Thread by @maddiestone

2021 was a wild year for 0-day exploitation detection. 2021 was also full of Google Project Zero & TAG publishing lots of good (in my biased opinion) stuff on 0-day exploits. 🧵ICYMI here they are:

#itw0days

1. In January, Project Zero published a 6 part series about a watering hole attack. The series covers the Chrome, Android, & Windows exploits, & the Android post-exploitation behavior of this attack.
Part #1: googleprojectzero.blogspot.com/2021/01/introd…

2. Also in January, @digivector of TAG published about a North Korean campaign targeting security researchers. While 0-day use was never confirmed, evidence suggested that the attackers did use 0-days in some cases.
blog.google/threat-analysi…

3. In February, I published a Year-in-Review of the 0-days used in the wild in 2020, "Déjà vu-lnerability" since 25% of the in-the-wild 0-days detected in 2020 were closely related to previously publicly disclosed vulns.
Blog: googleprojectzero.blogspot.com/2021/02/deja-v…
Pres:

4. In March, Project Zero followed up our in-the-wild series from January with an update on an additional watering hole attack from the same actors as the Jan series.

googleprojectzero.blogspot.com/2021/03/in-wil…

5. And in March, @digivector of TAG followed up with an update on the campaign targeting security researchers that they originally published about in January.

blog.google/threat-analysi…

6. In May, I keynoted AusCERT and gave my favorite talk of the year: "A World Where 0-day is Hard"

7. In July, @_clem1 and I published a TAG blog post on 4 different in-the-wild 0-days discovered by TAG.

blog.google/threat-analysi…

8. In November, @eryeh of TAG published a blog post on an XNU (macOS) privesc 0-day that she and @clecigne discovered as a part of a watering hole attack.

blog.google/threat-analysi…

9. In December, @i41nbeer published a detailed analysis of an NSO iMessage-based zero-click exploit in collaboration with Citizen Lab and Apple.

googleprojectzero.blogspot.com/2021/12/a-deep…

10. In 2021, we also moved our root cause analysis wiki to GitHub which meant it could become more of a community effort. Thank you to the 2021 non-Google contributors: @mmolgtm @jq0904 @amlweems @BouncyHat @dallasl1200! There are 12 RCAs for 2021 up!

googleprojectzero.github.io/0days-in-the-w…