What is an exploit?

The term Feat you have probably heard or read about it before, probably in connection with computer systems or mobile devices with iOS or Android. Sometimes the reports deal with the criminal use of so-called exploits, sometimes with the elimination of points of attack – e.g. B. with a system update. Or to put it another way: An exploit is the possibility of using a security gap that hackers can use to penetrate the system and that should be closed by the responsible developers. Below you will find more details and useful links on the subject.

What does "exploit" mean?

What does the term exploit actually mean? The English word means something like "exploit" or "exploit". With regard to electronic data processing (EDP), an exploit describes the opportunity to exploit a security gap that arose during the creation of software. Resources are accessed or the system paralyzed via this vulnerability.

In addition to operating systems, the faulty software can also be individual programs, Apps, tools and scripts trade. If these were not programmed "watertight" and hackers or cybercriminals find a way to exploit a vulnerability for their own purposes, then one speaks of an exploit. This is used for further measures, such as the installation of malware.

What is a zero-day exploit?

If you've heard of an exploit, you may have come across the term zero-day exploit. "Zero Day[s]" stands for "zero days" and describes the fact that the exploit is used as soon as it becomes known. The developers have no time, i.e. zero days, to do anything to prevent the discovered vulnerability from being exploited. A zero-day exploit is usually kept secret and traded on the black market so that criminal activities remain possible and no patch is developed to close the vulnerability as long as possible.

In addition to criminals, there are also hackers and companies who are looking for exploits to protect the respective system or program for which there is no patch yet. These are then reported to the developers and otherwise kept secret. However, some try to build up pressure by publishing discovered vulnerabilities after a certain period of time after reporting them to those responsible. This should lead to patches being developed faster and users being able to rely on more security sooner.

Easy classification of exploits

So if you now look at the exploit and the zero-day exploit as different ways of exploiting a vulnerability, then the following classification can result (you can find a more technical view below):

• Known exploit: These exploits have already been identified by security researchers. In this way, developers can program the necessary patches to close the underlying security gaps. The patches are made available to users as security updates. That is why it is of great importance to keep Mac, PC, smartphone and all other systems and their apps up to date.
• Unknown exploit: Also known as zero-day exploits, these exploits are created as soon as a vulnerability is discovered. In this way, the victim can be attacked promptly – practically on the same day. When this attack occurs, and ideally is discovered, it is up to the software developers to figure out how it works and how the exploited vulnerability can be remedied. 

Exploit Kits: Tools for non-technical criminals

The weak points or security gaps required for an attack therefore result from errors in the software development process. These flaws can be exploited by cyber criminals, giving them access to the software or the entire device/network. Entire exploit kits are even created for this – digital toolboxes that do a lot of work for you and require little or no programming knowledge. 

These kits can be purchased or even rented. They are hidden on dubious websites, in advertisements or in e-mail attachments. When someone visits the website or downloads the mail attachment, the malicious software scans the computer. If a vulnerability is discovered, the exploit is run to break it and get into the software or system.

More technical classification of exploits

In addition to well-known and unknown exploits from the point of view of security companies and developers, there is of course also the technical side of execution. This is also important for those responsible for developing a patch. But even more important is the respective procedure for everyone who wants to develop and / or use the exploit itself. You can use this classification for this:

• Local exploit: An infected file, such as a Word, Excel or PDF file, is opened and scans for useful security vulnerabilities in the background. These are then used to gain access rights at a higher level so that further malware can be installed or loaded. So there is an overlap with that Trojan horse.
• remote exploits: This is a remote attack carried out by infected data packets or data streams targeting the vulnerability. This is made possible by an active network connection, i.e. usually through the Internet.
• Denial of Service exploits: Instead of securing rights in the system or further malware (Virus, Worm, spyware, etc.), this attack is designed to overload the system in order to prevent it from functioning properly. Most of the time, zero-day exploits are executed in this way before more extensive attacks can be developed. The disadvantage for the cybercriminals is that the vulnerability can be exposed in this way.
• Command Execution Exploits: These remote attacks target programs that have extensive privileges in the system. This allows cybercriminals with the necessary programming skills to remotely access data, redirect information, control the system and cause harm to others.
• SQL injection exploits: These are attacks on websites and apps that use SQL databases, for example to manage account data. A possible procedure here is to try out SQL commands in the input fields of the login mask in order to get poorly programmed or poorly secured databases to output information.

How do I detect an exploit attack on my computer/system?

Unfortunately, there are no typical characteristics that clearly and unmistakably characterize an exploit attack. This is precisely why it is of great importance to always keep the operating system (macOS, Windows, Linux, etc.) and the installed apps up to date and to install security patches.

Although an exploit often goes unnoticed, the effects can be felt once more malware has eventually crept in. Signs of an outside attack include:

• Worse performance of the system
• The computer freezes / individual programs cause a high load
• Settings, especially for the network, change without you having to do anything
• Popups and/or ads keep opening (What is adware?)
• There is an inexplicable loss of disk space

If such signs are there, it is time to act. A first step can be a malware scan with a reputable antivirus tool. If it can be determined which file is responsible for the malware attack, installing a backup that does not already contain this file may help. The safest thing, however, is to completely format the hard drive and reinstall the operating system. Programs and files should then be carefully selected and returned from previously created backups.

How to fix an exploit?

As described in the last paragraph, as a victim of an attack on a security gap, you can only try to keep the damage small and then fix it locally. But most exploits are the result of developer mistakes. It is therefore their responsibility to detect them and close security gaps in order to prevent exploits based on them. Several companies and organizations are therefore on the lookout for zero-day exploits, so that preventive action can also be taken here. As a user, you have to be careful above all.

How to prevent an exploit attack? 

As already mentioned, all software should always be up to date. This means that all software updates should be installed immediately, even if it can be tedious and annoying at times. Otherwise, it's always better to be safe than sorry. No unknown mail attachments should be opened, dubious links should not be clicked on, or files should not be downloaded from unknown sources.

Useful links on the topic

Here are the sources / further reading on the topic of exploits:

• More background and popular examples of exploits: Wikipedia
• Steps of an exploit attack with descriptive infographic: GData guide
• "What is a Cyber ​​Attack?" Articles with Cross References: IBM topic

Johannes Domke

After graduating from high school, Johannes completed an apprenticeship as a business assistant specializing in foreign languages. But then he decided to research and write, which resulted in his independence. For several years he has been working for Sir Apfelot, among others. His articles include product introductions, news, manuals, video games, consoles, and more. He follows Apple keynotes live via stream.