Over a quarter of last year’s 0-day vulnerabilities caused by poorly written patches.
A zero-day represents a previously unidentified software vulnerability. They are very dangerous because it takes time for them to be discovered, time in which bad actors can exploit them uninterruptedly. According to Google security researchers, there were 24 0-days discovered in 2020, and incomplete security patches caused a good number of them.
Microsoft’s response to the attacks on their old JScript engine can be used as an example. Back in January 2018, there were a number of Internet Explorer vulnerabilities reported. A fix was released by the end of the year, along with a 0-day vulnerability which was discovered several months later.
“Looking at them all together as a group, the number that stuck out the most to me was that six out of the 24 zero-days exploited in 2020 are variants of previously disclosed vulnerabilities. […] On top of that, three out of the 24 vulnerabilities were incompletely patched, meaning that with just a few tweaks, you could have an exploit that still works even after the patch was applied.”Maddie Stone – Google security researcher
Check the source.
- Users of popular crypto app Maiar are targetted by SMiShingMaiar is a digital crypto wallet and global payments app that allows users to exchange and securely store money […]
- PHOBOS Ransomware Attack Hits Romanian Hospital on July 22A ransomware attack targeted Witting Clinical Hospital in Bucharest. Hackers took control of the healthcare provider’s servers, encrypted the […]
- 740 Ransomware Victims Listed On Data Leak Sites in Q2 2021, New Report ShowsA new report from Digital Shadow highlights the worrying information that the number of ransomware victims named on data […]
- Kaseya Gets Universal Decryptor for REvil RansomwareThe decryptor vendor will work closely with customers affected by this July’s outbreak of ransomware attacks to help recover […]
- Possibly the Highest Ransomware Payment Ever: CNA reportedly paid $40 million to hackersOne of the biggest US insurance companies, CNA, paid a ransom worth $40 million to attackers after a massive […]