Skip to main content
Microsoft Security

When Vulnerabilities are Exploited: the Timing of First Known Exploits for Remote Code Execution Vulnerabilities

One of the questions I get asked from time to time is about the days of risk between the time that a vulnerability is disclosed and when we first see active exploitation of it; i.e. how long do organizations have to deploy the update before active attacks are going to happen?  Trustworthy Computing’s Security Science team published new data that helps put the timing of exploitation into perspective, in the recently released Microsoft Security Intelligence Report volume 16.

The Security Science team studied exploits that emerged for the most severe vulnerabilities in Microsoft software between 2006 and 2013. The exploits studied were for vulnerabilities that enable remote code execution. The timing of the release of the first known exploit for each remote code execution vulnerability was examined, and the results were put into three groups:

Figure 1 shows us that there was a 70 percent decline in the total number of remote code execution vulnerabilities that were exploited in Microsoft products between 2010 and 2013. This is likely a result of the continued evolution of security mitigations in Microsoft products, like Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP), that make it much harder and more expensive for attackers to develop reliable exploits for vulnerabilities.

Of those vulnerabilities that do get exploited, the greatest potential risk comes from zero-day exploits, which are discovered in the wild before the publisher of the affected software is able to release a security update to address the vulnerability. Figure 1 illustrates that the number of zero-day exploits detected each year for severe vulnerabilities in Microsoft software decreased from its peak of 18 in 2011 to 13 in 2013. The rapidly shrinking number of remote code execution vulnerabilities that were exploited between 2010 and 2013 is good news, but subsequently zero-day exploits accounted for a larger proportion of the total number of exploits in each of the last three years.

With new remote code execution vulnerabilities becoming harder to find and exploit, as secure coding practices improve across the software industry, developing new exploits has become more expensive and the value of previously undisclosed exploits in the underground economy has increased. This reality provides “black hat” security researchers and exploit developers with a powerful incentive to maximize their own profits by selling exclusive access to a vulnerability and exploit to an attacker before the affected vendor has knowledge of the vulnerability and can issue a security update, and before security software vendors can update their detection signatures.

By contrast, remote code execution exploits that first appear more than 30 days after security update publication have become rare, with only one such instance in 2013. The number of exploits in the “after 30 days” category decreased from the peak of 11 in 2010 to 1 in 2013. A big part of this reduction is likely due to the work Microsoft and others in the industry have done to make it easier for customers to test and deploy updates quickly after release, even in large organizations. As the share of computers receiving updates within the first month of release continues to increase, exploiting older vulnerabilities becomes less profitable for attackers.

The number of remote code execution vulnerabilities exploited within the first 30 days after a security update has been released has also decreased substantially since 2010. In 2010, 42 exploits for severe vulnerabilities were first discovered in the 30 days after security updates for the vulnerabilities were released. But there has been a large reduction in this category of exploits in each subsequent year, 23 in 2011, 10 in 2012, and 6 in 2013.

There is likely a combination of reasons for the positive reduction in exploitation in all three categories First, as I mentioned earlier it is much harder to find and reliably exploit remote code execution vulnerabilities because of all the security mitigations layered into Microsoft software. Second, there has been increased usage of Microsoft Update and Windows Update services over the years, providing faster protection to more systems. Organizations have more sophisticated security update deployment and risk management methodologies supported by better and more efficient deployment technologies. Another contributing factor is the parties that are using the exploits and what is motivating them. You can get more insight into this aspect from an article I recently published called “Who Exploits Vulnerabilities: the Path from Disclosure to Mass Market Exploitation.” This data shows us that of the 16 remote code execution vulnerabilities studied, that were known to be exploited between January 2012 and February 2014, the majority of them (9 of the 16) were initially exploited in targeted attacks against specific targets. Attempted mass exploitation using the same exploits via exploit kits occurred months after the security updates that addressed the vulnerabilities were published and widely distributed.

Summary

Using this Information
One way to interpret this data is that attackers are accelerating their efforts and being more targeted, in an effort to use the vulnerability they have access to before it is disclosed, rapidly addressed across the ecosystem, and security vendors add detection for it to their tools and products. There are a few tools that I will highlight here that will help to mitigate such risks.

Tim Rains
Director
Trustworthy Computing