Zero-Day Exploit

Every program contains bugs. Some of these bugs can be exploited to break into someone else’s device or steal data. Such exploitable bugs are called security vulnerabilities. Normally, the vendor discovers the vulnerability and releases an update that closes it. A zero-day exploit is the special case: attackers know about the vulnerability, but the vendor does not yet. The name comes from the number of days the vendor had to react — zero.

Why there is no defense against zero-days

The usual advice against attacks is: install updates. With a zero-day, this advice doesn’t help. There is no update, because nobody at the vendor even knows about the problem yet. Even a carefully maintained system remains vulnerable during this time. That is exactly what makes such vulnerabilities so valuable.

That’s why a market for them exists. Security researchers who find a vulnerability can report it to the vendor and collect a reward. These programs are called bug bounty programs. Anyone who instead sells the vulnerability to specialized brokers often gets significantly more money. For a working attack on a current smartphone, six- to seven-figure sums are paid, depending on the case.

Buyers include intelligence agencies, police authorities, and companies making surveillance software. This became widely known through the Pegasus program, which was used to spy on the phones of journalists and activists. Zero-days are therefore not just a technical topic, but a political one as well.

From bug to working attack

Two things need to be distinguished. The vulnerability is the flaw in the program. The exploit is the piece of code that actually takes advantage of this flaw. A vulnerability alone is not yet an attack. Only the exploit turns it into a tool.

A classic pattern is the buffer overflow. A program reserves space for a certain amount of data, say 100 characters. If it doesn’t check the length of the input, an attacker can send 500 characters. The excess data then ends up in memory areas where it doesn’t belong. With enough skill, this can be used to make the program execute foreign commands.

Such bugs are found, among other methods, through fuzzing. In this process, a test program automatically feeds the software huge amounts of nonsensical input and watches for when it crashes. Every crash is a hint at a possible vulnerability. This very search can now be sped up using AI models that scan source code for suspicious patterns. This benefits both sides: defenders and attackers.

Zero-days in the news

When Apple, Google, or Microsoft describe an update as addressing something “actively exploited,” a zero-day is usually behind it. Such emergency updates appear outside the normal schedule. From the moment of publication, the vulnerability is officially no longer a zero-day, since it is now known. It remains dangerous nonetheless, because many users only install the update weeks later.

The most famous example in history is Stuxnet. This malware used several zero-days simultaneously around 2010 and damaged uranium enrichment facilities in Iran. It is considered the first digital weapon with physical effects. For companies, zero-days are a cost risk that interests investors: an attack on a cloud service can hit thousands of customers at once.

A common misconception is that zero-days threaten the average user. The vast majority of successful attacks run through long-known vulnerabilities and through passwords obtained via phishing emails. Zero-days are too expensive for mass attacks. They are deployed in a targeted manner, against individual people or well-protected targets.