It\u2019s finally here – the vacation you\u2019ve been planning has arrived and it\u2019s time to hit the road. You lock your doors and head to the airport. But a few days later, while you\u2019re gone, a burglar decides to check out your neighborhood. They come to your house and, to their delight, find that the lock on the back door is broken. You didn\u2019t notice, but the bad guys did. They are thus able to steal your valuables before you have the chance to fix your door. Now, replace your house a piece of software and the broken lock with a vulnerability and you\u2019re looking at how zero-day exploits work in the cybersecurity world.<\/p>\n\n\n\n
Zero-day attacks are extremely common and topped WatchGuard\u2019s list of the most popular types of network attacks<\/a> in 2019. The report also found that zero-day exploits were responsible for half of all malware detections, a figure that increased 60% from the previous year. Likewise, the Ponemon Institute\u2019s Study on the State of Endpoint Security Risk<\/a> determined that 80% of all successful data breaches in 2019 directly resulted from zero-day attacks. These stats are no surprise when you look at how much danger zero-day exploits pose and how effective they are at helping cybercriminals achieve their goals.<\/p>\n\n\n\n Most people think of zero-day exploits as tools created and used by black hat, criminal hackers. However, government agencies around the world are just as interested in obtaining them, most often for use in surveillance or their own cyberattacks. In fact, a thriving black market has emerged as a result of the fierce competition from both sides to be the first to know about zero-day vulnerabilities and the ways to exploit them.<\/p>\n\n\n\n So, what are zero-day attacks exactly? Why are they so dangerous? How are zero-day exploits used? And how can the damage be minimized?<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n Zero-day exploits take advantage of vulnerabilities that unknown to the public-at-large at the time of their creation, including the developers of the vulnerable software and the makers of security tools like anti-virus and anti-malware programs. When a hacker uses a zero-day exploit to break into a system, the resulting hack is called a zero-day attack.<\/p>\n\n\n\n The \u201czero-day\u201d portion of the name refers to the number of days that the good guys have to fix the problem, and zero-day exploits happen when the bad guys win the race to find any particular vulnerability. After locating a vulnerability, hackers then create an exploit that\u2019s able to make use of it during an attack. Since no one previously knew about the vulnerability, there will likely be minimal defenses in place to combat the exploit, making a zero day attack more likely to succeed. Once a vulnerability becomes publicly known, then the race is on for the software vendor to try and release a patch that fixes the problem before attackers can capitalize. (Side note: this is why security researchers and penetration testers are so important\u2014their job is to find vulnerabilities before hackers do.) All too often, though, the vendor will find out only after an attack has occurred, and then they\u2019ll be trying to merely minimize the damage.<\/p>\n\n\n\n The most popular attack vectors for zero-day exploits are widely used programs such as web browsers and common file types (and the programs that handle them) such as Word, Excel, or PDF files. If you\u2019re going to spend all the time to create a zero-day exploit, you may as well target a program nearly everyone uses so you have lots of targets for your evil plan.<\/p>\n\n\n\n It can be easy to confuse the three terms, and they are often incorrectly used interchangeably. Let\u2019s make sure their definitions are clear before moving forward:<\/p>\n\n\n\n Zero-Day vulnerabilities<\/strong> are security weaknesses in software, firmware, or hardware that are unknown to vendors. Accordingly, patches for them do not exist at the time of their release to the public. Usually, they only become known after an attack has occurred and has been investigated by researchers.<\/p>\n\n\n\n Zero-Day exploits<\/strong> take advantage of zero-day vulnerabilities. The exploit itself is the method and\/or code that hackers use to carry out an attack against whatever possesses the vulnerability. They don\u2019t necessarily need to use their exploit immediately, either. They can create it and strategically wait for the best time or place to deploy it. It\u2019s still a zero-day exploit at that point since it hasn\u2019t become public knowledge yet.<\/p>\n\n\n\n Zero-day attacks<\/strong> are the final step, and they happen when the attackers finally decide to make use of the exploit. This is often done via zero-day malware that contains the exploit. At this point, it is only a matter of time before the zero-day vulnerability is discovered since the hacker\u2019s tools are now out in the open and able to be studied and reverse-engineered by researchers.<\/p>\n\n\n\n As we mentioned earlier, zero-day exploits get their name from the fact that they\u2019ve been known by vendors for exactly zero days. Usually, patches fix vulnerabilities that enable the creation of zero-day exploits, but unfortunately, they can\u2019t be created instantly. This gives attackers time to run rampant and carry out zero-day attacks on defenseless targets.<\/p>\n\n\n\n It can take days, weeks or even months for fixes to be released. Users could be forced to use compromised software that entire time, exposing their machines and personal data. Not to mention the fact that people are often slow to actually download and install new updates.<\/p>\n\n\n\n Zero-day exploits also drastically increase the everyday risks for the average user. Not only are software vendors unprepared for zero-day exploits, but so are the developers of your security software. Usually your anti-virus or anti-malware programs would catch any malicious malware encountered during routine internet activities. But with zero-day exploits, your machine has a much higher chance of getting infected while viewing websites, dealing with suspicious messages, or downloading third-party programs.<\/p>\n\n\n\n It used to be that a single zero-day exploit could be disastrous for an application. However, thanks to improved security mitigation in modern operating systems, it is now often necessary to chain together multiple zero-day exploits in order for an attack to be successful.<\/p>\n\n\n\n The kind of hackers that deal with zero-day exploits usually don\u2019t mess around. They go after bigger, high-value targets such as:<\/p>\n\n\n\n So, while attackers aren\u2019t usually going after specific individual users, that doesn\u2019t mean that the average person won\u2019t be affected by zero-day attacks. They often end up being collateral damage or used as tools in a grander scheme. Non-targeted attacks aim to hit as many users as possible, and in that case your personal data is just as valuable as the next person\u2019s, which means the dangers are still very significant.<\/p>\n\n\n\n So, now that we\u2019ve covered what zero-day attacks are and why they\u2019re so dangerous, let\u2019s take a look at the typical life of a zero-day exploit from beginning to end:<\/p>\n\n\n\n The \u201czero-day attack\u201d portion occurs between steps 2 and 5, but it\u2019s important to remember that systems can still be vulnerable during every step.<\/p>\n\n\n\nWhat Is a Zero-Day Attack\/Exploit?<\/h2>\n\n\n\n
Zero-Day Vulnerabilities vs Exploits vs Attacks<\/h3>\n\n\n\n
Why Are Zero-Day Attacks\/Exploits so Dangerous?<\/h2>\n\n\n\n
Typical Targets of Zero-Day Exploits<\/h3>\n\n\n\n
The Process of Zero-Day Attacks<\/h2>\n\n\n\n