Expert Explains Zero-Day Vulnerabilities and Their Widespread Dangers

The news media often report on highly dangerous zero-day vulnerabilities discovered in popular applications or operating systems. Daniil Chernov, CTO at DerSecur LTD., explains this security problem, why it affects everybody, and how to confront it.

There are many types of vulnerabilities known to the information security community and classified by threat or severity level, trigger, or programming language. At the same time, so called zero-day vulnerabilities are unknown. The term ‘zero-day’ refers to the number of days that the developers have had to fix a vulnerability as it was previously unknown. Thus, a zero-day vulnerability is a program security breach for which a security patch or protection tool is not yet available.

There are two ways to detect zero-day vulnerabilities. Either hackers find and exploit a vulnerability to attack a development company or system users and cash in on it, or software developers announce a Bug Bounty program, offering individuals compensation for reporting security vulnerabilities. In the latter case, a company can promptly eliminate an identified vulnerability and protect its software and users against relevant attacks.

The problem is that neither the program vendor nor its users know where the danger may come from. Indeed, a vulnerability discovered by hackers is only known to a small group of maliciously minded persons. Being a completely new breach, a zero-day vulnerability has not been identified in any way before, with no relevant security patches created yet. This means that an attacker has plenty of time from the first vulnerability exploitation until its detection by a vendor or users themselves. Then, the release of security patches also takes time. After that, the main question is: how quickly will all affected users realize the danger and install the patches? This process could take months, during which hackers may exploit the vulnerability.

However, zero-day vulnerabilities are not always exploited by the hackers who found them. Sometimes, this unique knowledge is sold on the darknet to buyers who want to monetize it. For example, by exploiting a security breach, hackers can steal a database of user contact details and either sell or use it for phishing attacks aimed at, say, pilfering credit card details and withdrawing money from bank accounts. There can be many scenarios for monetizing an attack, depending on the hacked resource and access privileges that fall into the criminals’ hands.

To keep themselves safe, users need to update their software regularly. If you don't have time to monitor software updates, just turn on automatic updates in the settings menu. This will minimize the risk of incidents caused by zero-day vulnerabilities.