In this lesson,
we're going to cover zero-day vulnerabilities and exploits.
First, we have a zero-day vulnerability.
A zero-day vulnerability is any vulnerability
that's discovered or exploited
before the vendor can issue a patch for it.
For example, if there's some kind
of a flaw in the Windows operating system
and Microsoft doesn't know about it,
but an attacker was able to figure it out,
this would be considered a zero-day vulnerability
because the vulnerability exists
but the manufacturer, in this case, Microsoft,
is not aware of that vulnerability.
Now, if a threat actor discovers a zero-day vulnerability,
this means they could develop an attack
or an exploit to target and victimize that vulnerability.
This is known as a zero-day exploit.
Now, a zero-day exploit is any unknown exploit in the wild
that exposes a previously unknown vulnerability
in the software or hardware
and this can create complicated problems for us
as cybersecurity professionals well before anyone realizes
that something is wrong.
When we're dealing with a zero-day vulnerability,
this is something that somebody found out in the wild
and they said, "Ah, I found a new way
to break into something."
And so as a technician, we are not going to be able
to detect that or stop it
because that attacker knows
there's a vulnerability in the system before we do.
This is why it's called a zero-day vulnerability,
zero-day exploit, or zero-day attack
because the attack will actually happen on day zero
or the first day
that this malicious code is being discovered.
This becomes a really big problem
because our traditional antivirus
and anti-malware software products don't have the signatures
to match up with that exploit yet
because it's brand new, it's the first time
that anybody has ever been targeted
with this type of an attack.
Now, when you're working in the field,
you'll often hear people use the term zero-day
in multiple different cases,
such as to refer to the vulnerability, the exploit, or both.
In the old days, zero-day simply referred
to the vulnerability itself.
But in recent years, people have started
to use the term zero-day to refer to this specific type
of malware that exploits a zero-day vulnerability.
You may see either term being used on the exam,
and when they talk about zero-day on the exam,
they may be talking about the vulnerability, the exploit,
or the malware.
So it's really important for you
to read the question in order
to understand the proper context of what they're describing.
Now, the next thing we have to think about
when we talk about this zero-day malware
is how serious is it?
Well, zero-day exploits are really big business.
These things cost a lot of money
and a lot of time to develop.
For example, if you become a bug bounty hunter
in the cybersecurity field later on
and you're able to discover a zero-day vulnerability,
you can actually get a lot of money for turning that over
to the company that developed the original software,
because they don't want those zero-days to be known about
and be on the open market.
Instead, they want to identify that, patch it, fix it,
and then make their software more secure.
Additionally, these zero-day vulnerabilities
and exploits are also sold to other government agencies,
law enforcement agencies,
and even to criminals on the dark web.
For example, some zero-day exploits in the past have sold
for hundreds or thousands of dollars.
Some have even sold for over a million dollars,
like one zero-day exploit
that was targeting Apple iPhones in earlier versions of iOS.
Now, as you can see, zero-day vulnerabilities
and their associated zero-day exploits
can be a really big business.
Now, because these zero-days cost so much money to acquire,
most threat actors will only exploit
a zero-day vulnerability for a very high-value attack.
Basically, they're going to save
and stockpile these zero-days
for a rainy day when they're going
after a really, really important target and not just going
after your grandmother's laptop.
Instead, most threat actors are going to try
to target known vulnerabilities first by using generic
or off-the-shelf malware.
If that attempt isn't successful on their desired target,
then they may choose to use one of their zero-days
against that target instead.
This is why it is so important
to always have an up-to-date antivirus software
on your system because those attempts
to exploit the known vulnerabilities
that they're trying first are going to be caught
by the antivirus and blocked.
This will give you a warning
that someone is targeting your system,
and that way you can better prepare yourself
to fend off a future attack.
Often, countries and nation states
are stockpiling these zero-days,
so they can use them as part of their spying
or espionage operations or other things
that are considered a high strategic value for them.
So keep in mind when we talk about zero-day vulnerabilities
and zero-day exploits, you're talking about a vulnerability
that is being exploited before the developer knows about it
and can release a software patch
or security fix for that vulnerability.
This makes them extremely destructive
because they cannot be stopped by traditional antivirus
or anti-malware solutions
because the signatures haven't been written yet
for those pieces of software.
Now, remember, when it comes to a zero-day, this means
that your system can be vulnerable for days, weeks,
or even years without you even knowing it
because the software developer themself doesn't know
that vulnerability exists
and therefore, they can't make a patch for it.