Things like Heartbleed come to mind, or really any Zero day to be honest. What if I am a company who relies on product X but product X has just been found to have a bad vulnerability and it will probably take a couple days to patch. What do I do? Do I leave it vulnerable and keep myself open or do I shut down?
- Hot
- Active
-
Forum Thread: When My Kali Linux Finishes Installing (It Is Ready to Boot), and When I Try to Boot It All I Get Is a Black Screen. 8 Replies
3 days ago -
Forum Thread: HACK ANDROID with KALI USING PORT FORWARDING(portmap.io) 12 Replies
1 wk ago -
Forum Thread: Hydra Syntax Issue Stops After 16 Attempts 2 Replies
1 mo ago -
Forum Thread: Hack Instagram Account Using BruteForce 208 Replies
1 mo ago -
Forum Thread: Metasploit reverse_tcp Handler Problem 47 Replies
2 mo ago -
Forum Thread: How to Train to Be an IT Security Professional (Ethical Hacker) 22 Replies
3 mo ago -
Metasploit Error: Handler Failed to Bind 41 Replies
3 mo ago -
Forum Thread: How to Hack Android Phone Using Same Wifi 21 Replies
3 mo ago -
How to: HACK Android Device with TermuX on Android | Part #1 - Over the Internet [Ultimate Guide] 177 Replies
3 mo ago -
How to: Crack Instagram Passwords Using Instainsane 36 Replies
3 mo ago -
Forum Thread: How to Hack an Android Device Remotely, to Gain Acces to Gmail, Facebook, Twitter and More 5 Replies
3 mo ago -
Forum Thread: How Many Hackers Have Played Watch_Dogs Game Before? 13 Replies
3 mo ago -
Forum Thread: How to Hack an Android Device with Only a Ip Adress 55 Replies
4 mo ago -
How to: Sign the APK File with Embedded Payload (The Ultimate Guide) 10 Replies
4 mo ago -
Forum Thread: How to Run and Install Kali Linux on a Chromebook 18 Replies
5 mo ago -
Forum Thread: How to Find Admin Panel Page of a Website? 13 Replies
6 mo ago -
Forum Thread: can i run kali lenux in windows 10 without reboting my computer 4 Replies
6 mo ago -
Forum Thread: How to Hack School Website 11 Replies
6 mo ago -
Forum Thread: Make a Phishing Page for Harvesting Credentials Yourself 8 Replies
6 mo ago -
Forum Thread: Creating an Completely Undetectable Executable in Under 15 Minutes! 38 Replies
8 mo ago
-
How To: Exploit EternalBlue on Windows Server with Metasploit
-
How To: Scan for Vulnerabilities on Any Website Using Nikto
-
How To: Crack Shadow Hashes After Getting Root on a Linux System
-
How To: Check if Your Wireless Network Adapter Supports Monitor Mode & Packet Injection
-
How To: Gain SSH Access to Servers by Brute-Forcing Credentials
-
How To: Perform Advanced Man-in-the-Middle Attacks with Xerosploit
-
How To: Scan Websites for Interesting Directories & Files with Gobuster
-
How To: Dox Anyone
-
How To: Crack SSH Private Key Passwords with John the Ripper
-
How To: Hack Apache Tomcat via Malicious WAR File Upload
-
How To: Make Your Own Bad USB
-
How To: Crack Password-Protected Microsoft Office Files, Including Word Docs & Excel Spreadsheets
-
How To: Spy on Traffic from a Smartphone with Wireshark
-
Hack Like a Pro: How to Find Directories in Websites Using DirBuster
-
How To: Use Command Injection to Pop a Reverse Shell on a Web Server
-
How To: Top 10 Things to Do After Installing Kali Linux
-
How To: Scan, Fake & Attack Wi-Fi Networks with the ESP8266-Based WiFi Deauther
-
How To: Use an ESP8266 Beacon Spammer to Track Smartphone Users
-
How To: Use MDK3 for Advanced Wi-Fi Jamming
-
How To: Use Ettercap to Intercept Passwords with ARP Spoofing
7 Responses
In most situations, companies notify their customers of the bug and notify them that a fix is currently being worked on. The next steps really depend on what the zero day exploit is.
If the zero day gives criminals access to passwords (or hashed passwords if you're good at that stuff), then tell customers to change their passwords while you're working on a fix.
If the zero day gives criminals back doors in victim machines, then it's probably best to shut down services so no damage can be done.
That does make alot of sense, I would be so nervous as a company, especially if I was a financial site. You also have to consider complaining customers. If the zero day isn't really bad and you can keep it quiet than I guess all customers would see is requests to set a new password.
Just to be clear, this doesn't mean this company was the one the zero day was used on.
It depends on the situation... I agree with Cameron 100%. If you are a huge business with lots of personal details about your customers (credit cards, etc.), I would probably shut down. However, things can be patched pretty quickly. I imagine Amazon almost completely freaked out when Shellshock was first discovered, but they got right on it.
I know that with Shellshock it depended if the server was configured a certain way so they might have sacrificed some functionality to change the configuration.
First, very few companies would consider shutting down because of a zero-day. Second, the time lag between discovery of a zero-day and the patch is very often more than days, often more like months.
In this type of situation, big online companies will become every vigilant in watching their traffic. Even though a patch may not be available, usually a IDS signature can be generated in hours to detect the zero-day.
I guess I wasn't thinking about IDS systems and how they could be used. I assume with zero days that require something to be configured a certain way (Shellshock) the company could change that and wait for a patch.
Share Your Thoughts