Zero-day (computing)

In computing, a Zero-Day vulnerability (or "exploit") is a security hole in software which can permit unauthorized access, of which the software publisher has no knowledge. Such vulnerabilities are given this name because the software developers (and the security community in general) have known about the issue for "zero days." Once discovered, the publisher will usually rush to patch the vulnerability before it can be exploited any more that it already has been. Once a patch has been released, the vulnerability is no longer called a "zero-day" but may still be viable for some attacks for a time. Some copies of the vulnerable software can remain unpatched for quite some time, leaving those vulnerable. In some cases, the patches themselves put out-of-date systems at risk, since new attackers can learn of the vulnerabilities by analyzing the patches themselves. Zero-day vulnerabilities can exist in operating systems and programs alike.

Protection

It is difficult to protect from a zero-day exploit by its very nature. However, there are a few important steps to help reduce risk. Developers should, of course, work to test and analyze their own software on a regular basis to find such vulnerabilities. Users have much less control, but can still do two things to help keep them safe. First, apply all patches and updates as seen as possible. Once released, updates protect their users, but put those who have not updated at greater risk. Secondly, using anti-virus software with heuristic detection can help block attacks. Although the vulnerability will still exist, the anti-virus software can sometimes block malicious code delivered through it based solely on its behavior, thus stopping that particular attack.