What is a zero-day attack, and can anything defend against it?

what is a zero day attack and can anything defend against it shutterstock 225772180
Image Credit: Shutterstock/GlebStock
The easiest way to describe a zero-day is to break it down into its component parts. We start out with “zero,” which is the number of “days” that a vulnerability in a popular piece of software or hardware has been known and has gone un-patched by the developers of the device or program that’s been exploited. A zero-day is a previously unknown threat, so there’s no patch to combat it.

Zero-days continue to represent one of the biggest thorns in the side of Internet security. Thorns that, while difficult to defend against directly, can still be avoided with a proper set of tools and techniques ready at your side.

Zero-Day 101

While of course time is of the essence in network security just as much as it is in any other industry, with zero-days, sometimes all the hours in the day wouldn’t be enough to stop the most enterprising and determined of hackers. These are people who know the ins-and-outs of networking equipment like it’s their job, because it is. The more vulnerabilities they discover, the more profit rolls in, either from selling the exploits to others directly or using them for their own ends.

And though they may not have the same amount of money or manpower to throw at the problem as the corporations they’re battling against, rough estimates (emphasis on “rough”) still put the current market value of all active zero-days at somewhere around three billion annually, which is certainly nothing to sneeze at.

Unfortunately, the whole reason zero-days are so profitable in the first place is because they’re so adept at getting past the defenses of routers, anti-virus software, and personal firewalls. People wouldn’t be willing to shell out the tens, even hundreds of thousands of dollars they do for each discovery if they didn’t think it would return that investment through stolen credit cards, broken bank accounts, or hijacked wire transfers.

A difficult defense

Luckily, there are still enough people willing to do the right thing in the world who are looking out for your best interests, and ask for little in return. In the world of professional bug-hunting, two organizations stand head and shoulders above the rest; the Zero Day Initiative (an independent vetting group run by the company TippingPoint and funded entirely through donations), and Google’s Project Zero.

Both rely on the network security community as a whole to come together for the greater good, contributing information on any zero days found in the ether and informing hardware manufacturers and software developers of the risk before it has a chance to snowball out of control.

Bad news for the rest of us: snowballing out of control is exactly what these exploits are designed to do, and so far we haven’t locked down a concrete method of predicting where the next big hack is going to hit next.  Even the once untouchable Apple has been subject to zero-day attacks.

The best defense

For now, your best bet to avoid zero-days is to remain in a constant state of vigilance. Follow these simple steps, and though you may never be 100% safe from the threat of zero-days, at the very least you can still reduce the possibility of running into one while trudging around all the less-reputable destinations the web has to offer.

First, always be sure that your AV software is updated to the most current virus definitions. This could be anything from a third-party vendor such as Kaspersky or Symantec, all the way down to Windows Update in Microsoft Windows. This is part of what Internet security gurus call “multiple-layer mitigation,” where the act of stacking up different styles of defensive mechanisms on top of each other creates multiple hoops the zero-day has to jump through before it can cause any real damage.

Continuing on this thread, never forget to keep the firmware of your home router up to date (one of the most common mistakes of the general consumer set), as networking equipment continues to be one of the highest prized targets for malicious actors looking for the next big zero-day attack

Next, you can never be too cautious of downloads, email attachments, or links that look even the least bit dodgy at face value. Unless you’re downloading a file from a widely-known reputable resource, always be sure to verify the source of before giving it the go ahead to transfer from an outside server to your home network

Finally, stay informed. Though the only central resource for tracking zero-days from a single location looks to have gone defunct since April of last year, (the blog at BeyondTrust), keeping a close eye on threat bulletins and developments in the security space has never been easier thanks to services like Twitter and Google News. Set up alerts for any news that breaks on the net with the word “zero-day” in the title, and follow companies who stay up to date on crucial cracks like @RSASecurity, @VirusBulletin, and the offices of @US-CERT

Full circle

So what’s the takeaway here? Are we forever doomed to live at the mercy of these hackers and their seemingly endless capacity for greed?

In the end, zero-days aren’t about engineers or programmers not having enough time to protect you, as much as they’re about hackers having all the time in the world to get past that protection for the profit waiting on the other side. It’s a constant game of cat and mouse, one where no real victor can claim the prize because the trophy is always one step ahead of both sides of the competition.

