Zero-Day Exploitation

Zero-day exploitation uses a vulnerability for which the vendor has no patch yet, or does not know exists. The name says how much time the defense had to prepare: zero days. In practice a victim can be doing everything right, keeping systems and applications up to date, and still be exposed.

Term

description · examples · notes

Description

That is why zero-day vulnerabilities are expensive, rare and valuable. They are usually kept for targets that justify the price: government institutions, large companies, supply chains, journalists, activists, financial systems or infrastructure. When they do appear in mass use, the window for reacting is short.

A defense against zero-day cannot rest on patches alone, because at the moment of the attack the patch does not exist. What matters is reducing the attack surface, segmentation, behavioral detection, limited rights and a response plan. When you do not know the exact flaw, you have to limit what its exploitation can lead to.

Examples

An unknown vulnerability in a browser is used to install spyware with no visible interaction from the user.
A vulnerability in a network device is exploited before the vendor publishes a patch.
A popular library carries an unknown flaw that allows servers to be compromised before the community even works out what the problem is.

Notes

Zero-day does not automatically mean magic. After exploiting the vulnerability the attacker still has to move, stay present and extract something. That is where the defense can catch them.
If a system was exposed to the vulnerability before the patch was published, the question is not only when the patch goes on, but whether a compromise has already happened.

Mentioned in the news

Techniques

carried out with 6

Techniques used to carry it out. Select one to open its page.

Defenses

countered by 15

How it is defended against. Select one to open its page.