What is a class of vulnerabilities that are unknown before they are exploited?

Emerging Threats

• Security Center
• Emerging Threats
• What is a zero-day exploit?

Written by Clare Stouffer, a NortonLifeLock employee

September 3, 2021

A zero-day exploit is when hackers take advantage of a software security flaw to perform a cyberattack. And that security flaw is only known to hackers, meaning software developers have no clue to its existence and have no patch to fix it. 

This is why, when a zero-day attack is detected, it needs to be mitigated immediately. In other words, there are “zero days” to fix vulnerability because it’s already been exploited. 

Here, we’re zeroing in on the zero-day concept, including just what is a zero-day exploit, and how to avoid them.

Zero-day definitions

What is zero-day? The term “zero-day” refers to a newly discovered software vulnerability and the fact that developers have zero days to fix the problem because it has been — and has the potential to be — exploited by hackers. 

Sometimes written as 0-day, zero-day definitions run the gamut:       

• A zero-day vulnerability, also known as a zero-day threat, is a flaw in security software that’s unknown to someone interested in mitigating the flaw, like a developer.       
• A zero-day exploit is when hackers take advantage of a zero-day vulnerability for malicious reasons, oftentimes by way of malware to commit a cyberattack.       
• A zero-day attack is when hackers leverage their zero-day exploit to commit a cyberattack, oftentimes resulting in problems like identity theft or data loss. 

To put these zero-day definitions together, zero-day vulnerabilities leave us susceptible to zero-day attacks, which are carried out by zero-day exploits.

What makes a vulnerability a zero-day?

Security software vulnerabilities can come in many forms, including unencrypted data, broken algorithms, bugs, or weak passwords. What makes a vulnerability a zero-day is when someone interested in mitigating the flaw is unaware of it, meaning an official patch or update to fix the flaw doesn’t exist. Once the vulnerability is discovered, it is no longer considered a zero-day.

How do zero-day attacks work?

Zero-day attacks begin with zero-day vulnerabilities, meaning flaws or holes in security software. These can result from improper computer or security configurations or programming errors by developers themselves. 

The whole notion of a zero-day attack is that cyberattackers exploit these vulnerabilities without developers knowing. Cyberattackers might write — or purchase from the dark web — exploit codes to spot these vulnerabilities. When they do, it’s akin to a welcome mat for a zero-day attack. And what hackers often bring to the door is malware, also known as zero-day malware or more broadly as a zero-day exploit.

And they might deliver this by way of social engineering tactics or phishing. Once the zero-day exploit is downloaded on devices, the zero-day attack is executed. The havoc that ensues can include:       

• Data stolen       
• Hackers taking remote control of devices       
• Other malware installed       
• Files corrupted       
• Contact list accessed and sending spam messages     
• Spyware installed to steal sensitive information 

Since zero-day attacks are inherently stealthy, it can take months or even years for these zero-day exploits to be realized. That’s often once the aforementioned problems arise. In some cases, though, developers might be able to stop or patch vulnerabilities before too much damage is caused. 

In simpler terms, you might think of a zero-day attack like a robber finding a door that’s consistently left unlocked in a store. And they continue robbing the store through that unlocked door until the store owner discovers the flaw — the unlocked door.

Who conducts zero-day attacks?

While software developers are constantly looking to patch security vulnerabilities — we see this in the form of software updates — cyberattackers are constantly seeking to exploit them. And there are many types of cyberattackers, each with their own motivations:       

• Cybercriminals or hackers are often financially motivated       
• Hacktivists are motivated by drawing attention to a cause social or political       
• Corporate espionage artists are motivated by spying on companies       
• Cyberwarfare attackers can be countries or independent malicious actors who want to compromise a cybersecurity infrastructure as an act of war

Who are the victims of zero-day exploits?

You might also think of zero-day exploits as targeted and non-targeted cyberattacks, similar to spear phishing and phishing. The former targets valuable, individual victims, while the latter seeks to affect as many victims as possible.

