Empirical Estimates and Observations of 0Day Vulnerabilities

We define a 0Day vulnerability to be any vulnerability, in deployed software, that has been discovered by at least one person but has not yet been publicly announced or patched. These 0Day vulnerabilities are of particular interest when assessing the risk to a system from exploit of vulnerabilities which are not generally known to the public or, most importantly, to the owners of the system. Using the 0Day definition given above, we analyzed the 0Day lifespans of 491 vulnerabilities and conservatively estimated that in the worst year there were on average 2500 0Day vulnerabilities in existence on any given day. Then using a small but intriguing set of 15 0Day vulnerability lifespans representing the time from actual discovery to public disclosure, we made a more aggressive estimate. In this case, we estimated that in the worst year there were, on average, 4500 0Day vulnerabilities in existence on any given day

Empirical Estimates of 0Day Vulnerabilities in Control Systems

We define a 0Day vulnerability to be any vulnerability, in deployed software, which has been discovered by at least one person but has not yet been publicly announced or patched. These 0Day vulnerabilities are of particular interest when assessing the risk to well managed control systems which have already effectively mitigated the publicly known vulnerabilities. In these well managed systems the risk contribution from 0Days will have proportionally increased. To aid understanding of how great a risk 0Days may pose to control systems, an estimate of how many are in existence is needed. Consequently, using the 0Day definition given above, we developed and applied a method for estimating how many 0Day vulnerabilities are in existence on any given day. The estimate is made by: empirically characterizing the distribution of the lifespans, measured in days, of 0Day vulnerabilities; determining the number of vulnerabilities publicly announced each day; and applying a novel method for estimating the number of 0Day vulnerabilities in existence on any given day using the number of vulnerabilities publicly announced each day and the previously derived distribution of 0Day lifespans. The method was first applied to a general set of software applications by analyzing the 0Day lifespans of 491 software vulnerabilities and using the daily rate of vulnerability announcements in the National Vulnerability Database. This led to a conservative estimate that in the worst year there were, on average, 2500 0Day software related vulnerabilities in existence on any given day. Using a smaller but intriguing set of 15 0Day software vulnerability lifespans representing the actual time from discovery to public disclosure, we then made a more aggressive estimate. In this case, we estimated that in the worst year there were, on average, 4500 0Day software vulnerabilities in existence on any given day. We then proceeded to identify the subset of software applications likely to be used in some control systems, analyzed the associated subset of vulnerabilities, and characterized their lifespans. Using the previously developed method of analysis, we very conservatively estimated 250 control system related 0Day vulnerabilities in existence on any given day. While reasonable, this first order estimate for control systems is probably far more conservative than those made for general software systems since the estimate did not include vulnerabilities unique to control system specific components. These control system specific vulnerabilities were unable to be included in the estimate for a variety of reasons with the most problematic being that the public announcement of unique control system vulnerabilities is very sparse. Consequently, with the intent to improve the above 0Day estimate for control systems, we first identified the additional, unique to control systems, vulnerability estimation constraints and then investigated new mechanisms which may be useful for estimating the number of unique 0Day software vulnerabilities found in control system components. We proceeded to identify a number of new mechanisms and approaches for estimating and incorporating control system specific vulnerabilities into an improved 0Day estimation method. These new mechanisms and approaches appear promising and will be more rigorously evaluated during the course of the next year

Heterogeneous Ice Growth in Micron-Sized Water Droplets Due to Spontaneous Freezing

Understanding how ice nucleates and grows into larger crystals is of crucial importance for many research fields. The purpose of this study was to shed light on the phase and structure of ice once a nucleus is formed inside a metastable water droplet. Wide-angle X-ray scattering (WAXS) was performed on micron-sized droplets evaporatively cooled to temperatures where homogeneous nucleation occurs. We found that for our weak hits ice grows more cubic compared to the strong hits that are completely hexagonal. Due to efficient heat removal caused by evaporation, we propose that the cubicity of ice at the vicinity of the droplet’s surface is higher than for ice formed within the bulk of the droplet. Moreover, the Bragg peaks were classified based on their geometrical shapes and positions in reciprocal space, which showed that ice grows heterogeneously with a significant population of peaks indicative of truncation rods and crystal defects. Frequent occurrences of the (100) reflection with extended in-planar structure suggested that large planar ice crystals form at the droplet surface, then fracture into smaller domains to accommodate to the curvature of the droplets. Planar faulting due to misaligned domains would explain the increased cubicity close to the droplet surface. QC 20220223</p

Anomalous Behavior of the Homogeneous Ice Nucleation Rate in No Man s Land

We present an analysis of ice nucleation kinetics from near-ambient pressure water as temperature decreases below the homogeneous limit TH by cooling micrometer-sized droplets (microdroplets) evaporatively at 103−104 K/s and probing the structure ultrafast using femtosecond pulses from the Linac Coherent Light Source (LCLS) free-electron X-ray laser. Below 232 K, we observed a slower nucleation rate increase with decreasing temperature than anticipated from previous measurements, which we suggest is due to the rapid decrease in water’s diffusivity. This is consistent with earlier findings that microdroplets do not crystallize at <227 K, but vitrify at cooling rates of 106−107 K/s. We also hypothesizethat the slower increase in the nucleation rate is connected with the proposed “fragile-to-strong” transition anomaly in water

Coherent X-rays reveal the influence of cage effects on ultrafast water dynamics

The dynamics of liquid water feature a variety of time scales, ranging from extremely fast ballistic-like thermal motion, to slower molecular diffusion and hydrogen-bond rearrangements. Here, we utilize coherent X-ray pulses to investigate the sub-100 fs equilibrium dynamics of water from ambient conditions down to supercooled temperatures. This novel approach utilizes the inherent capability of X-ray speckle visibility spectroscopy to measure equilibrium intermolecular dynamics with lengthscale selectivity, by measuring oxygen motion in momentum space. The observed decay of the speckle contrast at the first diffraction peak, which reflects tetrahedral coordination, is attributed to motion on a molecular scale within the first 120 fs. Through comparison with molecular dynamics simulations, we conclude that the slowing down upon cooling from 328 K down to 253 K is not due to simple thermal ballistic-like motion, but that cage effects play an important role even on timescales over 25 fs due to hydrogen-bonding.112sciescopu