7 June 2017

334 zero-days were used in APT attacks since 2006

334 zero-days were used in APT attacks since 2006

Security is not a process. It's a state until you get pwned (c)

We are extremely glad to announce the official opening of Free Zero-Day Vulnerability Tracking Project, aimed to disclose and make publicly available information on all zero-day vulnerabilities ever used in the wild. For now, the database contains description of 353 zero-day vulnerabilities exploited since 2006.

Our research covers vulnerabilities of the most dangerous kind - the ones that are unknown to anybody except the malicious actor. Once they are used in a properly engineered attack there is no way to stop the hack. In the past decade we have witnessed sophisticated crimes, perfectly planned, organized and executed by the real Kung Fu masters of keyboard, mouse and espionage.

During our research we have gathered and analyzed publicly available information about almost 100 APT campaigns and reports on more than 500 vulnerabilities, suspected to be exploited in the wild both in targeted and mass attacks. As data sources we have used vulnerability databases, reports from companies and researchers in the field, news articles, official statements, etc. For comparison purposes we have chosen yearly reports from major IT security market players, who publish zero-day vulnerability statistics, such as Symantec, Trustwave, Flexera/Secunia, and FireEye.

Below is comparison statistics for reported zero-days by different security companies and our research under OSINT abbreviation in red color.

The largest number of zero-day vulnerabilities was reported in Microsoft products - 46% of all zero-days. The second closest vendor is Adobe with just 18% of the "market".

At the same time, the malware developers chose office applications as the most popular attack vector (73 zero-days) and operating system components (72 zero-days). The third place is taken by the number of exploits against browser-based plugins (e.g. ActiveX components, Adobe Flash player, Silverlight, etc.) - 57 in total. Along with web browsers (41 zero-days) they cover 73% of all vulnerabilities used in the wild.

All APT campaigns, analyzed during this research, were perfectly organized and significantly financed. And we do not believe these were crowdfunding projects from Kikstarter =) The only logical conclusion is that all of the espionage campaigns were planned, sponsored and executed by intelligence services of different countries. The latest leaks presented by the WikiLeaks project made us even more sure of that.

The full research along with free access to vulnerability database: https://www.zero-day.cz/

Sincerely yours,
Valerii Marchuk
Microsoft MVP, founder of Cybersecurity Help s.r.o.


Back to the list

Latest Posts

Week in review: major security incidents in October 9-15

Week in review: major security incidents in October 9-15

The article contains a brief report of cybersecurity incidents for the past week.
16 October 2017
Week in review: major security incidents in October 2-8

Week in review: major security incidents in October 2-8

The article contains a brief report of cybersecurity incidents for the past week.
9 October 2017
Week in review: major security incidents in September 25 – October 1

Week in review: major security incidents in September 25 – October 1

The article contains a brief report of cybersecurity incidents for the past week.
3 October 2017
Featured vulnerabilities
FreeBSD update for WPA2 protocol
Medium Patched | 18 Oct, 2017
Information disclosure in Tor
Low Patched | 17 Oct, 2017

Future events
Location: Na Strži 65/1702, Praha 4
Links: http://financnictvi.konference.cz/

Technologické inovace ve finančním sektoru (FINTECH). Kybernetická bezpečnost, risk management, decision engine, datová analýza, reporting, platformy bezpečnostních technologií, mobilní aplikace v globálním světě financí, projektové řízení, případové studie.
Location: Bajkalská 25/A, Bratislava
Links: http://bdd.exponet.sk/

Explózia dát je nepochybne sprievodným javom súčasnosti. Preto aj problematika bezpečnosti a dostupnosti dát zaznamenáva prevratný rozvoj a jej obsah a rozsah sa mení tiež v súvislosti s vývojom nových technológií. Ochrana dát sa netýka len jednotlivých zariadení, ale aj sietí, online úložísk a služieb. Množstvo dát, portfólio zariadení a úložisk sa tiež významne rozširuje s nástupom internetu vecí. Konferencia sa zameriava na aktuálne trendy a možnosti lepšej ochrany a efektívnej práce s dátami.
Location: Na Strži 65/1702, Praha 4
Links: http://did.konference.cz/

Konference přinese aktuální témata, vystoupení předních odborníků z praxe i z akademického prostředí, případové studie. V popředí zájmu budou big data, data analytics, propojování interních a externích dat, business intelligence, geodata, open data,  big data ve finančnictví, vzdělávání i astronomii.