Exploit
A program or technique that takes advantage of a vulnerability to achieve an unintended effect, code execution, privilege escalation, whose public release turns a theoretical flaw into a mass risk.
A vulnerability is a defect; an exploit is the tool that puts it to use. It is a program, a sequence of commands or specially crafted data that causes, on a vulnerable system, behavior its designers did not intend: arbitrary code execution, authentication bypass, privilege escalation, denial of service. The distinction matters to the underwriter, because real risk follows not the discovery of a flaw but the availability of reliable code to exploit it. As long as none exists, only highly skilled actors can use it; once it is published or sold, it is built within days into automated tools and ransomware, and the flaw becomes a mass risk. There is a market for such code, from bug bounty programs to brokers who resell unknown flaws to states, and some exploits developed by intelligence services have leaked. This is one of the points where cyber meets politics directly: a state's arsenal can become the tool of a global catastrophe.
EternalBlue, an exploit attributed to the US National Security Agency, was published on April 14, 2017 by the Shadow Brokers group, one month after the patch was released. It was used on May 12, 2017 to spread WannaCry, then in June to spread NotPetya, whose damage was estimated at ten billion dollars.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.