- Jan 24, 2011
- 9,379
Seven myths about zero day vulnerabilities debunked
- Thread starter Jack
- Start date
bogdan
Level 1
- Jan 7, 2011
- 1,362
It all depends about what everyone understands "0-day vulnerabilities" to be. If he talks about unknown flaws discovered in a product that can be exploited, he might be right. But unfortunately there are also known flaws with proof-of-concept code available on public sites like Exploit Database or integrated into Metaspoit that anyone can use to produce malicious software but companies ignore for some time. Sure, most malware threats do not use 0-day vulnerabilities and if you install updates regularly you are much safer, but there are some that do and those create significant damage. It took a long time for Microsoft to patch all 0-day vulnerabilities Stuxnet used.
And there is another aspect. In some cases malware doesn't even need to exploit a vulnerability since users are tricked into running the software themselves and they use an administrator account with UAC turned off. They exploit the user
And there is another aspect. In some cases malware doesn't even need to exploit a vulnerability since users are tricked into running the software themselves and they use an administrator account with UAC turned off. They exploit the user
Similar threads
