Exploit (computer security): Difference between revisions

Revision as of 23:54, 28 April 2025

Latest revision as of 07:23, 26 June 2025

(3 intermediate revisions by 3 users not shown)

Line 10:

Researchers estimate that malicious exploits cost the [[global economy]] over US$450 billion annually.

In response to this threat, organizations are increasingly utilizing [[cyber threat intelligence]] to identify vulnerabilities and prevent hacks before they occur.<ref>{{Cite journal |last1=Indiana University, Bloomington |last2=Samtani |first2=Sagar |last3=Chai |first3=Yidong |last4=Hefei University of Technology |last5=Chen |first5=Hsinchun |last6=University of Arizona |date=2022-05-24 |title=Linking Exploits from the Dark Web to Known Vulnerabilities for Proactive Cyber Threat Intelligence: An Attention-Based Deep Structured Semantic Model |url=https://misq.umn.edu/linking-exploits-from-the-dark-web-to-known-vulnerabilities-for-proactive-cyber-threat-intelligence-an-attention-based-deep-structured-semantic-model.html |journal=MIS Quarterly |volume=46 |issue=2 |pages=911–946 |doi=10.25300/MISQ/2022/15392|url-access=subscription }}</ref>

== Description ==

Line 61:

=== Zero-click ===

A zero-click attack is an exploit that requires no [[user interaction]] to operate – that is to say, no key-presses or mouse clicks.<ref>{{Cite magazine|title=Sneaky Zero-Click Attacks Are a Hidden Menace|language=en-US|magazine=Wired|url=https://www.wired.com/story/sneaky-zero-click-attacks-hidden-menace/|access-date=2021-09-14|issn=1059-1028}}</ref> These exploits are commonly the most sought after exploits (specifically on the underground exploit market) because the target typically has no way of knowing they have been compromised at the time of exploitation.

[[FORCEDENTRY]], discovered in 2021, is an example of a zero-click attack.<ref>{{Cite magazine|title=The Stealthy iPhone Hacks That Apple Still Can't Stop|language=en-US|magazine=Wired|url=https://www.wired.com/story/apple-imessage-zero-click-hacks/|access-date=2021-09-14|issn=1059-1028}}</ref><ref>{{Citecite web |last=Whittaker |first=Zack |title=A new NSO zero-click attack evades Apple's iPhone security protections, says Citizen Lab |url=https://techcrunch.com/2021/08/24/nso-pegasus-bahrain-iphone-security/ |access-date=20212025-0905-1425 |websitework=[[TechCrunch]] |date=24 August 2021|language=en-US |archive-date=2021-08-24 |archive-url=https://web.archive.org/web/2021082412471820210824103937/https://social.techcrunch.com/2021/08/24/nso-pegasus-bahrain-iphone-security/ |url-status=live}}</ref>

In 2022, [[NSO Group]] was reportedly selling zero-click exploits to governments for breaking into individuals' phones.<ref>{{cite news |journal=Insurance Journal |url=https://www.insurancejournal.com/news/international/2022/02/18/654917.htm |title=Beware of 'Zero-Click' Hacks That Exploit Security Flaws in Phones' Operating Systems |author=Ryan Gallagher |date=February 18, 2022}}</ref>

For mobile devices, the [[National Security Agency]] (NSA) points out that timely updating of software and applications, avoiding public network connections, and turning the device Off and On at least once a week can mitigate the threat of zero-click attacks.<ref>{{Cite web |title=Why you should power off your phone once a week - according to the NSA |url=https://www.zdnet.com/article/why-you-should-power-off-your-phone-once-a-week-according-to-the-nsa/ |access-date=2025-03-01 |website=ZDNET |language=en}}</ref><ref>{{Cite web |title=Telework and Mobile Security Guidance |url=https://www.nsa.gov/Press-Room/Telework-and-Mobile-Security-Guidance/ |access-date=2025-03-01 |website=www.nsa.gov}}</ref><ref>{{Cite web |last=Winder |first=Davey |title=NSA Warns iPhone And Android Users To Turn It Off And On Again |url=https://www.forbes.com/sites/daveywinder/2024/06/01/nsa-warns-iphone--android-users-to-turn-it-off-and-on-again/ |access-date=2025-03-01 |website=Forbes |language=en}}</ref> Experts say that protection practices for traditional endpoints are also applicable to mobile devices. Many exploits exist only in [[Computer memory|memory]], not in files. Theoretically, restarting the device can wipe malware payloads from memory, forcing attackers back to the beginning of the exploit chain.<ref name="zdnet25021801">{{Cite web |title=Why rebooting your phone daily is your best defense against zero-click attacks |url=https://www.zdnet.com/article/why-rebooting-your-phone-daily-is-your-best-defense-against-zero-click-attacks/ |access-date=2025-03-01 |website=ZDNET |language=en}}</ref><ref>{{Cite web |last=Taylor |first=Craig |date=2020-01-10 |title=Exploit Chain - CyberHoot Cyber Library |url=https://cyberhoot.com/cybrary/exploit-chain/ |access-date=2025-03-01 |website=CyberHoot |language=en-US}}</ref>

=== Pivoting ===