Even the most complex cyberattacks are too easy

By Joseph Marks, Washington Post

Welcome to The Cybersecurity 202! Whatever else 4/20 may signify, it's also the second birthday of this guy here. Happy birthday, Jet!

Below: European lawmakers on a committee investigating spyware get cracking, and a former eBay executive is pleading guilty in a bizarre cyberstalking scheme. 

‘Zero day’ cyber attacks should be harder to pull off

The most complex and time-consuming cyberattacks are still far too easy to pull off, according to a new report from Google’s Project Zero division.

These attacks, called zero days, are typically pulled off by extremely sophisticated hackers such as those employed by government intelligence agencies and top-end private companies like the controversial spyware vendor NSO Group. They’re more likely to give hackers long-lasting access to the technology they exploit and the ability to do far more damage. 

Ideally, such hacks would take so much time, effort and expertise that only the cream of the crop could find and use them. But that’s rarely the case, Google found. The report underscores the way cyberattackers continue to have an advantage over defenders — even at the very top of the hacking food chain. 

“It’s not as hard as it should be,” Maddie Stone, the Google researcher who developed the report, told me. “These should take so much effort to develop and cost so much money that they require years and years to develop, and that’s not what we’re seeing.”

“Zero day”

The annual report looks at cyberattacks conducted using “zero day” vulnerabilities. This is when highly sophisticated hackers are able to discover a vulnerability – and exploit it – before the developers are aware of the vulnerability (so they've had zero days to patch against it).

The report focuses specifically on zero days that researchers believe nefarious hackers have exploited rather than those that were merely discovered by the good guys. Because the zero day hacks are so comparatively easy to develop, hackers aren't as fearful of researchers discovering and protecting against them — so they use them more freely and cause more damage. 

The details

• Out of 58 exploited zero days that Google identified last year, all but two of them were comparatively easy to develop — they were essentially based on well-known security gaps in products that hackers frequently exploit.
• “With two exceptions … everything we saw was pretty ‘meh’ or standard,” the report states.
• The two totally novel zero days were both exploited with tools developed by NSO, which has drawn international condemnation because government clients used its tools to target journalists, dissidents and political opponents.

To be clear: Zero day hacks remain exceedingly rare compared with run-of-the-mill hacks, which use vulnerabilities that people and organizations know about but simply haven’t updated their technology to guard against. 

But they get outsize attention from cyberthreat researchers and media because they’re used against some of the most high-profile targets. 

“My mom and dad don’t need to worry about being attacked with zero days, but when politicians, journalists and human rights activists are targeted, that affects us in a very large way,” Stone told me. “We need to care about them because of the societal impact.” 

Questions

No one's sure quite how bad the zero day problem is.

Researchers simply don't know about the zero day bugs that they haven't discovered yet. And the people who do know about them — nefarious hackers — aren't sharing information. 

Stone estimated that the 58 zero days highlighted in this year’s Project Zero report represents less than 20 percent of the total number of zero days that were exploited in 2021, with the rest going undetected. 

“I’d probably hedge closer to 10 percent,” she said. “There’s a huge number of zero days that no one is detecting.”

There were more exploited zero days detected last year than in any previous year — more than double the previous record of 28 exploited zero days detected in 2015.

But that probably is because more zero days are getting discovered and reported rather than that there are more being exploited, the report states. 

More details from Project Zero via Recorded Future’s Allan Liska:

Yes, Black Cat Appreciation Day has become cheap and commercialized. But Jet celebrates regardless. pic.twitter.com/GpeFgOsdRv

— Joseph Marks (@Joseph_Marks_) August 17, 2021

One big difference in the number of zero day reports came from tech platforms that began specifying whether the previously undisclosed bugs they highlighted had been exploited by hackers or not. Such reports accounted for 12 of the 58 zero days reported — seven from Apple products and five from Google’s Android division. 

And yet: It's likely that many software vendors are aware of zero days that have been exploited on their platforms that they haven't publicly disclosed. One policy change Project Zero is calling for is a pledge from vendors to publicly disclose such bugs.