When a zero-day vulnerability is exploited in the wild, it's essential to identify the bug at the root of the attack. This "root cause analysis" informs researchers how an attack unfolded.
"We care a lot about making it harder for people to exploit users using zero-days," said Google Project Zero researcher Maddie Stone in a Black Hat presentation on the topic. "When zero-day exploits are detected in the wild, that's the failure case for these attackers. And so we need to learn as much as possible each time that happens."
Much of the time, when the security industry learns of a zero-day exploit in a blog post or advisory, there is often information about the malware payload or attack group behind it, but little about the "nitty gritty" of how intruders got the initial access to launch their attack.
The goal of a root cause analysis comes down to figuring out what that vulnerability is, in such depth that researchers can trigger it, Stone explained. This shows they understand all the details – not just the overarching summary – as well as the attackers' exploit methodology. This information can help determine which actions should be taken next to prevent it from being exploited again, such as structural improvements, variant analysis, and new detection methods.
Over the past 12 months, Project Zero has analyzed 11 zero-day vulnerabilities exploited in the wild. Researchers used five different techniques to identify their root cause, underscoring a point Stone emphasized in her talk: the process for analyzing a vulnerability can vary each time.
"There's a lot of different ways to reverse engineer a vulnerability," she explai ..
Support the originator by clicking the read the rest link below.
