Skip to main content
SpringerLink
Log in

Zero-Day und Less-than-Zero-Day Vulnerabilities und Exploits

Risiken unveröffentlichter Sicherheitslücken

  • Chapter
Forschungsspitzen und Spitzenforschung

Zusammenfassung

Gegen unveröffentlichte – nur wenigen Personen bekannte – Sicherheitslücken (Less-than-Zero-Day Vulnerabilities) und diese ausnutzende Angriffsprogramme (Exploits) können IT-Systeme nicht geschützt werden. In der Vergangenheit wurden Sicherheitslücken meist dem Hersteller gemeldet; dieser stellte (allerdings nicht in allen Fällen) eine Fehlerkorrektur zur Verfügung. In jüngerer Zeit werden Sicherheitslücken systematisch (Tool-gestützt) gesucht und an Behörden, Unternehmen und an die organisierte Kriminalität verkauft – und nicht oder nicht sofort dem Hersteller gemeldet. Durch Ausnutzung dieser unveröffentlichten Sicherheitslücken ist Wirtschaftsspionage und Computersabotage (auch der Steuerungsrechner des Internet) unerkannt möglich [GI 2007]. Praktizierte Anwendungen sind – u.a. auch als Titan Rain – dokumentiert [BfDI 2007, Keizer 2006, NSTAC 2007, Pohl 2007, Rath 2007].

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 119.00
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Hardcover Book
USD 119.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Literatur

  • Anderson, R.: Why Information Security is Hard. An Economic Perspective. London 2001 http://www.ftp.cl.cam.ac.uk/ftp/users/rja14/econ.pdf

    Google Scholar 

  • Arbeitskreis "Technische und organisatorische Datenschutzfragen" der Konferenz der Datenschutzbeauftragten des Bundes und der Länder (Hrsg.): Technische Aspekte der Online-Durchsuchung. o.O. 2007

    Google Scholar 

  • Arbaugh, W.A.; Fithen, W.L.; McHugh, J.: Windows of Vulnerability: A Case Study Analysis. IEEE Computer 12, 52 – 59, 2000

    Google Scholar 

  • Arora, A., Telang, R., Xu, H.: Optimal Policy for Software Vulnerability Disclosure, Arbeitsbericht der H. John Heinz III School of Public Policy and Management, Carnegie Mellon University, Pittsburgh 2004. http://www.dtc.umn.edu/weis2004/xu.pdf

    Google Scholar 

  • Arora, A.; Telang, R.: Economics of Software Vulnerability Disclosure. IEEE Security and Privacy, 3 (1), 20-25, 2005

    Article  Google Scholar 

  • Bachfeld, D.: Die Axt im Walde. Einführung in Fuzzing-Tools. Heise Security 18. Aug. 2006 http://www.heise.de/security/artikel/76512

    Google Scholar 

  • Bächer, P.; Holz, T.; Kötter, M.; Wichersky, G.: Know your Enemy: Tracking Botnets. Using Honeynets to learn more about Bots. 2005 http://www.honeynet.org/papers/bots/

    Google Scholar 

  • Beirer, S.: Metasploit Framework v3.0. In: GAI NetConsult GmbH (Hrsg.): Security Journal. Berlin 12/2006 http://www.gai-netconsult.de/download/security/secjournal/SecJournal_0628.pdf

    Google Scholar 

  • BfDI – Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (Hrsg.): 21. Tätigkeitsbericht 2005 – 2006. Bonn 2007

    Google Scholar 

  • BMI – Bundesministerium des Innern (Hrsg.): Entwurf eines IT-Sicherheitsgesetzes. Berlin 30. Mai 2008

    Google Scholar 

  • Böhme, R.: Vulnerability Markets. What is the economic value of a zero-day exploit? In: Proc. of 22C3. Berlin 2005 http://events.ccc.de/congress/2005/fahrplan/attachments/542-Boehme2005_22C3_VulnerabilityMarkets.pdf

    Google Scholar 

  • Böhme, R.: A comparison of market approaches to software vulnerability disclosure. In G. Müller (Hrsg.): Proc. of ETRICS, Freiburg, 5. – 9. Juni 2006 298 – 311, Berlin 2006 http://www.springerlink.com/link.asp?id=428k87mr2h103143

