In early November, Google rolled out an emergency patch for a zero-day vulnerability in its flagship Chrome browser. This is the seventh Chrome vulnerability fixed by Google in 2022. Let’s do a deep dive into what the bug was and understand the cybersecurity dangers presented by zero-day threats.
Before reading further, update your Google Chrome browser to version 107.0.5304.87/107.0.5304.88.
Usually, Chrome automatically updates to the latest version in the background as a default setting. If not, you’ll see an “Update” icon in the top-right corner of your browser. Update your browser to its latest version from there.
Now, let’s return to discussing the latest zero-day vulnerability found in Chrome.
Google released an emergency security update for an actively exploited vulnerability in Chrome’s JavaScript-based V8 engine. The bug, identified as CVE-2022-3723, is a type of confusion vulnerability. Out of the seven zero-day vulnerabilities detected in 2022, this was the third type confusion weakness found in Chrome.
What’s a zero-day vulnerability?
Zero-days are flaws or weaknesses in software, hardware, or firmware that are unknown to the vendor or developer of the technology. Once a zero-day vulnerability has been exposed, it’s called an n-day or one-day vulnerability.
There is usually a gap between the discovery of a zero-day vulnerability and its patch release. These are high-risk attack vectors for two main reasons:
- Cybercriminals are always on the lookout for zero-day vulnerabilities. Exploiting zero-days is a sure-shot way to succeed in their schemes.
- Users with vulnerable systems are exposed to attacks until a patch is released and systems are updated.
What’s a type confusion vulnerability?
Type confusion vulnerabilities are logical bugs resulting from confusion between object types. The latest vulnerability found in Chrome’s V8 JavaScript triggers logical errors and can lead to “out-of-bounds memory access.” According to MITRE, type confusion vulnerabilities occur when “the program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.”
This vulnerability risks the resource’s availability, integrity, and confidentiality. It can lead to a crash or a possible code execution.
If you’re wondering whether zero-day exploits are as severe as they sound, we’ll clear your confusion. Take a walk through the sophisticated zero-day exploit from earlier this year.
Chrome’s zero-day vulnerability exploited by state-sponsored North Korean hackers
On February 14, Google patched a bug in Chrome 98.0.4758.102, and the update was immediately available to most users. But it was already too late by then. Hackers based in North Korea had been exploiting the zero-day vulnerability and pulling off several covert operations since January 4.
The zero-day vulnerability, coded as CVE-2022-0609, was a use-after-free bug in the browser. It allowed hackers to “place executable malicious code inside vulnerable memory locations,” as per TechTarget’s researchers.
Suggested Reading: Vulnerability Assessment: The Complete Guide
North Korean attackers targeted US-based news media, IT companies, cryptocurrency, and fintech industries. Google’s Threat Analysis Group (TAG) identified two attack campaigns by two separate groups that exploited the vulnerability. Google tracked the two groups to be:
- Operation Dream Job
- Operation AppleJeus
According to sources at Bleeping Computer, the attacks targeted more than 330 individuals. Hackers used emails, fake websites, and compromised websites to launch attacks and activate the exploit kit.
In the first campaign by Operation Dream Job, targets received emails claiming to be from recruiters at Disney, Oracle, and Google with fraudulent job opportunities. The emails were infected with links to spoofed websites such as Indeed and ZipRecruiter. Google TAG claims that “the targets who clicked on the link received hidden iframes that would trigger the exploit kit.” Operation AppleJeus’s campaign also used similar techniques. They targeted cryptocurrency and fintech companies using the same exploit kit.
These attacks severely compromised the victims’ privacy and data security.
How can you prepare against Zero-day attacks?
The trouble with zero-day attacks is that you, as the end user, have very little control over what’s happening. The responsibility of exposing vulnerabilities and deploying patches rests with the vendor. What’s your role in preventing zero-day attacks?
Zero-day attacks are tough to defend against because of their very nature. But all is not hopeless. A proactive and prevention-first approach to cybersecurity is the best way to prepare against sudden exploits.
-
Leverage next-generation endpoint protection
Traditional antivirus solutions are not adequate protection against zero-day exploits. They rely on signature-based detection, and zero-day exploits lack known signatures until the vulnerability is publicly announced vendor’s malware database is updated.
Advanced next-generation endpoint security solutions, like ACE Managed EDR, can stop unidentified zero-day attacks. These solutions leverage global threat intelligence feeds, AI-powered behavioral analytics, and machine learning code analysis to find and block unknown strands of malware.
-
Optimize patch management
Organizations of all sizes need to prioritize patch management policy and automation. Automated solutions source patches from vendors as soon as they are released, prioritize critical systems that need updates, and automatically deploy patches to production.
A well-oiled system prevents delays in deployment and ensures you remember all system while installing updates. While patch management doesn’t directly block zero-day attacks, it significantly minimizes the exposure risk.
-
Regularly monitor for network vulnerabilities
Constantly analyzing your security postures and complete visibility of what’s happening in your network is a vital safeguard against zero-day attacks. Constantly hardening patches and identifying weaknesses in your security infrastructure is the best way to maintain a proactive cybersecurity approach.
-
Invest in full-coverage, multi-layered security
Protecting against zero-day attacks calls for a multi-layered security infrastructure. As evidenced by the Chrome’s North Korean exploits, attackers will use several vectors to breach your system and execute malicious code. You need comprehensive network, endpoint, and email security to guard all entry points. But, that’s a challenging call to execute.
The most intelligent approach to creating such a security infrastructure is to partner with a managed security service provider. MSSPs are powered with the latest security technologies, threat intelligence, and top-of-the-class human capabilities to prevent major zero-day attacks.
For instance, take a look at Ace Managed Security Services. An MSSP with 14+ years of experience in cloud security, ACE MSS is the one-stop solution for a comprehensive, fully managed security infrastructure. With a 24/7/365 Security Operations Center and advanced vulnerability management capabilities, you can empower your security posture and implement multiple cutting-edge security solutions. So, what’s the delay?
Search
Popular Posts
