Zero-day vulnerabilities

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What makes a vulnerability a zero-day?

A It was found on the first day of the year

B Attackers know about it before a fix has been released

2. A zero-day has just been found being used in attacks. What does the software maker have available?

A No patch yet

B A patch that users just need to install

3. Which statement about zero-days is true?

A Keeping software fully up to date does not stop a zero-day attack

B Installing every update makes you immune to zero-days

4. The maker has not released a patch for a flaw. Which is a sensible workaround?

A Turn off the affected feature until a fix arrives

B Keep using the feature exactly as before and ignore the warning

5. Which is an example of monitoring while waiting for a patch?

A Deleting all the logs to free up space

B Checking logs for unusual activity on the affected system

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1zero-day		AA zero-day is a flaw attackers know about before the maker has released a fix. A flaw fixed years ago is a known, patched vulnerability.
2patch_available = False		BA flaw that attackers know about before the software maker has released a fix
3While there is no patch yet, defenders can use a workaround such as turning off the risky feature		CWith a zero-day there is no patch yet, so updating cannot fix it until the maker releases one. Use workarounds and monitoring in the meantime.
4Monitoring means watching logs for signs that a zero-day is being used against you		DThere is no fix yet, which is the key sign of a zero-day
5Update to the latest version and the zero-day is fixed straight away		Edisable_feature("risky_plugin")
6A zero-day is any flaw that was fixed years ago		Fwatch_logs(alert_on="odd_activity")

Definitions

zero-day

Fill in the Blanks

Complete each line of code by filling in the missing parts.

patchAvailable = _____

if attackerKnows ___ not makerKnows: print("Zero-day")

patchAvailable = False if ___ patchAvailable: workaround = True

if patchAvailable __ False: workaround = True

___ entry in log: if entry == "odd login": alert()

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A known = True

B patched = True

C if known and not patched:

D print("Zero-day")

Question 2

A status = "zero-day"

B patch = None

C if patch is not None:

D print("Use a workaround")

Question 3

A def is_zero_day(patched):

B return patched

C print(is_zero_day(False))

Question 4

A alerts = 0

B for event in log

C if "exploit" in event:

D alerts += 1

Question 5

A workaround = disable feature

B print("Apply", workaround)

C print("Then monitor logs")

Answer Key

Zero-day vulnerabilities

Section A: Quick Questions

B — Attackers know about it before a fix has been released

A — No patch yet

A — Keeping software fully up to date does not stop a zero-day attack

A — Turn off the affected feature until a fix arrives

B — Checking logs for unusual activity on the affected system

Section B: Match the Pairs

zero-day → A flaw that attackers know about before the software maker has released a fix

patch_available = False → There is no fix yet, which is the key sign of a zero-day

While there is no patch yet, defenders can use a workaround such as turning off the risky feature → disable_feature("risky_plugin")

Monitoring means watching logs for signs that a zero-day is being used against you → watch_logs(alert_on="odd_activity")

Update to the latest version and the zero-day is fixed straight away → With a zero-day there is no patch yet, so updating cannot fix it until the maker releases one. Use workarounds and monitoring in the meantime.

A zero-day is any flaw that was fixed years ago → A zero-day is a flaw attackers know about before the maker has released a fix. A flaw fixed years ago is a known, patched vulnerability.

Section C: Definitions

zero-day — A zero-day is a software flaw that attackers know about before the maker has released a fix, so there is no patch yet. Defenders use workarounds and monitoring until one arrives.

Section D: Fill in the Blanks

patchAvailable = False

if attackerKnows and not makerKnows:
    print("Zero-day")

patchAvailable = False
if not patchAvailable:
    workaround = True

if patchAvailable == False:
    workaround = True

for entry in log:
    if entry == "odd login":
        alert()

Section E: Spot the Error

B — A zero-day has no patch yet, so patched must be False. If it were True, the flaw would not be a zero-day.

C — A workaround is needed when there is no patch. The test should be 'patch is None', not 'is not None'.

B — A flaw is a zero-day while it is NOT patched. The function should return 'not patched'.

B — A for loop line must end with a colon. It should be 'for event in log:'.

A — Text must be in quotes. Without them Python sees names, not a string. It should be workaround = "disable feature".