Since there have been banks, there have been robbers. As long as there’s money on the internet, there will be hackers. One uses a diamond steel-cutter to break through a safe, the other uses zero-days to lift bales of cash from the comfort of their computer chair. For now, the best we can do is actively fund organizations that are working to make better locks and build stronger doors to the vault.

It may not be a perfect system, but it’s the one we’ve got to work with today, for better or worse.

Deals

The Dell G5587 gaming laptop is on sale for one of the lowest prices we’ve seen

Even diehard desktop PC gamers have to admit that gaming laptops have come a long way in recent years, and the beefy Dell G5587 – now on sale from Walmart for $300 off – is a solid sub-$1,000 machine for work and play.
Home Theater

Here's how to turn off subtitles on Netflix, no matter the device

Subtitles are great if you want or need them, but they can be a major headache if you’ve somehow turned them on by accident and can’t figure out how to get rid of them. Don't worry, it's not as complicated as it seems.
Gaming

How to share your best gaming moments with friends on the PS4

Check out Digital Trends' quick guide to everything you need to know to save your outstanding PlayStation 4 gameplay moments, share them online, and transfer them to your computer.
Gaming

Have an issue with your 3DS? We can help you fix it with these common solutions

The Nintendo 3DS has seen its fair share of issues since it launched in 2011, including poor battery life and fragile Circle Pads. Here are some of the most common, as well as the steps you can take to solve them.
Mobile

The 100 best Android apps turn your phone into a jack-of-all-trades

Choosing which apps to download is tricky, especially given how enormous and cluttered the Google Play Store has become. We rounded up 100 of the best Android apps and divided them neatly, with each suited for a different occasion.
Computing

HP’s new Zbook, EliteBook 800 workstations go 4K with 8th-gen Intel CPUs

HP's new line of workstation laptops includes some seriously durable EliteBook and ZBook designs, with options for high-end, eighth-generation Intel CPUs, 2TB of storage, and discrete AMD Radeon graphics chips.
Product Review

You won't buy Microsoft's Surface Hub 2S, but it could still change your life

The Microsoft Surface Hub 2S wants to change the way you collaborate at work. That’s a lofty goal most devices fail to achieve, but the unique Hub 2S could be an exception. And trust us – you’re going to want it.
Computing

Light up your external GPU with Razer’s new Core X Chroma enclosure

The Razer Core X Chroma external graphics card enclosure is big enough for three-slot graphics cards, with enough space for a 700w PSU and it brings back the RGB lighting of the Core V2 — all for the same price as its predecessor.
Computing

Microsoft accelerates carbon reduction plans in new sustainability push

Microsoft wants to accelerate its sustainability goal of becoming a zero-carbon company. To reach those goals, Microsoft is doubling its self-imposed carbon tax to incentivize business divisions in making sustainable choices.
Computing

MacOS update may include external display support for iPads

Apple's upcoming MacOS is rumored to include a new native external display support feature. Code-named "Sidecar" the new feature is expected to allow MacOS computers to send app windows to external displays like iPads.
Deals

Apple’s MacBook laptop is on sale for just $800 for a limited time

If you have your heart set on a MacOS-powered laptop, B&H has a sale on Apple's MacBook that takes the price down to $800. Only select models are on sale right now, but you can score up to a $600 savings if you act quickly.
Computing

AMD could offer ray tracing with next-gen Navi graphics cards

Navi is the next-generation graphics card line from AMD and it's coming in just a couple of months time. When it does arrive, one of its major features may be ray tracing, which has to date been an Nvidia-exclusive feature.
Features

Exclusive: The Surface Hub 2S will revolutionize work. Here’s how it was made

Exclusive interviews with the designers, futurists, and visionaries behind the Surface Hub 2 paint a dramatic picture of how Microsoft thinks collaboration will change your office.
Computing

Meet the mastermind behind Microsoft's massive new Surface Hub

Microsoft Chief Product Officer Panos Panay gives us an exclusive peek at the 85-inch Surface Hub 2, and explains how innovation and collaboration will transform your workplace.