Definition
A zero-day vulnerability is a software flaw that is unknown to the vendor and therefore unpatched. It poses a critical security risk as attackers can exploit it before a fix is available.How It Works
- 1Discovery: The vulnerability is discovered by an attacker, researcher, or insider before the vendor is aware.
- 2Exploitation: Attackers develop an exploit to take advantage of the flaw, often using it in targeted attacks.
- 3Disclosure: The vulnerability may be responsibly disclosed to the vendor or sold on the zero-day market.
- 4Patch Development: Once informed, the vendor creates a patch to fix the vulnerability.
- 5Deployment: The patch is distributed to users, closing the security gap.
Key Characteristics
- Unknown: Not known to the software vendor or the public.
- Exploitable: Can be used by attackers to execute unauthorized actions.
- Time-Sensitive: Actively exploited before a patch is available.
Comparison
| Term | Definition |
|---|---|
| Zero-Day | Unknown, unpatched vulnerability |
| Known Exploit | Vulnerability with an available patch |
| Bug Bounty | Program rewarding the discovery and responsible disclosure of bugs |
| Zero-Day Market | Buying/selling zero-day vulnerabilities |
Real-World Example
- Log4Shell (CVE-2021-44228): A zero-day vulnerability in the Log4j library allowing remote code execution, leading to widespread exploitation before it was patched.
- EternalBlue (CVE-2017-0144): Used in the WannaCry ransomware attack, exploiting a vulnerability in the SMB protocol.
Detection & Prevention
- Defense-in-Depth: Implement layered security measures to protect against zero-day threats.
- Threat Detection Tools: Use tools like Nmap, Burp Suite, or Nuclei to identify potential vulnerabilities.
- Network Monitoring: Continuously monitor for unusual activity.
- Regular Updates: Keep systems and applications up-to-date.
Common Misconceptions
- Myth: "Zero-days are always discovered by hackers first."
- Myth: "Zero-day vulnerabilities are always highly complex."
Related Terms
- "Exploit"
- "Patch Management"
- "Threat Intelligence"
- "Vulnerability Scanning"
- "Incident Response"
- "Bug Bounty"