Firstly, what are the zero-day attacks?
The idea of a day zero threat, also known as a zero-day threat, is that the good guys have had no time, literally zero days, to respond to a newly identified security weakness. If a new security weakness is found in an operating system like Windows or somewhere in the computer, either in software or hardware, and it is just announced to the public without special handling beforehand, within a few minutes of the announcement cybercriminals can attack people on the basis of that new weakness. This means the attack comes before any patches or security improvements can be distributed widely. This gives the cybercriminals a window during which they can more easily attack.
Cybercriminals also rely on the fact that a lot of that of patching or updating of software, even when a fix is available, is very variable. Updating may be done only on a semi-regular basis or not at all. A legacy piece of software may not be fixed at all is the original distributors are no longer maintaining it.
The value of advance warning
As soon as the weaknesses found cybercriminals do as much as possible to exploit that weakness to their own advantage. However, in the recent times that’s become less of a threat because there’s been a general consensus between the antivirus or virus researchers, cybersecurity researchers and the actual software or hardware vendors, such as Microsoft or Intel, such that if someone discovers a vulnerability then they will give a heads up to the people responsible for providing a security patch ahead of the actual public announcement information on the weakness. So, hopefully, these days there will have been a chance for the vendors to actually have either pre-emptively included a patch or fix, or be very close to distributing it, when the announcement is made. Occasionally, discoverers want announcements to line up with particular security conferences which may mean there is less slack in terms of when the announcement will be made. However, more commonly, people have withheld announcements for a significant period of time pending the vendor’s resolving the exploit.
When you look at these zero-day exploits an extra advantage is the exploit can be attacked by new software that’s not actually been used before so the signatures of this type of software won’t be in the antivirus databases. This helps it slip through undetected and have easy access to a widely available our security hole.
Two things are working against this risk, even if it uses a zero-day exploit:
Firstly, if you try to update a previously released virus to attack this new weakness then peoples’ antivirus databases may actually have that virus signature, or one close enough, in their system. That is, if you do have antivirus then it can defeat such a zero-day attack. However, they are hoping that there are enough people without antivirus or up-to-date antivirus, that a modification of a previous virus will slip through.
The second thing working against zero-day attacks is having real-time monitoring by the antivirus software or dedicated real-time monitoring software, such as Heimdal, that can pick up a day zero attempted exploit before it actually achieves anything just by noting that software behaving unusually. This is because when the virus is trying to use the exploit it is most likely going to be behaving a bit differently than a completely normal program. This will flag it to the real-time monitor or the antivirus software that there is some issue with that piece of software. It will be blocked, or at least it will ask you whether you trust the flagged software or whether you want to be blocked.
Once real-time monitoring is detected the new virus, along with the signatures marking that virus’s presence, can be sent back to the antivirus companies website so they can implement a detection for this exploit. This blocking due to signature detection or due to a real-time monitoring flag is an interim measure until the exploit is fully closed by patching of the underlying problem software.
Here are the 5 tips to protect yourself from day zero attacks:
Tip 1: Use antivirus software on your systems. We’ve seen that antivirus software can be active against them.
Tip 2: The other great defense is to patch your software in a timely fashion so that any newly discovered exploits are closed as soon as possible. Antivirus software often has an option that will automatically check major software on your system is patched up to date.
Tip 3: Real-time checking by antivirus software or dedicated monitoring software is really important for blocking zero-day attacks, so keep that option turned on.
Tip 4: It’s also important to listen for zero-day warnings in the news so you know if you have to take special precautions. Be particularly careful online if there is a zero-day attack around!
Tip 5: You may even consider going off-line for a few days, or until fixes are available if there is a particularly hard to deal with attack underway.
I hope you found this information and video helpful. Neil Brown reviews.com has many written and video reviews to help you find the antivirus software that’s best for you and also has great deals on security and Internet software. We keep up to date with what discounts and special deals are available.
Cheers for now, from Neil
