Summary of Kim Zetter's Countdown to Zero Day

By IRB Media

Please note: This is a companion version & not the original book.

#1 In 2010, Sergey Ulasen, head of the antivirus division of a small computer security firm in Belarus, found a computer virus that used a rootkit to cloak itself and make it invisible to antivirus engines. It used a shrewd zero-day exploit to spread from machine to machine.

#2 The mystery files came to the attention of VirusBlokAda when a reseller in Iran reported a persistent problem with a customer’s machine. The computer was caught in a reboot loop, crashing and rebooting repeatedly while defying the efforts of technicians to control it.

#3 The two hackers found a rootkit on the system in Iran that was designed to hide four malicious. LNK files. The malware appeared to be using an exploit to spread itself via infected USB flash drives. The rootkit prevented the. LNK files from being seen on the flash drive.

#4 The LNK exploit attacked a fundamental feature of Windows systems, and was much more severe than Autorun exploits. It was discovered by a security firm that had never heard of VirusBlokAda. The drivers that were dropped onto targeted machines were signed with a legitimate digital certificate from a company called RealTek Semiconductor.

• Language: English
• Publisher: IRB Media
• Release date: Apr 13, 2022
• ISBN: 9781669385288

IRB Media

With IRB books, you can get the key takeaways and analysis of a book in 15 minutes. We read every chapter, identify the key takeaways and analyze them for your convenience.

Book preview

Insights on Kim Zetter's Countdown to Zero Day

Contents

Insights from Chapter 1

Insights from Chapter 2

Insights from Chapter 3

Insights from Chapter 4

Insights from Chapter 5

Insights from Chapter 6

Insights from Chapter 7

Insights from Chapter 8

Insights from Chapter 9

Insights from Chapter 10

Insights from Chapter 11

Insights from Chapter 12

Insights from Chapter 13

Insights from Chapter 14

Insights from Chapter 15

Insights from Chapter 16

Insights from Chapter 17

Insights from Chapter 18

Insights from Chapter 19

Insights from Chapter 1

#1

In 2010, Sergey Ulasen, head of the antivirus division of a small computer security firm in Belarus, found a computer virus that used a rootkit to cloak itself and make it invisible to antivirus engines. It used a shrewd zero-day exploit to spread from machine to machine.

#2

The mystery files came to the attention of VirusBlokAda when a reseller in Iran reported a persistent problem with a customer’s machine. The computer was caught in a reboot loop, crashing and rebooting repeatedly while defying the efforts of technicians to control it.

#3

The two hackers found a rootkit on the system in Iran that was designed to hide four malicious. LNK files. The malware appeared to be using an exploit to spread itself via infected USB flash drives. The rootkit prevented the. LNK files from being seen on the flash drive.

#4

The. LNK exploit attacked a fundamental feature of Windows systems, and was much more severe than Autorun exploits. It was discovered by a security firm that had never heard of VirusBlokAda. The drivers that were dropped onto targeted machines were signed with a legitimate digital certificate from a company called RealTek Semiconductor.

#5

The use of a legitimate digital certificate to authenticate malicious files undermined the trustworthiness of the computer world’s signing architecture and called into question the legitimacy of any file signed with digital certificates thereafter.

#6

The computer security industry began to address the worm that had a name: Stuxnet. The driver was discovered on a computer by itself, without any of Stuxnet’s other files, but it was assumed to be related to Stuxnet since it shared similarities with the other drivers that VirusBlokAda had found.

#7

The discovery of the second certificate led to more speculation about how the hackers had obtained these security documents. It seemed that the attackers had stolen the digital signing keys and certs of two Taiwanese companies, RealTek and JMicron, and used them to sign their malware.

#8

Stuxnet was the first digital weapon, and it appeared that it was on its way out of the spotlight. But a few security researchers weren’t ready to let it go.

#9

The Autorun feature in Windows is a convenience feature that allows programs on a USB flash drive, CD-ROM, or DVD to automatically launch when the devices are inserted into a computer. It’s a known security risk because any malicious program on the device will automatically launch as well.

#10

Microsoft’s security response team received an email from an antivirus company in Belarus about the malware. They were able to stop the virus from spreading, but not before it had already infected hundreds of computers.

#11

The driver might have been used with a new version of Stuxnet the attackers unleashed after tweaking the code to prevent antivirus signatures from detecting it. No later version of Stuxnet has ever been discovered.

Insights from Chapter 2

#1

O’Murchu was manager of operations for the Security Response team in Symantec’s Culver City office, and it was his job to review new malware. He had never seen anything like the code he was looking at. It was using techniques that went way beyond anything he had ever seen before.

#2

O’Murchu’s first encounter with malware was in 1996, when he was studying computer science at University College Dublin. He was fascinated by