What is a zero-day attack, and can anything defend against it?

what is a zero day attack and can anything defend against it shutterstock 225772180
Image Credit: Shutterstock/GlebStock
The easiest way to describe a zero-day is to break it down into its component parts. We start out with “zero,” which is the number of “days” that a vulnerability in a popular piece of software or hardware has been known and has gone un-patched by the developers of the device or program that’s been exploited. A zero-day is a previously unknown threat, so there’s no patch to combat it.

Zero-days continue to represent one of the biggest thorns in the side of Internet security. Thorns that, while difficult to defend against directly, can still be avoided with a proper set of tools and techniques ready at your side.

Zero-Day 101

While of course time is of the essence in network security just as much as it is in any other industry, with zero-days, sometimes all the hours in the day wouldn’t be enough to stop the most enterprising and determined of hackers. These are people who know the ins-and-outs of networking equipment like it’s their job, because it is. The more vulnerabilities they discover, the more profit rolls in, either from selling the exploits to others directly or using them for their own ends.

And though they may not have the same amount of money or manpower to throw at the problem as the corporations they’re battling against, rough estimates (emphasis on “rough”) still put the current market value of all active zero-days at somewhere around three billion annually, which is certainly nothing to sneeze at.

Unfortunately, the whole reason zero-days are so profitable in the first place is because they’re so adept at getting past the defenses of routers, anti-virus software, and personal firewalls. People wouldn’t be willing to shell out the tens, even hundreds of thousands of dollars they do for each discovery if they didn’t think it would return that investment through stolen credit cards, broken bank accounts, or hijacked wire transfers.

A difficult defense

Luckily, there are still enough people willing to do the right thing in the world who are looking out for your best interests, and ask for little in return. In the world of professional bug-hunting, two organizations stand head and shoulders above the rest; the Zero Day Initiative (an independent vetting group run by the company TippingPoint and funded entirely through donations), and Google’s Project Zero.

Both rely on the network security community as a whole to come together for the greater good, contributing information on any zero days found in the ether and informing hardware manufacturers and software developers of the risk before it has a chance to snowball out of control.

Bad news for the rest of us: snowballing out of control is exactly what these exploits are designed to do, and so far we haven’t locked down a concrete method of predicting where the next big hack is going to hit next.  Even the once untouchable Apple has been subject to zero-day attacks.

The best defense

For now, your best bet to avoid zero-days is to remain in a constant state of vigilance. Follow these simple steps, and though you may never be 100% safe from the threat of zero-days, at the very least you can still reduce the possibility of running into one while trudging around all the less-reputable destinations the web has to offer.

First, always be sure that your AV software is updated to the most current virus definitions. This could be anything from a third-party vendor such as Kaspersky or Symantec, all the way down to Windows Update in Microsoft Windows. This is part of what Internet security gurus call “multiple-layer mitigation,” where the act of stacking up different styles of defensive mechanisms on top of each other creates multiple hoops the zero-day has to jump through before it can cause any real damage.

Continuing on this thread, never forget to keep the firmware of your home router up to date (one of the most common mistakes of the general consumer set), as networking equipment continues to be one of the highest prized targets for malicious actors looking for the next big zero-day attack

Next, you can never be too cautious of downloads, email attachments, or links that look even the least bit dodgy at face value. Unless you’re downloading a file from a widely-known reputable resource, always be sure to verify the source of before giving it the go ahead to transfer from an outside server to your home network

Finally, stay informed. Though the only central resource for tracking zero-days from a single location looks to have gone defunct since April of last year, (the blog at BeyondTrust), keeping a close eye on threat bulletins and developments in the security space has never been easier thanks to services like Twitter and Google News. Set up alerts for any news that breaks on the net with the word “zero-day” in the title, and follow companies who stay up to date on crucial cracks like @RSASecurity, @VirusBulletin, and the offices of @US-CERT

Full circle

So what’s the takeaway here? Are we forever doomed to live at the mercy of these hackers and their seemingly endless capacity for greed?

