Zero-Day Vulnerability

Every major computer program contains bugs. Some of these bugs are harmless, others allow outsiders to gain unauthorized access to a device. Such dangerous bugs are called security vulnerabilities. Normally, the manufacturer finds them itself and closes them with an update. A zero-day vulnerability is the reverse case: someone else has discovered the flaw first and keeps quiet about it. The name comes from the fact that the manufacturer has zero days left to react, because it does not yet know anything about the problem.

Why a lead of days is worth so much

The crucial point is the asymmetry of knowledge. Whoever knows about a zero-day vulnerability can exploit it, while everyone else is left in the dark. There is no update to install, and no antivirus program recognizes the attack pattern either. Even a cautious user who keeps every piece of software up to date is vulnerable during this time. That is exactly what makes these vulnerabilities so valuable.

That is why a veritable market exists for them. Some companies buy zero-days for six-figure sums and resell them to intelligence agencies or police authorities. Other companies pay rewards to researchers who report vulnerabilities instead of selling them. Such programs are called bug bounty programs, that is, a bounty on bugs. Google and Apple have spent double-digit million-dollar amounts on this in individual years.

Zero-days are rarely used for mass attacks. They are too expensive and burn out once deployed, because they can be noticed in the process. Targeted attacks on individual people are typical: journalists, politicians, executives of large corporations. This became known through the spyware Pegasus, which installed itself unnoticed on smartphones via such vulnerabilities.

From a flaw in the code to a finished attack tool

At the beginning there is a flaw in the program code. A common type is the buffer overflow: a program reserves space for a certain amount of data but does not check whether the incoming data actually fits into it. If an attacker sends more, the rest ends up in a memory area where it has no business being. In the worst case, this data is executed as commands. The attacker then determines what the program does.

The flaw alone does not yet make an attack. What is needed is a program that reliably exploits the flaw. This tool is called an exploit, literally an exploitation. A good exploit works on many devices and does not crash, because a crash would warn the victim. Attackers often combine several vulnerabilities in succession to get from a harmless program all the way to the deepest privileges of the operating system.

As soon as the manufacturer learns of the vulnerability, a race begins. It develops a patch, that is, a correction of the code, and distributes it as an update. From this moment on, the vulnerability is officially no longer a zero-day. It remains dangerous nonetheless, because many users postpone updates for weeks. Attackers even analyze the patches to learn from them where the vulnerability was located.

Where zero-days appear in the news

In reports, such cases can be recognized by phrases like “already actively exploited.” When Apple releases an emergency update outside the usual rhythm, a zero-day is usually behind it. Every officially recorded vulnerability gets an identification number that begins with CVE. These numbers can be found in security advisories and in trade articles.

This topic is also relevant for investors. A spectacular attack via a zero-day vulnerability can halt production and expose customer data. The stocks of security companies often react in the opposite direction to such news, because demand for protective software rises. Artificial intelligence now also plays a role: programs automatically search code for suspicious spots. This helps defenders and attackers at the same time.

A common misconception is that zero-days are the main risk for private individuals. That is not true. Most successful attacks use vulnerabilities that have long been known and for which an update has existed for months, or they deceive people with fake emails. Updating promptly and maintaining a healthy distrust therefore accomplish more than fear of unknown vulnerabilities.