Google Researcher Explains How In-the-Wild Zero-Days Are Found
· 35:14 · Watch on YouTube ↗
Summary
At Hexacon, Google researcher Clem1 explained how exploit hunters identify in-the-wild zero-days, how attackers fingerprint targets, and why messaging apps may become more attractive targets.
Key points
- Repeated scans and website snapshot comparisons helped identify compromised sites delivering Chrome and iOS exploits.
- The speaker described detection clues in browser exploits, including binary headers embedded in JavaScript, garbage-collection patterns and browser-version checks.
- One-time exploit links and crash telemetry can expose attacks, although distinguishing exploit-related crashes from millions of ordinary crashes is difficult.
- Attackers fingerprint devices and research environments before delivery, using information such as browser versions, battery status and codec availability.
- The talk described exploit chains combining browser execution, sandbox escape and privilege escalation, as well as cases where attackers reuse flaws fixed upstream but not yet patched on devices.
- One observed implant exfiltrated device files and removed forensic traces; the speaker also described partial exploit chains that steal cookies without achieving full device compromise.
- The speaker expects more targeting of messaging apps and described a discovered exploit against a messaging app’s JavaScript engine.
Article Details
- Topics
- [02:33] Finding watering-hole exploits through repeated website scans
- [07:13] Detecting browser exploit patterns in JavaScript
- [10:04] Discovering one-time links and exploit-related crashes
- [14:38] Finding exploits in public data repositories
- [16:23] Target and research-environment fingerprinting
- [20:25] Exploit chains, sandbox bypasses and patch gaps
- [29:52] Post-exploitation cleanup and data theft
- [31:58] Partial exploit chains and messaging-app attack surfaces
MITRE ATT&CK
T1027 · Obfuscated Files or InformationObserved exploit deliveries used JavaScript obfuscation and encryption, particularly for newer iOS versions.T1070.004 · File DeletionAn observed post-exploitation routine removed files associated with forensic analysis to eliminate traces.T1189 · Drive-by CompromiseThe speaker described compromised websites serving browser and iOS exploits to visitors.