Re: Definition of Zero Day Protection

["Andy Cuff" <lists () securitywizardry com>]

Hi all,
With regard to host IPS they often refer to methods to reduce the likelihood
of a buffer overflow as "Zero Day" protection, however, judging by the
claims in the Phrack article "Bypassing 3rd Party Windows Buffer Overflow
Protection "
http://www.phrack.org/phrack/62/p62-0x05_Bypassing_Win_BufferOverflow_Protection.txt
their success varies.  (biting tongue)

-andy
Talisker's Computer Security Portal
Computer Network Defence Ltd
http://www.securitywizardry.com

----- Original Message ----- 
From: "Teicher, Mark (Mark)" <teicher () avaya com>
To: "Drew Simonis" <simonis () myself com>; <focus-ids () securityfocus com>
Cc: "Seanor, Joseph (Joe)" <jseanor () avaya com>
Sent: Monday, August 09, 2004 8:14 PM
Subject: RE: Definition of Zero Day Protection


Drew,

What host based products would fit this category based on the definition
??  Do they really work ??

-----Original Message-----
From: Drew Simonis [mailto:simonis () myself com]
Sent: Monday, August 09, 2004 01:07 PM
To: Teicher, Mark (Mark); focus-ids () securityfocus com
Cc: Seanor, Joseph (Joe)
Subject: Re: Definition of Zero Day Protection


----- Original Message -----
From: "Teicher, Mark (Mark)"
Date: Sun, 8 Aug 2004 19:47:48 -0600
Subject: Definition of Zero Day Protection

> What is Zero Day Protection

It is, as you stated, another marketing blurb, but it isn't just that.
Usually, this bit of jargon is applied to a detection/prevention system
that uses things like heuristic detection techniques, behavior based
detection, protocol anomoly or some other advanced methods.  These allow
the activity to be blocked or alerted on, as opposed to the specific
event.

So, for example, a worm can be characterized by certain activity.  Say,
opening connections to lots of remote hosts in a short period of time.
This behavior can be blocked (e.g. the process can be killed) even
without knowing that it was WormX.


hth,
-Ds



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to
learn more.
--------------------------------------------------------------------------


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------