Skip to main content

When to burn a Zero-Day?

So I've often heard people say "Why would you waste a Zero-day on <insert something>?". And on the opposite end of using your Zero-day, you have the hoarders who simply collect them to keep in their back pocket. So the question remains, when is the appropriate time to actually use a Zero-day for legitimate purposes?

The primary impetus for this discussion was someone smugly claiming they would never use a zero-day in a hacking competition or CTF event. So I can understand that stance, however if your trying to win something like P0wn20wn or some other serious hacking competition why wouldn't you? Is that truly a waste of a good Zero-day if it brings you respect in the industry and potentially more consulting work? I don't believe so, however financially given the cost of exploit development it may be wasteful. I think it really depends on the exploit. I've heard that security research companies often task teams of individuals for months to years just to develop a great reliable remote exploit on a popular platform or application. That isn't cheap in terms of billable hours by any means. Financially it may make sense to sell your exploit, however as a whitehat and someone who is a fan of responsible disclosure I can't agree with this line of thought. The other option may be to leverage that exploit in your pen testing engagements. So how would that benefit the customer? Yes it may give you credibility, but if they can't do anything about it patching wise, then nothing is gained. I don't buy into that approach unless you as a pen tester can recommend a solid mitigation plan for the vulnerability you've exploited.

To wrap things up, unless you are specifically tasked to research and deliver a working exploit to a customer for their use, I think it makes the most sense to just follow the responsible disclosure methods. To the contrary, if you are trying to build up your credibility and/or consulting business then it may also make sense to use them in an engagement or competition. I still do not believe the customer is looking to be exploited by a zero-day without any mitigation possibilities, unless you can show them that the exploit is already being traded in the underground. In that case, it is not really your private exploit but a legitimate attack they need to prepare for.

Comments

Popular posts from this blog

2020 SANS CTI Summit Notes

Unfortunately due to some back surgery I was not able to attend the SANS CTI summit this year, however I always try to take advantage of the great content SANS makes available. To help me out in synthesizing the information, I combined the context provided by those that were live tweeting which is useful when reviewing the slide decks. Hope you find this useful and well done @rickholland , @PDXbek , and @likethecoins , another great year of great content! Day 1 Secret Squirrels and Flashlights: Legal Risks and Threat Intelligence https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1579535253.pdf @CristinGoodwin Assistant General Counsel for Customer Security and Trust, Microsoft Boundaries and strategies to help analysts identify and manage legal risks while hunting, investigating, and responding "Have a principled approach to sharing, so when the crisis comes you don’t have to panic.” "What we call common in #threatinel sharing is what a l

FIRST Conference 2018 - Review (Kuala Lumpur Edition)

As apart of my new job, my employer is seeking to gain FIRST membership later this year. To support that goal, I was asked to attend the 30th FIRST Conference in Kuala Lumpur. For the travel weary, this is not a trip to take lightly. For me it was 3 flights and 28 hours total of travel just to arrive. I do have to say, the conference venue, the Shangri-La hotel is absolutely fabulous. Very nice, clean, and ultra courteous staff. The swag bag I was given at registration was also very nice, including 3 shirts, challenge coin, notebook, mini first aid kit, and a pretty decent backpack. I also have to say the lunch options for the conference are vastly superior to anything I have ever experienced. SANS and Blackhat could learn a few things. For a 5 day conference, you get a much greater value here. If you are interested in jumping straight the slides you can visit here . Opening The conference was kicked off on Day 1 by Thomas Schreck (@shrekts) who gave out some

SANS Cyber Threat Intelligence Summit 2013

     I recently attended the first SANS CTI Summit in Washington DC. While there was plenty of brain power in the room, and good discussions were to be had, overall it was just ok. There was a big focus on what CTI is and why you should be doing it, or at least consuming it. There wasn't enough discussion, aside from one talk, on how you should be doing it. It basically reinforced my beliefs that this is still very much a small, closed off club of insiders, where nobody is sharing tradecraft. I love that SANS is getting involved in this space though, and it sounds like Mike Cloppert will be writing a SANS course on Threat Intelligence in the future. I would very much be interested in that and I expect it would sell out quickly.      Mike Cloppert opened the day by discussing the old vulnerability centric approach focused on reducing attack surface as opposed to the new threat centric model focused on reducing the risk of the actual threats affecting your company. The key focus of