Product Code Database
A zero-day (also known as a 0-day) is a vulnerability or security hole in a computer system unknown to its developers or anyone capable of mitigation it. Until the vulnerability is remedied, Threat actor can exploit it in a zero-day exploit, or zero-day attack.Compare:
The term "zero-day" originally referred to the number of days since a new piece of software was released to the public, so "zero-day software" was obtained by hacking into a developer's computer before release. Eventually the term was applied to the vulnerabilities that allowed this hacking, and to the number of days that the vendor has had to fix them. Vendors who discover the vulnerability may create patches or advise to mitigate it – though users need to deploy that mitigation to eliminate the vulnerability in their systems. Zero-day attacks are severe threats. The Man Who Found Stuxnet – Sergey Ulasen in the Spotlight published on November 2, 2011
Governments of states are the primary users of zero-day exploits, not only because of the high cost of finding or buying vulnerabilities, but also the significant cost of writing the attack software. Nevertheless, anyone can use a vulnerability, and according to research by the RAND Corporation, "any serious attacker can always get an affordable zero-day for almost any target". Many targeted attacks and most advanced persistent threats rely on zero-day vulnerabilities.
The average time to develop an exploit from a zero-day vulnerability was estimated at 22 days. The difficulty of developing exploits has been increasing over time due to increased anti-exploitation features in popular software.
Even publicly known and zombie vulnerabilities are often exploitable for an extended period. Security patches can take months to develop, or may never be developed. A patch can have negative effects on the functionality of software and users may need to software testing the patch to confirm functionality and compatibility. Larger organizations may fail to identify and patch all dependencies, while smaller enterprises and personal users may not install patches.
Research suggests that risk of cyberattack increases if the vulnerability is made publicly known or a patch is released. Cybercriminals can reverse engineer the patch to find the underlying vulnerability and develop exploits, often faster than users install the patch.
According to research by RAND Corporation published in 2017, zero-day exploits remain usable for 6.9 years on average, although those purchased from a third party only remain usable for 1.4 years on average. The researchers were unable to determine if any particular platform or software (such as open-source software) had any relationship to the life expectancy of a zero-day vulnerability. Although the RAND researchers found that 5.7 percent of a stockpile of secret zero-day vulnerabilities will have been discovered by someone else within a year,: "For a given stockpile of zero-day vulnerabilities, after a year, approximately 5.7 percent have been discovered by an outside entity." another study found a higher overlap rate, as high as 10.8 percent to 21.9 percent per year.
Many organizations have adopted defense-in-depth tactics so that attacks are likely to require breaching multiple levels of security, which makes it more difficult to achieve. Conventional cybersecurity measures such as training and access control such as multifactor authentication, least-privilege access, and air-gapping makes it harder to compromise systems with a zero-day exploit. Since writing perfectly secure software is impossible, some researchers argue that driving up the cost of exploits is a good strategy to reduce the burden of cyberattacks.
The sellers and buyers that trade in zero-days tend to be secretive, relying on non-disclosure agreements and classified information laws to keep the exploits secret. If the vulnerability becomes known, it can be patched and its value consequently crashes. Because the market lacks transparency, it can be hard for parties to find a fair price. Sellers might not be paid if the vulnerability was disclosed before it was verified, or if the buyer declined to purchase it but used it anyway. With the proliferation of middlemen, sellers could never know to what use the exploits could be put. Buyers could not guarantee that the exploit was not sold to another party. Both buyers and sellers advertise on the dark web.
Research published in 2022 based on maximum prices paid as quoted by a single exploit broker found a 44 percent annualized inflation rate in exploit pricing. Remote zero-click exploits could fetch the highest price, while those that require local access to the device are much cheaper. Vulnerabilities in widely used software are also more expensive. They estimated that around 400 to 1,500 people sold exploits to that broker and they made around $5,500 to $20,800 annually.: "The number of independent active sellers (between 40031 and 150035 individuals) ... 2015,35 suggests an annual pay of $5.5k - 20.8k per researcher."
The phases of zero-day vulnerability disclosure, along with a typical timeline, are as follows:
The United States National Security Agency (NSA) increased its search for zero-day vulnerabilities after large tech companies refused to install backdoors into the software, tasking the Tailored Access Operations (TAO) with discovering and purchasing zero-day exploits. In 2007, former NSA employee Charlie Miller publicly revealed for the first time that the United States government was buying zero-day exploits. Some information about the NSA involvement with zero-days was revealed in the documents leaked by NSA contractor Edward Snowden in 2013, but details were lacking. Reporter Nicole Perlroth concluded that "either Snowden’s access as a contractor didn’t take him far enough into the government’s systems for the intel required, or some of the government’s sources and methods for acquiring zero-days were so confidential, or controversial, that the agency never dared put them in writing".
One of the most infamous vulnerabilities discovered after 2013, Heartbleed (CVE-2014-0160), was not a zero-day when publicly disclosed but underscored the critical impact that can have on global cybersecurity. This flaw in the OpenSSL Cryptography library could have been exploited as a zero-day prior to its discovery, allowing attackers to steal sensitive information such as private keys and passwords.
In 2016 the Hacker group known as Shadow Brokers released a trove of sophisticated zero-day exploits reportedly stolen from the NSA. These included tools such as EternalBlue, which leveraged a vulnerability in Microsoft Windows' Server Message Block (SMB) protocol. EternalBlue was later weaponized in high-profile attacks like WannaCry and NotPetya, causing widespread global damage and highlighting the risks of stockpiling vulnerabilities.
The year 2020 saw one of the most sophisticated cyber espionage campaigns to date, in which attackers exploited multiple vulnerabilities, including zero-day vulnerabilities, to compromise SolarWinds' Orion software. This allowed access to numerous government and corporate networks.
In 2021 Chinese state-sponsored group, Hafnium, exploited zero-day vulnerabilities in Microsoft Exchange Server to conduct cyber espionage. Known as ProxyLogon, these flaws allowed attackers to bypass authentication and execute arbitrary code, compromising thousands of systems globally.
In 2022 the spyware Pegasus, developed by Israel's NSO Group, was found to exploit zero-click vulnerabilities in messaging apps like iMessage and WhatsApp. These exploits allowed attackers to access targets' devices without requiring user interaction, heightening concerns over surveillance and privacy.
|
|
