Zero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits

on YouTube ↗56m

" summary

RAND analyzes a private dataset of ~200 zero-days spanning 14 years from 64 vendors and finds over half still unknown, an average lifespan of ~7 years, and a median ~6% per year collision rate (drops to <1% over 90 days). Exploit development is fast—70% of exploits developed within a month, 31% within a week. Memory corruption dominates; mitigations shift attackers from stack to heap. Purchased bugs (4%) die quickly; hypervisor/AV bugs remain largely viable.

AI-written summary · about

" chapters (31)

1. 0:00Intro
2. 3:00The decision calculus is complicated
3. 6:15We focus on characteristics of the vulnerabilities
4. 8:43Various groups search for vulnerabilities
5. 12:20BUSBY finds zero-day vulnerabilities, and develops exploits for them
6. 14:10Data stats: three main types of vulnerabilities
7. 14:37Vulnerability Sub-Type: Memory Corruption
8. 14:58Vulnerability Sub-Type: Memory Mismanagement
9. 15:14Vulnerability Sub-Type: Logic
10. 15:30Data stats: number of vulnerabilities per source code type
11. 15:44Data stats: number of vulnerabilities found and exploited, by vendor
12. 16:29Some other observations about the data
13. 19:15Exploit development time is relatively short
14. 20:20Mitigations have affected exploitability (e.g., heap vs stack overflow)
15. 21:35Exploit development career lengths vary
16. 24:32There are some caveats to our research
17. 25:49Life Status
18. 26:37About 1 in 6 of the alive are immortal
19. 27:01Patches killed most of the dead
20. 27:35Code revisions created a bunch of code refactored "zombies"
21. 28:13Longevity
22. 30:43We plotted the survival probability of our data
23. 31:34Average life expectancy is nearly 7 years
24. 32:03Do certain characteristics indicate a long or short life?
25. 34:34Does life expectancy or survival probability change over time?
26. 35:19Collision Rate
27. 37:18Clarity about time intervals is important
28. 39:52Implications and recommendations of findings
29. 41:48Our findings can help inform the retain vs. disclose discussions
30. 43:03Zero-days affect many sectors, and raise policy questions
31. 44:28Key findings

" related talks

• 15mThink Zero Days Are Your Your Biggest Risk - Think AgainCiara Campbell · BSides London 2021
• 40mTales from the Underground: The Vulnerability Weaponization LifecycleMayra Rosario Fuentes · RSAC 2021
• 39mCVE 101: The Unfolding Of A Zero Day AttackTheresa Mammarella · Jfokus 2023
• 44mPreparing for Zero-Day: Vulnerability Disclosure in Open Source SoftwareJennifer Fernick, Christopher R Robinson, Anne Bertucio · FOSS Backstage 2022
• 16mHistorical Analysis of Exploit Availability TimelinesJonathan M. Spring, Allen D. Householder, Jeff Chrabaszcz, Trent Novelly, David Warren · 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET '20)
• 39m"Vulnerabilities for Sale - The Good, the Bad and the Ugly"Udo Schneider · CONFidence 2019
• 50mSelling 0-Days to Governments and Offensive Security CompaniesMaor Shwartz · Black Hat USA 2019
• 35m0-day In-the-Wild Exploitation in 2022...so far.Maddie Stone · 34th Annual FIRST Conference 2022