Biz & IT —

0-day exploits more than double as attackers prevail in security arms race

Spike brings number to 54 in 2015, the highest ever recorded.

The number of zero days showed their sharpest rise ever in 2015, reaching a record 54.
Enlarge / The number of zero days showed their sharpest rise ever in 2015, reaching a record 54.
Symantec

The number of attacks that exploited previously unknown software vulnerabilities more than doubled in 2015 as hackers raced against security defenders to find effective ways to infect end users with malware, according to a recently released report.

The number of "zero-day" exploits—a term that was coined because affected software developers have zero days to release a patch that keeps users protected—reached an unprecedented 54, according to researchers at security firm Symantec. That number compared with 24 in 2014, 23 in 2013, and 14 in 2012. The increase was partly caused by the breach of Italy-based zero day broker Hacking Team, which spilled six closely guarded zero days into the public domain. It also came as Adobe and other developers significantly reduced the time it took to release patches that plugged zero-day holes.

"It is difficult to defend against new and unknown vulnerabilities, particularly zero-day vulnerabilities for which there may be no patch, and attackers are trying hard to exploit them faster than vendors can roll out patches," Symantec researchers wrote in the company's annual Internet Security Threat Report. The report went on to say that the Angler exploit kit, a package sold in Internet crime forums, was able to quickly integrate the growing number of zero days into its arsenal.

Thanks, Adobe

Unsurprisingly, the software suffering the most zero-day attacks last year was Adobe Flash, with a whopping 10 vulnerabilities, or 17 percent of all the 2015 zero days. As checkered as the media player software's reputation is, last year represented an improvement over 2014, which recorded 12 attacks exploiting previously unknown vulnerabilities. (Last week, Adobe fixed a Flash vulnerability that was being exploited to surreptitiously install crypto ransomware on end-user computers.) Microsoft software also sustained 10 zero-day attacks, although they were spread out among a larger portfolio of products, including Windows with six exploits, Internet Explorer with two exploits, and Office with two exploits.

The growth in zero-day attacks came as software developers sharply reduced the time it took to patch the underlying vulnerabilities. On average, it took just one day for them to release a patch in 2015, compared with 59 days in 2014 and four in 2013. The total time of exposure for last year was seven days, compared with 295 days in 2014 and 19 days in 2013.

Symantec

The accelerated pace is likely a major contributor to the increased number of zero-day attacks. Once a vulnerability is patched by a significant base of users, attackers discard it and replace it with new one. The statistics in the Symantec report underlie an arms race between criminal hackers and the software developers who are charged with trying to stop them. Given the nearly unlimited number of critical vulnerabilities that can be found in widely used applications, especially those like Flash that have a sprawling and aging code base and a massive number of users, the attackers continue to get the upper hand at the expense of computer users everywhere.

Listing image by Kaspersky Lab

Channel Ars Technica