    Google Scholar 

  • Bonner, E.: Streit um Bugtraq-Eintrag: Aufklären oder schweigen. PC Welt 21. Nov. 2002 http://www.pcwelt.de/start/sicherheit/archiv/27470/

    Google Scholar 

  • Browne, H.K.; McHugh, J.: A Trend analysis of Exploitations. CS-TR-4200, UMIACS-TR-2000-76, 2000

    Google Scholar 

  • Camp, L.J.; Wolfram, C.D.: Pricing Security: Vulnerabilities as Externalities. Economics of Information Security 12, 2004

    Google Scholar 

  • Christey, S.; Wysopal, C.: Responsible Vulnerability Disclosure Process. Internet-Draft. MITRE Bedford 2002

    Google Scholar 

  • Clinton, N.: How Windows Update Keeps Itself Up-to-Date. Microsoft TechNet 2007 http://blogs.technet.com/mu/archive/2007/09/13/how-windows-update-keepsitself-up-to-date.aspx

    Google Scholar 

  • Core Security Technology (Ed.): Core Impact. Boston 2007 http://www.coresecurity. com/

    Google Scholar 

  • Coverity Inc. (Ed.): [Homepage] San Francisco 2007 http://www.coverity.com/

    Google Scholar 

  • Danchev, D.: Malware – future trends. o.O. 2006 http://www.packetstormsecurity. org/papers/general/malware-trends.pdf

    Google Scholar 

  • Debian (Hrsg.): Werkzeuge für Sicherheit-Audits. http://www.de.debian.org/security /audit/tools

    Google Scholar 

  • Eidenberg, A.: Exploits für alle. Heise Security 06.01.2006 http://www.heise.de/security/artikel/67984/

    Google Scholar 

  • Fox, D. (Hrsg.): Secorvo Security News Juli 2007. Karlsruhe 2007 http://www.secorvo. de/security-news/secorvo-ssn0707.pdf

    Google Scholar 

  • Garfinkel, T.; Adams, K.; Warfield, A.; Franklin, J.: Compatibility is Not Transparency: VMM Detection Myths and Realities. 11thWorkshop on Hot Topics in Operating Systems San Diego, CA May 7–9, 2007 http://www.stanford.edu/~talg/papers/HOTOS07/vmm-detection-hotos07.pdf

    Google Scholar 

  • Gerkis, A.; Danahy, J.: Software Security Governance in the Development Lifecycle. Boston 2007

    Google Scholar 

  • GI – Gesellschaft für Informatik (Hrsg.): GI fordert Veröffentlichung von Sicherheitslücken in Software. Bonn 2007 http://www.gi-ev.de/aktuelles/meldungsdetails/meldung/167/

    Google Scholar 

  • Heise Security (Hrsg.): Untergrundauktionen: Vista-Exploit 20.000 $, eBay-Konto 7 $. Hannover 2006a http://www. heise.de/security/news/meldung/82679

    Google Scholar 

  • Heise Security (Hrsg.): Rootkit verschiebt Windows in virtuelle Maschine. Hannover 2006b http://www.heise.de/security/news/meldung/79676

    Google Scholar 

  • Heise Security (Hrsg.): Betreiber von Exploit-Auktionen spricht auf Microsofts Hacker-Konferenz. Hannover 2007 http://www.heise.de/security/news/meldung/96800

    Google Scholar 

  • IBM Internet Security Systems (Ed.): Cyber Attacks On The Rise: IBM 2007 Midyear Report. Somers 2007 http://www.iss.net/documents/whitepapers/X-Force_Threat_ Executive_Brief_Aug_07.pdf

    Google Scholar 

  • iDefense Labs (Ed.): Vulnerability Contributor Program. Sterling Va. 2007a http://labs. idefense.com/vcp

    Google Scholar 

  • iDefense Labs (Ed.): Major Threats and Trends Impacting the 2007 Cyber Security Landscape. Sterling Va. 2007b http://www.verisign. com/static/040800.pdf

