What are zero day exploits and why is Israel's military after them?
AP Photo/Jockel Finck
A sliver of light has been thrown onto Israel’s cyber-espionage efforts after the Motherboard website revealed letters apparently showing the government shopping for prized digital penetration opportunities known as zero-day exploits.
The letters, reportedly sent to hackers and researchers in the United States and Europe between 2016 and 2017 and were described by the magazine’s sources as alternatively “unusual” in their “blunt” approach, or as a routine procurement strategy.
Zero day exploits are holes in software that are discovered and exploited until those who created the software realize and have time to fix them.
It is like “you can be invisible in someone else’s house: you can walk in freely, no one knows you are there and you can do what you want,” explained i24NEWS cyber-security analyst Ram Levi and CEO of Konfidas, a consultancy.
“That’s why they’re so attractive to governments and hackers. As long as the vendor doesn’t know about it you have free access to use it as you wish.”
An unchecked vulnerability in a widely-used piece of software or operating system -- such as Windows or Apple’s iOS -- could allow someone with knowledge of the zero-day exploit to to “negatively affect the hardware, applications, data or network,” according to a 2015 overview by cyber-security firm Symantec.
This includes the ability to eavesdrop on, steal data from or cause damage to phones, computers and networks.
There is a thriving market for zero-day exploits, of which Israel is apparently an eager participant.
The letter given to Motherboard sent by the Israeli embassy in Berlin -- similar to that sent in the US -- says the defense ministry “is interested in advanced vulnerabilities [research and development] and zero-day exploits, to be used by its law enforcement and security agencies, for a wide variety of target platforms and technologies.”
“We are interested in both offensive and defensive cyber security contractors, focusing on vulnerabilities R&D,” the letter continues.
One unnamed source in the US told the website that the correspondence was “very irregular” chiefly because they had never been in touch with Israeli officials before, while another said “There wasn’t a single thing about this that was normal.”
Levi, who stressed he did not know whether the document was genuine, argued that “intelligence services need a way to get in. Of course they are looking for zero-day vulnerabilities.”
Most intelligence services have their own staff working on finding zero-day exploits, he added, but will occasionally go to market for unique or urgent missions.
They are not cheap. A 2012 investigation by Forbes magazine reported that an exploit of Apple’s iOS could fetch up to $100,000, or one in Adobe Reader can be bought for as little as $5,000.
Levi says buyers will have to fork out “hundreds of thousands” for a top-of-the-line vulnerability.
The same report said software producers themselves frequently part with funds in order to snap up bugs in their own systems before they can be sold on to the ill-intentioned.
There are also some companies in Israel who work in the detection and sale of such exploits.
Israel is a top seller of cyber-security and cyber-offensive products, with a flourishing industry mainly staffed by former members of the Israel Defense Forces’ Unit 8200 cyber-intelligence unit.
You need to be logged in in order to post comments. Sign up or log in