'Less than zero-day' threats too often overlooked, analysts warn
Attacks that target publicly unknown vulnerabilities continue to pose a silent and growing problem for companies. But the response to those threats has been largely misguided because of certain misconceptions about them, analysts said.
Zero-day exploits these days are generally defined as attacks that target publicly known but still-unpatched vulnerabilities. Examples of such threats include an object tag flaw in Microsoft Corp.'s Internet Explorer Web browser made public in April and the more recent the Vector Markup Language (VML) vulnerability in IE. Both were considered zero-day threats because they were publicly disclosed, and exploited, before Microsoft had a chance to issue patches.
"According to accepted wisdom, organizations face the greatest danger when an attack or exploit targeting [such vulnerabilities] is verified in the wild," said Alan Shimel, chief strategy officer at StillSecure in Superior, Colo.
While that danger is obvious, it is equally important that companies remain on guard for undisclosed vulnerabilities or "less than zero-day" flaws that are unknown to anybody but attackers, Shimel said. Typically, such flaws are discovered only after they have been successfully exploited in an attack and are much harder to detect and stop using most standard antimalware tools, he said.
read the full story here:
http://www.computerworld.com/action/...icleId=9004477
