Security News > 2021 > July > 22% of exploits for sale in underground forums are more than three years old

Trend Micro released a research urging organizations to focus patching efforts on the vulnerabilities that pose the greatest risk to their organization, even if they are years old.

Older exploits for sale more popular with criminals.

The research found that 22% of exploits for sale in underground forums are more than three years old.

"The lifespan of a vulnerability or exploit does not depend on when a patch becomes available to stop it. In fact, older exploits are cheaper and therefore may be more popular with criminals shopping in underground forums. Virtual patching remains the best way to mitigate the risks of known and unknown threats to your organization."

The oldest exploit sold in the underground was for CVE-2012-0158, a Microsoft RCE. CVE-2016-5195, known as the Dirty Cow exploit, is still ongoing after five years.

Access-as-a-Service has the advantages of an exploit, but all the hard work has already been done for the buyer, with underground prices starting at $1000.

News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/1Jws7icw3YM/