Zero-Day

Every major program contains bugs. Some of these bugs are dangerous because they allow an attacker to read data or control other people's devices. Normally, the manufacturer discovers such bugs itself and distributes a fix, known as an update. A zero-day is the reverse case: an attacker knows about the flaw first, and the manufacturer knows nothing about it. The name alludes to the fact that the manufacturer has zero days left to react. As long as the vulnerability is unknown, even the most diligent updating doesn't help, because there is simply nothing to update.

Why an unknown vulnerability is so valuable

The usual protection against attacks relies on knowledge. Virus scanners recognize known malware, firewalls block known attack patterns, updates close known flaws. A zero-day bypasses this entire chain because it appears on no list. That is exactly what makes it so attractive to attackers.

As a result, a veritable market has formed. Companies buy up unknown vulnerabilities and sell attack tools built from them to intelligence agencies and police authorities. For a flaw in a widely used smartphone system, sums in the six or seven figures are paid. Major software manufacturers, in turn, pay rewards to researchers who report bugs to them instead of selling them. These programs are called bug bounty programs, meaning bounties for bugs.

The distinction is important: not every security vulnerability is a zero-day. As soon as the manufacturer knows about the flaw and provides a fix, it becomes a normal, known vulnerability. Most successful attacks in the world exploit exactly such known vulnerabilities on devices that nobody has updated. Zero-days are rarer, but against them the individual is almost defenseless.

From a bug in the code to a finished attack

First, someone has to find the vulnerability. This is done by systematically examining programs, for instance by feeding them millions of randomly altered inputs and observing when they crash. A crash is an indication that the program is doing something with an input that the developers did not intend. This is exactly where the attacker starts.

In the second step, this becomes an exploit. This is a piece of code that deliberately triggers the flaw while smuggling in its own commands. A classic example: an image file deliberately contains incorrect size information. The program that opens it then writes data to a location in memory where it should never write. Attacker instructions are then placed there, and the device executes them.

The last step is distribution. Zero-days are often used very sparingly, against individual, important targets. The reason is economic: every use increases the risk that someone will notice the attack and the manufacturer will release an update. After that, the expensively acquired vulnerability becomes worthless. If it becomes publicly known, a race begins between the manufacturer's update and attackers who now exploit the vulnerability broadly.

Zero-days in the news and on your own phone

When a manufacturer releases a security update outside the normal schedule and states that the flaw is already being actively exploited, then it was a zero-day. Such reports regularly concern browsers, smartphone operating systems, and office software. Spyware programs that could take hold on a phone through a single message, without the owner having to click on anything, have become well known.

The topic is also relevant for investors and companies. A large-scale attack via an unknown vulnerability in corporate software can hit thousands of customers simultaneously and shut down production. Accordingly, the stock prices of security firms and affected providers react to such news.

For private individuals, the practical consequence remains remarkably simple. Updates should be installed immediately, because they are precisely what closes the vulnerability the moment it is no longer unknown. Anyone who leaves software outdated for weeks is not endangered by zero-days, but by long-since-fixed bugs. Artificial intelligence now plays a role on both sides: language models help researchers search code for bugs, and make it easier for attackers to quickly build a working attack from a discovered flaw.