What is a Zero-day exploit?

On average it takes seven years for a zero-day exploit to be dis­covered. That means attackers can spy on busi­nesses and or­gan­isa­tions through security gaps in their ap­plic­a­tions over a period of seven years. The economic damage this can bring about is enormous.

This makes it all the more important for busi­nesses to take their IT security seriously and take measures to protect them­selves from such attacks.

The term “zero-day exploit” is based on the fact that a business has zero days to close a security gap before it becomes a danger because generally the company only notices the weak point in its software after the damage has been done. Attackers will have already dis­covered and made use of the security gap long before it is dis­covered to plant spyware or malware with the help of rootkits, Trojans and other tools.

Chro­no­logy of a zero-day exploit:

1. The developer programs software and writes code that in­ad­vert­ently contains a weak point (zero-day vul­ner­ab­il­ity) via which attackers can take in­form­a­tion or ma­nip­u­late systems.
2. An attacker finds the weak point before it becomes apparent to the company. Instead of notifying the company about the error, the hacker writes code (called exploit) to take advantage of the gap. The hacker may not use the code himself, but rather sell it on the black market, where he can get up to several thousands of pounds for it.
3. The company becomes aware of the zero-day exploit, whether by chance, customer feedback or a damage report. Only now can de­velopers create a security patch to close the gap. But the damage is (most likely) already done.

Gateways for exploits are mostly ap­plic­a­tions for major digital companies like Google, Apple, and Microsoft. Microsoft, in par­tic­u­lar, is a common target for zero-day attacks. This means that es­sen­tially all companies that use software by these providers are at risk.

The risk of falling victim to a zero-day exploit increases for busi­nesses as they become more suc­cess­ful because they more readily attract the attention of cy­ber­crim­in­als. However, small busi­nesses in very com­pet­it­ive in­dus­tries could become targets of exploits that are regularly used in in­dus­tri­al espionage.

Zero-day cy­ber­at­tacks are par­tic­u­larly dangerous because the hackers have a time advantage over their victim. Months and years could go by with attackers spying on companies and going unnoticed.

Anti-virus software doesn’t recognise these exploits because the attack patterns are unknown and so aren’t present in a database. When the weak point is finally found, the affected companies are unable to react im­me­di­ately, but have to wait for de­velopers to publish a security patch for the affected software. Only after in­stalling this patch, security is restored.

If the software man­u­fac­turer publishes a patch that, for whatever reason, is not installed by the company, the security gap remains.

Pro­tec­tion from zero-day exploits is difficult, but security measures can minimise the prob­ab­il­ity of them causing damage, even if an attack does take place.

While tra­di­tion­al anti-virus software isn’t effective against zero-day exploits because of the unknown virus signature, behaviour-based security solutions can provide effective help. Intrusion detection systems (IDS) and intrusion pre­ven­tion systems (IPS) monitor data movements and data access in the company with the help of al­gorithms and heur­ist­ics, and produce warning signals if anomalies are detected. Some of them auto­mat­ic­ally take coun­ter­meas­ures.

Busi­nesses can reduce the danger of data misuse by im­ple­ment­ing en­cryp­tion, au­thor­isa­tion systems, and checks.

Because any software could be the target of an exploit attack, the number of ap­plic­a­tions installed should be kept to a minimum. Companies should always use the most current version of a software and update software regularly (including available security updates). Ap­plic­a­tions that are not used should be removed from computers.

These measures can’t prevent an attack, but they can sig­ni­fic­antly reduce the risk of suffering financial damage through a zero-day exploit.