What is a Zero Day Exploit?

Zero day exploit definition

Wikipedia defines zero day as a computer-software vulnerability previously unknown to those who should be interested in its mitigation, like the vendor of the target software. Until the vulnerability is mitigated, hackers can exploit it to adversely affect programs, data, additional computers or a network. An exploit taking advantage of a zero day is called a zero day exploit, or zero day attack.

You might be wondering if there’s a simpler way to explain what a zero day is. Let’s break it down a bit but before we do that, imagine yourself in the following situation:

• Consider that you put hard copies of your confidential documents into a physical locker.
• The locker has a 8 digit login that only you know so your information is very secure.
• Imagine that an offender figures out that hammering the locker in a certain way can break it open.
• You come to know about this flaw but as yet you do not have a fix for this.
• It is an example of zero day vulnerability. Why is it called a ‘zero day’ ? It’s because you have just discovered this vulnerability, and you exactly have ‘zero days’ to fix it.
• If the offender breaks open the locker utilizing the known flaw before you come up with a fix, it is called a zero day attack.

Typical properties of a zero-day exploit in context of cyber security:

1. A flaw or vulnerability in a computer software.
2. Vulnerability was previously unknown to the software vendor.
3. There is no immediate fix available for the vulnerability.
4. The vulnerability is open to be exploited by the hackers.

Zero day exploit example

Let’s now look at a real example of a ‘zero-day exploit’-

In recent times, The Log4j vulnerability received a lot of press and has been labeled by some as “the worst software vulnerability ever”. Log4j is an example of zero day vulnerability.

Mahendra Ramsinghani succinctly explains Log4j vulnerability-

Software developers like to record everything so that they can review and debug their work. Recording in the developer world is called logging, and the “camera” they use for recording/logging events is called Log4j. Log4j is prepackaged open-source code that is incorporated in software applications, like a Lego block. But this camera has a glitch and can magically become a tunnel via which attackers can get in and control the house. 

Assessing Log4j vulnerability on 4 listed properties of a zero day exploit:

1. It is a software flaw in a popular open-source framework developed by Apache Software Foundation.
2. It was previously unknown to Apache’s developers till they started receiving alerts from Alibaba’s cloud-security team.
3. It was obviously an unknown flaw till then, with no fix available.
4. This was a remote code execution vulnerability. Such a vulnerability allows a cyber-intruder to run malicious software on the server that can literally take over the server. Once a cyber-intruder gains access, it can cause massive damage to organization’s data and systems.

What is the difference between a zero day vulnerability, a zero day exploit and a zero day attack?

The terms- zero day vulnerability, zero day exploit and a zero day attack are often used interchangeably but they are not the same.

• A zero day vulnerability is simply a flaw that is discovered before the software vendor knows about it. There is no fix available for it.
• A zero day exploit indicates that the method to exploit the zero day vulnerability has been discovered.
• A zero day attack leverages zero day vulnerability to cause damage e.g. steal the data, bring down the systems.

The table below summarizes the differences between these terms:

Key quotes about zero day exploit:

• “Security is always going to be a cat and mouse game because there’ll be people out there that are hunting for the zero day award, you have people that don’t have configuration management, don’t have vulnerability management, don’t have patch management.”- Kevin Mitnick
• “A zero-day exploit is a method of hacking a system. It’s sort of a vulnerability that has an exploit written for it, sort of a key and a lock that go together to a given software package. It could be an internet web server. It could be Microsoft Office. It could be Adobe Reader or it could be Facebook.”- Edward Snowden