Analysis of Zero-Day Vulnerabilities in Java MARIUS POPA

The zero-day vulnerability is a security lack of the computer system that is unknown to software vendor. This kind of vulnerability permits building attack strategies for gaining the access to the resources and data of a computer system. The main issue of the topic is how a computer system can be protected by zero-day vulnerabilities using the actual security procedures and tools for identifying the potential attacks that exploit the vulnerabilities unknown to computer users and software providers. The paper highlights the main features of such kind of vulnerabilities, some exploitation methods and examples of them for Java zero-day vulnerabilities and how protection strategies can be built on intelligence extracted from attack anatomy analysis. Key-Words: Zero-Day Vulnerability, Security Exploit, Threat Intelligence 1. Features of Zero-Day Vulnerabilities A Zero-day vulnerability refers to a security lack in a software that is unknown to the software vendor. The security lack is exploited by hackers to vulnerability window closing with security patches by the software vendors. Vulnerability window duration depends on the time when the software vendor becomes aware about the vulnerability and a security patch is developed to close the security window. The vulnerability window exists between the time when the vulnerability is first exploited and the time when the software vendor publishes the security patch to close the security lack. Taking into account the above considerations, the following actions are stated as being part of the vulnerability window time line:  The software vendor develops a software application containing an unknown vulnerability;  The attacker find the vulnerability that is still unknown to the software vendor;  The attacker develops malicious software that is used or distributed; the software vendor does not know the vulnerability or know it but cannot close it;  The software vendors or users are aware about the vulnerability exploiting and security patch development starts;  The software vendor releases the security update to close the security lack. Sometimes, the security patch is a source of information for attack engineering planned by exploitation developers. The main issue of a zero-day vulnerability is the software vendor awareness about the vulnerability presence in the released software. Before that, aware hackers about the security lack use malicious software for access to the users’ information. There are situations when the software vendor or technology provider is aware about the presence of the vulnerability. They postpone the security fixes till the vulnerability exploiting or public disclosure of that vulnerability. A very good example is the vulnerability found in Simple Network Management Protocol (SNMP) that was fixed more than 6 months after the time when it was discovered. The users’ information can be accessed by the following attacking techniques:  Web browsers when the security lack is discovered in such kind of software or they permit software installing on target computer system; web browsers are very popular in accessing the Internet information and distributed software; Journal of Mobile, Embedded and Distributed Systems, vol. V, no. 3, 2013