Zero-Day Vulnerabilities: How They Work, Notable Attacks and Ways to Reduce Risk
Summary
An explainer describes zero-day risks through examples including WannaCry, Stuxnet and Predator spyware, and discusses bug bounty programs, zero-day brokers, software updates and other ways to reduce exposure.
Key points
- The article defines zero-day vulnerabilities as flaws unknown to vendors and the wider IT community, leaving no fix available until they are discovered and addressed.
- It cites Microsoft’s November 2024 updates, which addressed 89 security flaws, including four newly revealed zero-days; the article says two were already being exploited.
- WannaCry used the leaked EternalBlue exploit to spread ransomware globally; the article notes that Microsoft had released a patch before the attack.
- The article says Apple issued emergency patches in September 2023 for three zero-days, which researchers linked to a Predator spyware exploit chain used against a former Egyptian parliament member.
- Bug bounty programs reward researchers for reporting vulnerabilities, while zero-day brokers may sell undisclosed flaws to buyers seeking covert access.
- The article recommends promptly installing software updates and using measures such as penetration testing, code reviews and responsible disclosure practices.
Article Details
- Topic
- Zero-day vulnerabilities and exploits, their role in cyberattacks, and defensive responses
CVE
CVE-2023-41991In late September 2023, Apple issued emergency patches addressing three zero-day vulnerabilities (CVE-2023-41992, CVE-2023-41991, and CVE-2023-41993) in iPhones and iPads.CVE-2023-41992In late September 2023, Apple issued emergency patches addressing three zero-day vulnerabilities (CVE-2023-41992, CVE-2023-41991, and CVE-2023-41993) in iPhones and iPads.CVE-2023-41993In late September 2023, Apple issued emergency patches addressing three zero-day vulnerabilities (CVE-2023-41992, CVE-2023-41991, and CVE-2023-41993) in iPhones and iPads.CVE-2024-43451CVE-2024-43451 is described by Microsoft as a zero-day which requires very little user interaction to expose a user’s password.
Malware
PredatorCitizen Lab’s research linked these zero-days to an exploit chain used by Cytrox’s Predator spyware.StuxnetStuxnet represents one of the most sophisticated uses of zero-day vulnerabilities in a real-world (not just theoretical).WannaCryThe WannaCry ransomware attack in May 2017 highlights the destructive potential of a zero-day exploit falling into the wrong hands.