    Google Scholar 

  • Immunity (Ed.): CANVAS. Miami Beach 2007 http://www.immunitysec.com/

    Google Scholar 

  • ISO/IEC 15408: Information technology – Security techniques – Evaluation criteria for IT security – Parts 1, 2, 3 Genf 2005

    Google Scholar 

  • Jones, J.R.: Estimating Software Vulnerabilities. IEEE Security & Privacy 5, 4, 28 – 32, 2007

    Article  Google Scholar 

  • Kannan, K.; Telang, R.: Market For Software vulnerabilities? Think Again. Management Science, 51(5), 726-740 2005 http://www.heinz.cmu.edu/~rtelang/MS_market. pdf

    Article  Google Scholar 

  • Keizer, G.: UCLA admits Massive Data Hack. Informationweek Dec. 12, 2006 http://www.informationweek.com/shared/printableArticle.jhtml?articleID=196603485

    Google Scholar 

  • Krebs, B.: A Time to Patch. http://blog.washingtonpost.com/securityfix/2006/01/a_time_ to_patch.html 2006

    Google Scholar 

  • Ma Huijuan: Handling Less Than Zero Day Attack – A Case Study. Seville 2007 http://www.first.org/conference/2007/papers/huijuan-ma-slides.pdf

    Google Scholar 

  • Martinez, V.: PandaLabs Report: Mpack uncovered. o.O. 2007 http://blogs.pandasoftware.com/blogs/images/PandaLabs/2007/05/11/MPack.pdf?sitepanda=particulares

    Google Scholar 

  • McAfee (Hrsg.): Virtual Criminology Report. North American Study into Organized Crime and the Internet. Hamburg 2006 http://www.mcafee.com/de/about/press/corporate/2006/20061208_124141_v.html

    Google Scholar 

  • Metasploit (Ed.): Bustin shells since 2003. 2007 http://www.metasploit.com/

    Google Scholar 

  • Miller, B.P.: Fuzz testing of Application Reliability. Madison 2007 http://pages.cs.wisc. edu/~bart/fuzz/

    Google Scholar 

  • Miller, C.: The legitimate vulnerability market: The secretive world of 0-day exploit sales. 2007 http://weis2007.econinfosec.org/papers/29.pdf

    Google Scholar 

  • Mitre (Ed.): Common Vulnerabilities and Exposures (CVE). The Standard for Information Security Vulnerability Names. 2007 http://www.cve.mitre.org/

    Google Scholar 

  • Naraine, R.: Researcher: WMF Exploit Sold Underground for $4,000. February 2, 2006 http://www.eweek.com/article2/0,1895,1918198,00.asp

    Google Scholar 

  • NSTAC – The Presidents National Security Telecommunications Advisory Committee (Ed.): NSTAC Report to the President on International Communications. Washington 2007

    Google Scholar 

  • Ozment, A.: Bug Auctions: Vulnerability Markets Reconsidered. In Workshop of Economics and Information Security, Minneapolis 2004 http://www.dtc.umn.edu/weis2004/ozment.pdf

    Google Scholar 

  • OWASP – Open Web Application Security Project (Ed.): Source Code Analysis Tools. http://www.owasp.org/index.php/Source_Code_Analysis_Tools

    Google Scholar 

  • Parson, G.; Thorne, G.: Internet Security Threat Report Vol. XI. o.O. 2007 http://cio.vermont.gov/var/cio/storage/original/application/6c785bbe879fc3ddd2c5741435669 af6.ppt

    Google Scholar 

  • Pohl, H.: Zur Technik der heimlichen Online-Durchsuchung. Datenschutz und Datensicherung 31, 9, 684 – 688, 2007 http://www.dud.de/binary/DuD_Pohl_907.pdf ?sid=9f7bc909e95c652b86ebd9ae5344abba

    Google Scholar 

  • Porter, B.: Approaching Zero. A Study in Zero-Day Exploits. Origin, Cases, and Trends. Norwich o.J. http://nujia.norwich.edu/current/2_2_art01.pdf

    Google Scholar 

  • Rath, C.: Der Zoll ist schon drin. In: Kölner Stadt-Anzeiger 7. Okt. 2007 http://www. ksta.de/html/artikel/1190968634161.shtml

