What Is a Zero-Day? The Race You Never See

In 2010, security researchers found a very strange computer worm. It had been built to sabotage centrifuges, the machines used to enrich uranium, and most of its infections were in Iran. To spread, it used four security holes that were still unknown, so no patch existed yet. Four zero-days. So what exactly is a zero-day, and why are they so dangerous?

A city of code

Every app on your phone is a city made of code. And sometimes that code contains flaws. Some of those mistakes leave a door open for attackers. A flaw like that is called a vulnerability. And a piece of code that uses it to break in is called an exploit.

Zero days to fix it

Normally, when a company learns about a flaw in its software, it can create a patch to fix it. But sometimes, the attackers find it first. Then the makers of the software have had zero days to fix it. That is a zero-day. Until it is fixed, attackers who know the flaw can use it against devices running that code.

Who hunts them

Who looks for zero-days? Security researchers, who report them so they can be fixed. And governments, the main users of zero-day exploits, which may buy them, use them in attacks, or stockpile them. That makes them valuable. In 2019, one exploit broker offered up to two and a half million dollars for a zero-click exploit chain against Android phones. And Google's Project Zero team counted fifty-eight zero-days used in real attacks in 2021 alone.

The race

Once a zero-day is discovered, a race begins. The maker can then write a patch, a fix that closes the hole. But criminals can reverse engineer that patch to find the flaw it fixes. Then they build an attack, often faster than people install the update. Until people install it, their devices stay vulnerable, even though the flaw is no longer a zero-day.

What you can do

No patch exists for a zero-day that nobody knows about. But you can keep the window short. Install updates as soon as they arrive, and turn on automatic updates. Give apps and accounts only the access they really need, so one hole does not open everything. And keep backups, so an attack costs you a bad day instead of everything. Because in the race between attackers and defenders, every day counts.