At the end of the day, anyone utilizing an exploited system can be a zero-day exploit victim, including:       

• individuals       
• businesses or organizations       
• government agencies 

And if you’re an everyday computer user, a zero-day vulnerability can pose serious security risks because exploit malware can infect operating systems, web browsers, applications, open-source components, hardware, even IoT devices through otherwise harmless web browsing activities. This can include viewing a website, opening a compromised message, or playing infected media.

How to identify zero-day vulnerabilities

Oftentimes, zero-day vulnerabilities are detected when it’s too late — when they’re exploited, that is. There are some more technical ways to identify zero-day vulnerabilities, including scanning internet traffic, examining codes of incoming files, and leveraging malware detection methods.

For everyday computer users, antivirus software can take out some of this guesswork for you. What’s more, avoiding zero-day exploits and vulnerabilities from the start can go a long way.

How to avoid zero-day exploits and vulnerabilities

Even as we can’t always detect these vulnerabilities, we can protect our devices and data in the event an exploit does occur. Consider these proactive and reactive security measures.

1. Keep software up to date to ensure security patches are in place and to reduce the risk of malware infection.
2. Limit your applications because the less you have downloaded, the less data you’re putting at risk.
3. Use a firewall to monitor and block suspicious activity, such as zero-day exploits.
4. Educate yourself on zero-day exploits and seek out solutions when zero-day vulnerabilities are discovered.
5. Consider using antivirus software to protect against both known and unknown threats.

Examples of zero-day exploits

Finally, don’t underestimate the threat of zero-day exploits. Cybercriminals will seek to exploit security holes and gain access to your devices and your personal information. They can use your information for a range of cybercrimes including identity theft, bank fraud, and ransomware.

Just consider these recent and headline-making examples of zero-day exploits.       

• Google Chrome, 2021: Google Chrome fell victim to several zero-day threats, attributed to a bug in JavaScript.       
• Zoom, 2020: Hackers exploited a vulnerability in the video conferencing platform that allowed them to take remote control over PCs.       
• Apple, 2020: A bug in Apple’s iOS software allowed hackers to compromise devices from remote locations. 
• Microsoft Windows, 2019: Government agencies across Eastern Europe saw their Microsoft Windows software exploited, resulting in suspicious apps being installed, data changed, and programs compromised. 
  
• Microsoft Word, 2017: Individual computer users saw their bank accounts compromised after opening a Microsoft Word document containing zero-day malware.       
• ​​Stuxnet, 2010: A self-replicating computer worm disrupted Iranian nuclear plants, taking control of computers and altering the speed of centrifuges in the plants, ultimately shutting them down. 

Stuxnet isn’t only one of the earliest zero-day exploits used, but it’s also one of the most famous. The zero-day attack was even made into a documentary, appropriately titled “Zero Days.”

Just because zero-day exploits are meant to fly under the radar doesn’t mean you should let these stealthy cyberattacks fall off your own radar. Instead, zero in on cybersecurity best practices to avoid zero-day exploits at all costs. 

Editorial note: Our articles provide educational information for you. NortonLifeLock offerings may not cover or protect against every type of crime, fraud, or threat we write about. Our goal is to increase awareness about cyber safety. Please review complete Terms during enrollment or setup. Remember that no one can prevent all identity theft or cybercrime, and that LifeLock does not monitor all transactions at all businesses.

Copyright © 2022 NortonLifeLock Inc. All rights reserved. NortonLifeLock, the NortonLifeLock Logo, the Checkmark Logo, Norton, LifeLock, and the LockMan Logo are trademarks or registered trademarks of NortonLifeLock Inc. or its affiliates in the United States and other countries. Firefox is a trademark of Mozilla Foundation. Android, Google Chrome, Google Play and the Google Play logo are trademarks of Google, LLC. Mac, iPhone, iPad, Apple and the Apple logo are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc. Alexa and all related logos are trademarks of Amazon.com, Inc. or its affiliates. Microsoft and the Window logo are trademarks of Microsoft Corporation in the U.S. and other countries. The Android robot is reproduced or modified from work created and shared by Google and used according to terms described in the Creative Commons 3.0 Attribution License. Other names may be trademarks of their respective owners.

How vulnerabilities are exploited to launch an attack?

What is an attack vector in cyber security?

Which of these host

Which of the following is an example of a vulnerability?