Record of zero-day breaches in 2021

Among the categories of security events posing great risks to businesses, zero day breaches are definitely in the lead alongside phishing and ransomware attacks. Compared to these two previous types of threats, these vulnerabilities have existed for much longer and their danger is to be intrinsically linked to products (software or hardware) marketed and used by companies. The latter must therefore be very vigilant: when alert bulletins reveal zero day vulnerabilities, they then run a very high risk of compromise, paving the way for exploits.

This situation is not ready to end, on the contrary: according to an analysis from MIT which compiled several sources and indicators, 66 zero day vulnerabilities have already been identified this year. This is a record: 2021 is not yet over as the number of security holes of this type already exceeds that of 2020 (37) and 2019 (28). How can this sudden and powerful progression be explained? “One of the factors contributing to this progression is linked to the rapid proliferation of hack tools,” explains MIT. “All groups [malveillants] spend a bunch of money in zero day loopholes that they use for themselves and they reap the rewards ”.

Evolution of the number of zero day vulnerabilities. (credit: MIT)

Various exploits of loopholes

“We have seen state groups turning to NSO Group or Candiru, these increasingly well-known services that allow countries to obtain offensive capabilities for remuneration,” said Jared Semrau, director of vulnerability and exploitation activities at FireEye. The United Arab Emirates, the United States, and European and Asian powers have also all invested money in the exploit industry.

The exploits via zero day vulnerabilities have multiplied in the last few months (Exchange, Kaseya …) with the key a rain of intrusions, theft, data encryption and ransom demands. At the end of 2020 we remember the electroshock caused by the discovery of the SolarWinds hack, with global repercussions, which led to massive and targeted attacks targeting 150 companies and consequences that have spread in recent months. Last March, Google also had the opportunity to decrypt the 11 zero days iOS, Android and Windows. And to think that 2021 is not over …