Exploit Development

Every larger computer program contains bugs. Some of these bugs are harmless, others can be abused: an attacker gets the program to do something its developers never intended. Such an exploitable bug is called a vulnerability. An exploit is the finished piece of code that reliably triggers exactly this vulnerability. Exploit development is the work in between: building a functioning tool from the knowledge of a bug. This is rarely done in an hour, but often takes weeks of laborious detail work.

Why a bug alone is not yet an attack

Between “something is wrong here” and “I control this computer” lies a large gap. A program can crash on a certain input. A crash is annoying, but initially worthless to an attacker. It becomes interesting when he can control the crash so that his own code runs instead. This very control is the actual achievement of exploit development.

That is why the assessment of security vulnerabilities is sharply differentiated. A theoretical vulnerability worries manufacturers only moderately. As soon as a functioning exploit exists and circulates publicly, the situation changes immediately. Then even people who could never have found the flaw themselves can use it. Security firms then speak of a “weaponized exploit”.

Economically, the field is surprisingly large. There are companies that sell exploits for high sums to authorities and intelligence services. For a chain of vulnerabilities that allows taking over a current smartphone without the owner’s involvement, sums in the millions have already been mentioned. At the same time, manufacturers like Google or Apple pay bounties to researchers who report vulnerabilities to them. The same skill can therefore be used legally or criminally.

From crash to control over the program

At the beginning there is usually searching. A widespread method is called fuzzing: a test program throws millions of randomly altered inputs at the software and logs when it crashes. Every crash is an indication of a possible vulnerability. The developer then analyzes exactly what went wrong in the computer’s memory.

A classic pattern is the buffer overflow. A program reserves space for a hundred characters, but is given a thousand, and writes them down anyway. The excess characters end up in memory areas that serve other purposes. Among other things, this is where it is stored at which point the program should continue working after the current step. Whoever overwrites this location determines the further course of execution. You can imagine it like a form where you write beyond the field and in doing so paste over the instruction in the neighboring field.

Modern systems, however, defend themselves. Memory areas are placed at random addresses on every startup so that the attacker doesn’t know where to aim. Other areas are marked as “non-executable”. A large part of today’s exploit development therefore consists of bypassing these protective mechanisms. Often several vulnerabilities are needed in succession, a so-called exploit chain: the first reveals memory addresses, the second allows code execution, the third grants administrator rights.

Between bug bounty programs and headlines

In the news, the topic usually appears under the keyword zero-day. This is the name for a vulnerability that is exploited before the manufacturer could provide an update. Reports about spyware on the phones of journalists also belong here. Behind this there is almost always an elaborately developed exploit chain.

Legally, one encounters this craft in bug bounty programs and penetration tests. In this, a company commissions experts to attack its own systems in order to find vulnerabilities before criminals do. The boundary is important: such tests are only permissible with the explicit permission of the operator. Without permission, even the attempt is punishable by law in Germany.

A common misconception is that exploit development has something to do with guessing passwords. That is a completely different approach. This is about flaws in the program code itself, not about weak credentials. What is new is that AI models are helping to detect such flaws. Security researchers use them for code analysis, and presumably attackers do too.