps drive and shape McAfee product offerings.

One of the areas that I’ve spent some time analyzing is that of the zero-day threat. The first step when considering a threat is to define it. Over the years, the term zero day has been used for a number of things; from vulnerabilies and exploits, to viruses, Trojans, and even spam and phish. I define a zero-day threat as follows:

Exploit information does not necessarily mean a working exploit, or even proof of concept code, but at a minimum it means that enough technical details are available for someone to find the vulnerability on their own, to create a working exploit.

This definition excludes a number of things that some would not like to exclude:

• Malware that doesn’t exploit anything new. Some like to refer to new malware as a zero-day threat, so that they can claim zero-day protection. We already have a term for that, proactive protection.
• Spam & phish that doesn’t exploit anything new. The same applies here.
• Vulnerabilities that are privately disclosed to the vendor. I do not consider brief, yet public, “Upcoming Advisories” that are published when a vendor is notified to be a zero-day threat; unless sufficient vulnerability details are also made public.

The two recent Yahoo Messenger vulnerabilities were an interesting case. Ryan Naraine’s blog has a good write-up. eEye published an “Upcoming Advisory” after discovering the vulnerabilies and reporting them to the vendor. A Yahoo spokesperson inadvertently spilled the beans and gave additional details that were not public. While I wouldn’t say that those details were sufficient to call these zero-day threats at that point, they were enough for a researcher to find the vulnerability within an hour, give or take. The results of that research, proof-of-concept exploit code posted to the Full Disclosure mailing list, were zero-day threats. Shortly thereafter, other exploit code was posted to the Web, and attacks were discovered in the field. In the end it didn’t much matter what the zero-day timestamp was for this threat, Yahoo users were put at risk, and certainly attacked. Yahoo did manage to turn around a patch in an amazing 48 hours, but surely there are many thousands of users who have yet to apply the patch.

There’s much more to cover on the topic of zero-day threats. Stay tuned for part 2 of this series.

– Update June 14 –
Part 2 has been posted: Zero-Day Threats, Part 2: Who’s Behind Them and Why?