    Google Scholar 

  • Rescorla, E.: Is finding security holes a good idea? In: Workshop on Economics and Information Security. Minneapolis 2004 http://www.dtc.umn.edu/weis2004/rescorla.pdf

    Google Scholar 

  • Rollins, J.; Wilson, C.: Terrorist Capabilities for Cyberattack: Overview and Policy Issues. CRS Report for Congress. Washington 2007

    Google Scholar 

  • Royal Canadian Mounted Police (Ed.): Future Trends in Malicious Code – 2006 Report. Ottawa 2006

    Google Scholar 

  • Rutkowska, J.: Subverting Vista Kernel for Fun and Profit. Black Hat Aug. 2006.

    Google Scholar 

  • Schechter, S.E.: How to buy better testing: Using competition to get the most security and robustness for your dollar. In: Proceedings of the Infrastructure Security Conference. Bristol 2002

    Google Scholar 

  • Schneier, B.: Attack Trees. Dr. Dobb's Journal December 1999 http://www.schneier. com/paper-attacktrees-ddj-ft.html

    Google Scholar 

  • Schneier, B.: Full Disclosure and the Window Exposure. Sept. 15, 2000 http://www. schneier.com/crypto-gram-0009.html#1

    Google Scholar 

  • Schneier, B.: Business Models for Discovering Security Vulnerabilities. Mountain View 2007 http://www.schneier.com/blog/archives/2007/02/business_models.html

    Google Scholar 

  • SecurityFocus (Ed.): Bugtraq. 2007 http://www.securityfocus.com/archive/1

    Google Scholar 

  • shellcode.org (Ed.): [Homepage] 2007. http://shellcode.org/

    Google Scholar 

  • Shimel, A.: Less Than Zero Threat. Oct. 19, 2006 http://www.stillsecureafteralltheseyears.com/ashimmy/2006/10/less_then_zero_.html

    Google Scholar 

  • Stone, B.: Moscow company scrutinizes computer code for flaws. International Herald Tribune January 29, 2007 http://www.iht.com/articles/2007/01/29/business/bugs. php

    Google Scholar 

  • Symantec (Ed.): Symantec Internet Security Threat Report. Trends for January – June 07. Vol. XII. Cupertino 2007 http://eval.symantec.com/mktginfo/enterprise/white_papers/ent-whitepaper_internet_security_threat_report_xii_exec_summary_09_2007. en-us.pdf

    Google Scholar 

  • TippingPoint (Ed.): Zero Day Initiative. 2007 http://www.zerodayinitiative.com/

    Google Scholar 

  • VulnWatch (Ed.): [Homepage]. 2007 http://www.vulnwatch.org/index.html

    Google Scholar 

  • Wabisabilabi (Ed.): Closer to zero risk. London 2007 http://www.wslabi.com/wabisabilabi/home.do?

    Google Scholar 

  • Zero Day Initiative (Ed.): Published ZDI Advisories. Austin 2007a http://www.zerodayinitiative.com/advisories.html

    Google Scholar 

  • Zero Day Initiative (Ed.): Upcoming ZDI Advisories. Austin 2007b http://www.zerodayinitiative.com/upcoming_advisories.html

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Fachbereich Informatik, FH Bonn-Rhein-Sieg, Sankt Augustin, Deutschland

    Hartmut Pohl

Authors
  1. Hartmut Pohl
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. Fachhochschule Bonn-Rhein-Sieg, 53754, Sankt Augustin, Deutschland

    Christoph Zacharias , Klaus W. ter Horst , Kurt-Ulrich Witt , Volker Sommer , Marc Ant , Ulrich Essmann  & Laurenz Mülheims , , , , ,  & 

Rights and permissions

Reprints and permissions

Copyright information

© 2009 Physica-Verlag Heidelberg

About this chapter

Cite this chapter

Pohl, H. (2009). Zero-Day und Less-than-Zero-Day Vulnerabilities und Exploits. In: Zacharias, C., et al. Forschungsspitzen und Spitzenforschung. Physica-Verlag HD. https://doi.org/10.1007/978-3-7908-2127-7_12

Download citation

Publish with us

Policies and ethics

Search

Navigation