Things like Heartbleed come to mind, or really any Zero day to be honest. What if I am a company who relies on product X but product X has just been found to have a bad vulnerability and it will probably take a couple days to patch. What do I do? Do I leave it vulnerable and keep myself open or do I shut down?
- Hot
- Active
-
Forum Thread: How to Hack an Android Device Remotely, to Gain Acces to Gmail, Facebook, Twitter and More 7 Replies
9 hrs ago -
Forum Thread: Hydra Syntax Issue Stops After 16 Attempts 2 Replies
16 hrs ago -
Forum Thread: Hack Instagram Account Using BruteForce 208 Replies
23 hrs ago -
How to: Crack Instagram Passwords Using Instainsane 37 Replies
6 days ago -
Forum Thread: Metasploit reverse_tcp Handler Problem 47 Replies
1 mo ago -
Forum Thread: How to Train to Be an IT Security Professional (Ethical Hacker) 22 Replies
1 mo ago -
Metasploit Error: Handler Failed to Bind 41 Replies
2 mo ago -
Forum Thread: How to Hack Android Phone Using Same Wifi 21 Replies
2 mo ago -
How to: HACK Android Device with TermuX on Android | Part #1 - Over the Internet [Ultimate Guide] 177 Replies
2 mo ago -
Forum Thread: How Many Hackers Have Played Watch_Dogs Game Before? 13 Replies
2 mo ago -
Forum Thread: How to Hack an Android Device with Only a Ip Adress 55 Replies
3 mo ago -
How to: Sign the APK File with Embedded Payload (The Ultimate Guide) 10 Replies
3 mo ago -
Forum Thread: How to Run and Install Kali Linux on a Chromebook 18 Replies
4 mo ago -
Forum Thread: How to Find Admin Panel Page of a Website? 13 Replies
5 mo ago -
Forum Thread: can i run kali lenux in windows 10 without reboting my computer 4 Replies
5 mo ago -
Forum Thread: How to Hack School Website 11 Replies
5 mo ago -
Forum Thread: Make a Phishing Page for Harvesting Credentials Yourself 8 Replies
5 mo ago -
Forum Thread: Creating an Completely Undetectable Executable in Under 15 Minutes! 38 Replies
7 mo ago -
Forum Thread: Hacking with Ip Only Part [1] { by : Mohamed Ahmed } 5 Replies
7 mo ago -
Forum Thread: Problem with Airmon-Ng and VM 3 Replies
7 mo ago
-
How To: Brute-Force Nearly Any Website Login with Hatch
-
How To: Find Vulnerable Webcams Across the Globe Using Shodan
-
How to Hack Wi-Fi: Stealing Wi-Fi Passwords with an Evil Twin Attack
-
Tutorial: Create Wordlists with Crunch
-
How To: Stealthfully Sniff Wi-Fi Activity Without Connecting to a Target Router
-
How to Hack Wi-Fi: Cracking WPA2-PSK Passwords Using Aircrack-Ng
-
How To: Dox Anyone
-
How To: Find Identifying Information from a Phone Number Using OSINT Tools
-
How To: Use Burp & FoxyProxy to Easily Switch Between Proxy Settings
-
How To: Scan for Vulnerabilities on Any Website Using Nikto
-
BT Recon: How to Snoop on Bluetooth Devices Using Kali Linux
-
How To: Make Your Own Bad USB
-
How To: Crack Password-Protected Microsoft Office Files, Including Word Docs & Excel Spreadsheets
-
How To: Bypass File Upload Restrictions on Web Apps to Get a Shell
-
Android for Hackers: How to Turn an Android Phone into a Hacking Device Without Root
-
How To: Exploit WebDAV on a Server & Get a Shell
-
How To: Enumerate MySQL Databases with Metasploit
-
How To: Run Your Favorite Graphical X Applications Over SSH
-
Hacking Windows 10: How to Create an Undetectable Payload, Part 1 (Bypassing Antivirus Software)
-
How To: Write Your Own Bash Scripts to Automate Tasks on Linux
7 Responses
In most situations, companies notify their customers of the bug and notify them that a fix is currently being worked on. The next steps really depend on what the zero day exploit is.
If the zero day gives criminals access to passwords (or hashed passwords if you're good at that stuff), then tell customers to change their passwords while you're working on a fix.
If the zero day gives criminals back doors in victim machines, then it's probably best to shut down services so no damage can be done.
That does make alot of sense, I would be so nervous as a company, especially if I was a financial site. You also have to consider complaining customers. If the zero day isn't really bad and you can keep it quiet than I guess all customers would see is requests to set a new password.
Just to be clear, this doesn't mean this company was the one the zero day was used on.
It depends on the situation... I agree with Cameron 100%. If you are a huge business with lots of personal details about your customers (credit cards, etc.), I would probably shut down. However, things can be patched pretty quickly. I imagine Amazon almost completely freaked out when Shellshock was first discovered, but they got right on it.
I know that with Shellshock it depended if the server was configured a certain way so they might have sacrificed some functionality to change the configuration.
First, very few companies would consider shutting down because of a zero-day. Second, the time lag between discovery of a zero-day and the patch is very often more than days, often more like months.
In this type of situation, big online companies will become every vigilant in watching their traffic. Even though a patch may not be available, usually a IDS signature can be generated in hours to detect the zero-day.
I guess I wasn't thinking about IDS systems and how they could be used. I assume with zero days that require something to be configured a certain way (Shellshock) the company could change that and wait for a patch.
Share Your Thoughts