This course delves into the world of zero-day vulnerabilities and their exploits, providing insights into the vulnerability research and exploit development industry. The learning outcomes include understanding the characteristics of vulnerabilities, the groups involved in vulnerability searches, and the impact of mitigations on exploitability. Students will also learn about exploit development timelines, vulnerability longevity, and the implications of zero-day vulnerabilities across various sectors. The course teaches skills such as analyzing vulnerability data, interpreting exploit development trends, and making recommendations based on findings. The teaching method involves data analysis, statistical insights, and real-world observations. This course is intended for cybersecurity professionals, researchers, and individuals interested in offensive and defensive security operations.
Zero Days, Thousands of Nights - The Life & Times of Zero-Day Vulnerabilities and Their Exploits
Overview
Syllabus
Intro
The decision calculus is complicated
We focus on characteristics of the vulnerabilities
Various groups search for vulnerabilities
BUSBY finds zero-day vulnerabilities, and develops exploits for them
Data stats: three main types of vulnerabilities
Vulnerability Sub-Type: Memory Corruption
Vulnerability Sub-Type: Memory Mismanagement
Vulnerability Sub-Type: Logic
Data stats: number of vulnerabilities per source code type
Data stats: number of vulnerabilities found and exploited, by vendor
Some other observations about the data
Exploit development time is relatively short
Mitigations have affected exploitability (e.g., heap vs stack overflow)
Exploit development career lengths vary
There are some caveats to our research
Life Status
About 1 in 6 of the alive are immortal
Patches killed most of the dead
Code revisions created a bunch of code refactored "zombies"
Longevity
We plotted the survival probability of our data
Average life expectancy is nearly 7 years
Do certain characteristics indicate a long or short life?
Does life expectancy or survival probability change over time?
Collision Rate
Clarity about time intervals is important
Implications and recommendations of findings
Our findings can help inform the retain vs. disclose discussions
Zero-days affect many sectors, and raise policy questions
Key findings
Taught by
Black Hat