In the end, zero-days aren’t about engineers or programmers not having enough time to protect you, as much as they’re about hackers having all the time in the world to get past that protection for the profit waiting on the other side. It’s a constant game of cat and mouse, one where no real victor can claim the prize because the trophy is always one step ahead of both sides of the competition.

Since there have been banks, there have been robbers. As long as there’s money on the internet, there will be hackers. One uses a diamond steel-cutter to break through a safe, the other uses zero-days to lift bales of cash from the comfort of their computer chair. For now, the best we can do is actively fund organizations that are working to make better locks and build stronger doors to the vault.

It may not be a perfect system, but it’s the one we’ve got to work with today, for better or worse.


Here are all the awesome award-winning indie games from IGF

Indie games are now offering experiences capable of matching -- and often surpassing -- that of big-budget blockbuster titles. The Independent Games Festival recognized the best of them on March 20.
Home Theater

How to connect your Roku device to your hotel room’s TV

Staying at a hotel, but can't bear to be parted from your favorite streaming shows and movies? Take them with you with our complete guide to using your Roku on the road when staying at a hotel.

Secure your Excel documents with a password by following these quick steps

Excel documents are used by people and businesses all over the world. Given how often they contain sensitive information, it makes sense to keep them from the wrong eyes. Thankfully, it's easy to secure them with a password.

Windows updates shouldn't cause problems, but if they do, here's how to fix them

Windows update not working? It's a more common problem than you might think. Fortunately, there are a few steps you can take to troubleshoot it and in this guide we'll break them down for you step by step.

Get the most out of your high-resolution display by tweaking its DPI scaling

Windows 10 has gotten much better than earlier versions at supporting today's high-resolution displays. If you want to get the best out of your monitor, then check out our guide on how to adjust high-DPI scaling in Windows 10.

Got gadgets galore? Keep them charged up with the 10 best USB-C cables

We're glad to see that USB-C is quickly becoming the norm. That's why we've rounded up some of the better USB-C cables on the market, whether you're looking to charge or sync your smartphone. We've got USB-C to USB-C and USB-C to USB-A.

Looking for a Chromebook? The Google PixelBook just got a $200 price cut

Once relatively obscure, Chromebooks have come into their own in a big way in recent years. One of our favorites is the super-sleek Google Pixelbook, and it's on sale right now from Amazon for $200 off, letting you score this premium laptop…

Nvidia’s GTX 1650 graphics card could be just a slight upgrade over the 1050 Ti

Rumors suggest Nvidia might soon launch the GTX 1650, and a leaked benchmark listing from Final Fantasy XV suggests that the new graphics card could be just a slight upgrade over last generation's GTX 1050 Ti. 

Get ready to say goodbye to some IFTTT support in Gmail by March 31

If This Then That, the popular automation service, will drop some of its support for Gmail by March 31. The decision comes as a response to security concerns and is aimed to protect user data.

Get the new Dell XPS 13 for $750 with this limited-time deal

Dell is currently running a limited time deal lasting through Thursday, March 28, where you can bring home a version of this year's new XPS 13 for around $750 with the use of a special coupon code. 

This is the easiest way to save your iPhone data to your computer

Living in fear of losing your contacts, photos, messages, and notes on your iPhone? Fear no more -- in this guide, we'll break down exactly how to back up your iPhone to your computer using Apple's iTunes or to the cloud with iCloud.

Here are the best iPad Pro keyboard cases to pick up with your new tablet

The iPad Pro range can double as laptops, but they do need proper keyboards to fill in effectively. Thankfully, there are loads to choose from and we rounded up the best iPad Pro keyboard cases right here.

Microsoft’s Clippy came back from the dead, but didn’t last very long

Before Cortana, Alexa, and Siri even existed, Microsoft Clippy dominated the screens of computers in the 1990s to help assist Microsoft Office users when writing letters. He recently made a bit of a comeback only to die off again.

Nvidia faces attacks from AMD, Intel, and even Google. Should it be worried?

Nvidia announced an expanded array of RTX server solutions designed to leverage the power of ray-tracing at GTC 2019. The effort will help Nvidia take on Google's Stadia in game streaming with GeForce Now, and the company's investments in…