Attackers are chaining multiple zero-day vulnerabilities together to break into fully patched systems. Google Project Zero found a campaign using 7 zero-days within an 11-zero-day attack, a capability only nation-states possess. Current security ratings like CVSS miss this compounded risk, treating separate vulnerabilities like gunpowder ingredients that become far deadlier when combined.
Chapters
Cyberattacks are leaping ahead in sophistication and the industry is just not prepared. As an example, Google Project Zero, their team recently detected attackers that exploited a combination of 7 previously unknown vulnerabilities, zero days, to hack fully patched Windows, Android, and iOS systems. Now, this was part of a bigger campaign from these attackers. That leveraged a total of 11 zero-day attacks. This is unheard of. So what is a zero-day exploit? A zero-day is a vulnerability that is known by the parties that discover it, but not anybody else, including the, maybe the software developer or the operating system owner, so that they know to patch it., and this allows the attackers to exploit it and have a huge advantage. And they're very, very valuable in, in the environment. If you can imagine, using a single zero-day is rare and they are very coveted. In fact, some zero-days have fetched over a million dollars on the open market. So this is something that, that people try and discover and Product developers try and make sure that there aren't any major vulnerabilities like that that can be used to the detriment of their users. Now, chaining together these vulnerabilities or, or any kind of vulnerability is common, but not with zero days because they're very, very rare. And so this is a whole different game when zero days are exploited that way in force. And detecting attacks leveraging zero days, well, that's bad enough because you don't know what's out there. But again, chaining all of these together, that is far beyond the scope of what can currently be addressed. It's just not practical in our current cybersecurity, um, environment. And this type of attack is not trivial. It is tremendously complex. You have to discover or acquire, you can purchase zero days sometimes, and then you have to develop the exploits to take advantage of those vulnerabilities that is specific to the individuals that you're targeting. You have to test those exploits and then you have to integrate them into some type of framework that also aligns with your intended target. And in many cases, just like the one that, that Google Zero team found, an infrastructure had to be built and maintained to deploy the attack. And even once these attacks are launched, the attackers, well, they have to continuously adapt and fine-tune them because the targets sometimes react or things just change in the environment. So these kinds of attacks require huge skills. Serious resources, patience, focus, and an organizational capability in order to pull off these attacks successfully. And there really aren't many attackers that can do that. We're really talking about nation-states. They're the ones that have the resources, the skills, constantly investing. They have the patience, and they're the ones that are— they're that are attacking in these ways. So they have the ability to acquire and chain together exploits of multiple zero-day vulnerabilities. Unfortunately, the current rating schemes that we have around, uh, vulnerabilities like CVSS, they're not well designed to comprehend the complexities of such nested risk scores. And as attackers are chaining these vulnerabilities together, it kind of undermines this, this current rating scheme that we have. Imagine evaluating saltpeter, sulfur, and charcoal, right? Independently, okay, they're kind of interesting, but you combine them and you get gunpowder. Well, the same principle applies when you look at vulnerabilities in general. If you look at a vulnerability just by itself, it may not be that interesting. But if you can see the bigger picture where somebody can take that vulnerability and chain it to another to get to something else to do something really bad and down the line, that then becomes a much greater problem. And right now our scoring systems don't see it in that holistic way. And we need to change that. And these exploits that are originally funded or developed by nation-states, they can— once they're released in the environment, everybody can kind of see them and tear them apart and figure out how they work. And that can waterfall down to other types of attackers, to cyber criminals and everything, and they get— tend to get reused. So It's not just the problem of the target of that nation-state. It becomes everyone's problem eventually. And overall, I think this is an important signal for the next big step that cybersecurity needs to take. We need to be able to adapt, uh, our rating systems to account for chaining these types of zero days, uh, or any type of vulnerability. We have to understand the types of zero days that are going to be flooding into our market. It used to be extraordinarily rare to even see 1 or 2 of these pop up in a quarter, and now, you know, one attacker used 11 of them in a single attack. So our understanding of the scope and the challenges has to shift. This isn't just one little step forward, and we need to start driving significantly better product security, DevSecOps and DevSec, right, to make sure that our products don't have so many holes. And that will shrink down the attack surface and it will reduce the amount of vulnerabilities that can be, you know, discovered and then chained together. So we have to do a number of different things here. And it's really important for organizations to start to comprehend that nation states, the influence of nation states into the vulnerability market, into the ATT&CK infrastructures and everything else, should be playing a role in their risk models. Even if they're not perceived as being a likely target, it's still going to impact you because of how these vulnerabilities can waterfall down. And if the attack does happen to somebody who provides a product or service that you use, that then impacts you. That's a supply chain issue. It's more complex. We have to take a more comprehensive look at those threat agents when it comes to risk modeling. Okay, so overall, this is not a small evolutionary step. This signals a big leap in the cybersecurity industry, and one that right now we're simply not prepared for.
