Exploit
exploit code · vulnerability exploitation · PoC · proof of concept · exploit kit
A program or technique that takes advantage of a specific vulnerability to make a system do something it should not: run code, bypass authentication, read data.
In practice
The vulnerability is the defect; the exploit is the tool that turns it into an attack. As soon as a patch is released, attackers study it to work out which flaw it fixes, and the gap between release and exploitation is sometimes measured in days. A proof of concept (PoC) shows that a flaw can be exploited; once public, it is often picked up by criminals. The KEV catalogue and the EPSS score help identify, first, the flaws that are actually being exploited.
EternalBlue, an exploit targeting Windows’ SMBv1 file-sharing protocol, was made public in April 2017. Microsoft had released the MS17-010 fix on 14 March 2017. On 12 May 2017, the WannaCry ransomware used it to spread on its own from machine to machine: only unpatched systems were hit.
How to protect yourself
- Apply security patches according to criticality, starting with flaws listed in the KEV catalogue.
- Reduce the attack surface: disable obsolete protocols (such as SMBv1) and never expose an administration interface to the internet.
- Deploy an EDR that can block exploitation behaviour, not just known files.
- Segment the network so that one compromised machine cannot reach all the others.
