The term zero-day describes the point in time at which a vulnerability is exploited: the vendor proverbially had zero days to close it. A distinction is made between the vulnerability itself, the zero-day exploit as the attack code that exploits it, and the zero-day attack, in which this code is actually used.
Such vulnerabilities are tricky for companies because the usual protection mechanisms initially do not work. There is no update yet, and signature-based virus scanners do not know the attack.
How does a zero-day attack work?
Security researchers, criminal groups or state actors find a flaw in software, firmware or hardware. If attackers discover the vulnerability first, they develop an exploit and use it while the vendor knows nothing about it. Such vulnerabilities are sometimes also traded.
As soon as the vendor is informed, it develops an update or publishes interim protective measures. Strictly speaking, the vulnerability is no longer a zero-day once it is published. It nevertheless remains dangerous: attackers analyze published updates to build their own exploits quickly while many systems are still unpatched.
Typical examples
- A crafted document in an email attachment exploits an unknown vulnerability in an office application and executes malicious code when opened.
- Systems at the network edge, such as firewalls, VPN gateways or file transfer platforms, are directly reachable from the internet and therefore a preferred target.
- A vulnerability in a widely used program library affects many products at the same time. Companies then first have to find out where the component is even in use.
What companies should keep in mind
- Be able to respond quickly: A well-practiced process for emergency updates shortens the time between publication and installation. The basis for this is functioning patch management.
- Reduce the attack surface: Only make necessary services reachable from the internet and consistently harden systems, see system hardening.
- Detect behavior: Endpoint Detection and Response solutions detect conspicuous behavior even without a known signature.
- Keep an overview: An up-to-date inventory of systems and software versions immediately shows whether the company is affected when a warning is issued.
- Follow warnings: Security advisories from vendors and national CERTs such as CERT.at often contain interim measures until an update is available.
How it differs
A zero-day vulnerability is unknown or still unpatched. For a known vulnerability, an update already exists, it just has not been installed yet. In practice, many attacks succeed via such known vulnerabilities. Fast patching therefore remains the most important foundation, even if it does not help against true zero-days on its own.
How TOMORIS relates
With GRID.scout, TOMORIS makes known vulnerabilities visible, and GRID.patch supports the timely installation of updates.
View GRID.scout