The easiest way to describe a zero-day is to break it down into its component parts. We start out with “zero,” which is the number of “days” that a vulnerability in a popular piece of software or hardware has been known and has gone un-patched by the developers of the device or program that’s been exploited. A zero-day is a previously unknown threat, so there’s no patch to combat it.
Zero-days continue to represent one of the biggest thorns in the side of Internet security. Thorns that, while difficult to defend against directly, can still be avoided with a proper set of tools and techniques ready at your side.
Zero-Day 101
While of course time is of the essence in network security just as much as it is in any other industry, with zero-days, sometimes all the hours in the day wouldn’t be enough to stop the most enterprising and determined of hackers. These are people who know the ins-and-outs of networking equipment like it’s their job, because it is. The more vulnerabilities they discover, the more profit rolls in, either from selling the exploits to others directly or using them for their own ends.
And though they may not have the same amount of money or manpower to throw at the problem as the corporations they’re battling against, rough estimates (emphasis on “rough”) still put the current market value of all active zero-days at somewhere around three billion annually, which is certainly nothing to sneeze at.
Unfortunately, the whole reason zero-days are so profitable in the first place is because they’re so adept at getting past the defenses of routers, anti-virus software, and personal firewalls. People wouldn’t be willing to shell out the tens, even hundreds of thousands of dollars they do for each discovery if they didn’t think it would return that investment through stolen credit cards, broken bank accounts, or hijacked wire transfers.
A difficult defense
Luckily, there are still enough people willing to do the right thing in the world who are looking out for your best interests, and ask for little in return. In the world of professional bug-hunting, two organizations stand head and shoulders above the rest; the Zero Day Initiative (an independent vetting group run by the company TippingPoint and funded entirely through donations), and Google’s Project Zero.
Both rely on the network security community as a whole to come together for the greater good, contributing information on any zero days found in the ether and informing hardware manufacturers and software developers of the risk before it has a chance to snowball out of control.
Bad news for the rest of us: snowballing out of control is exactly what these exploits are designed to do, and so far we haven’t locked down a concrete method of predicting where the next big hack is going to hit next. Even the once untouchable Apple has been subject to zero-day attacks.
The best defense
For now, your best bet to avoid zero-days is to remain in a constant state of vigilance. Follow these simple steps, and though you may never be 100% safe from the threat of zero-days, at the very least you can still reduce the possibility of running into one while trudging around all the less-reputable destinations the web has to offer.
First, always be sure that your AV software is updated to the most current virus definitions. This could be anything from a third-party vendor such as Kaspersky or Symantec, all the way down to Windows Update in Microsoft Windows. This is part of what Internet security gurus call “multiple-layer mitigation,” where the act of stacking up different styles of defensive mechanisms on top of each other creates multiple hoops the zero-day has to jump through before it can cause any real damage.
Continuing on this thread, never forget to keep the firmware of your home router up to date (one of the most common mistakes of the general consumer set), as networking equipment continues to be one of the highest prized targets for malicious actors looking for the next big zero-day attack
Next, you can never be too cautious of downloads, email attachments, or links that look even the least bit dodgy at face value. Unless you’re downloading a file from a widely-known reputable resource, always be sure to verify the source of before giving it the go ahead to transfer from an outside server to your home network
Finally, stay informed. Though the only central resource for tracking zero-days from a single location looks to have gone defunct since April of last year, (the blog at BeyondTrust), keeping a close eye on threat bulletins and developments in the security space has never been easier thanks to services like Twitter and Google News. Set up alerts for any news that breaks on the net with the word “zero-day” in the title, and follow companies who stay up to date on crucial cracks like @RSASecurity, @VirusBulletin, and the offices of @US-CERT
Full circle
So what’s the takeaway here? Are we forever doomed to live at the mercy of these hackers and their seemingly endless capacity for greed?
In the end, zero-days aren’t about engineers or programmers not having enough time to protect you, as much as they’re about hackers having all the time in the world to get past that protection for the profit waiting on the other side. It’s a constant game of cat and mouse, one where no real victor can claim the prize because the trophy is always one step ahead of both sides of the competition.
Since there have been banks, there have been robbers. As long as there’s money on the internet, there will be hackers. One uses a diamond steel-cutter to break through a safe, the other uses zero-days to lift bales of cash from the comfort of their computer chair. For now, the best we can do is actively fund organizations that are working to make better locks and build stronger doors to the vault.
It may not be a perfect system, but it’s the one we’ve got to work with today, for better or worse.
