Feeds

Ready, aim ... exploit! Experts calculate exact moment to launch that precious 0-day weapon

Don't fire until you see the whites in their silicon dies

Internet Security Threat Report 2014

There's a right time and a wrong time to exploit a vulnerability – and according to researchers from the University of Michigan, that's something that can be worked out ahead of time.

According to this paper Timing of cyber conflict, available from PNAS, knowing exactly when to launch a digital assault is something that can be calculated from the following information:

  • Persistence – “the probability that if you refrain from using it now, it will still be useable” in the future. In other words, if you have a zero-day up your sleeve (and bear in mind they are worth a lot of money), do you use it now, or hope that it won't get patched before you want to use it?
  • Stealth – “the probability that if you use it now it will still be usable” in the future. In other words: can you deploy an attack based on a vulnerability, without being detected?
  • Threshold – What conditions would lead you to use a particular cyber attack vector?

The findings may not be particularly Earth-shattering to seasoned infosec professionals, but they can be taken as a neat summary of considerations IT security types must ponder every day.

As the authors say: “The heart of our model is the trade-off between waiting until the stakes of the present situation are high enough to warrant the use of the resource, but not waiting so long that the vulnerability the resource exploits might be discovered and patched even if the resource is never used.”

The writers, Robert Axelrod and Rumen Iliev of the Ford School of Public Policy at the University of Michigan, then test the model against historical examples such as Stuxnet; Iran's attack on Saudi Aramco; Chinese cyber-espionage; and China's restriction of rare earth exports.

In the Stuxnet case, they say, the attack used had low persistence because it depended on a combination of vulnerabilities: the use of USB keys to deploy the worm (which could have been banned at any time by the target, the Iranian nuclear enrichment plant at Natanz), the spread technique (via a shared printer), and the worm's privilege escalation. However, because the attack was stealthy, its designers were confident that it would evade detection (as it did, for 17 months), so they decided that it was better to deploy sooner rather than later.

Similarly, they say, China's apparently-frequent cyber-espionage seems to be predicated on the belief that their attacks have low persistence (they'll get patched soon) but may have reasonable stealth.

While none of this will come as a surprise to experts in the field, the aim of the Axelrod-Iliev paper seems to be to help policy-level people understand the cyber-attack landscape with a minimum of technical grasp. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.