A zero-day (or zero-hour or day zero) attack or threat is an attack that exploits a previously unknown vulnerability in a computer application, meaning that the attack occurs on "day zero" of awareness of the vulnerability.

learn more… | top users | synonyms (1)

5
votes
3answers
593 views

Where can I get security breach alerts?

I've been following a mish-mash of Google News alerts as well as some 'security' influencers on Twitter, but have a feeling there's a more efficient way to deal with this out there...
2
votes
1answer
342 views

How does malware such as Stuxnet and Flamer propagate through USB memory sticks?

The best explanation I found is from this article but it still is unclear to me. Apparently a new vulnerability has been found involving .lnk files where when a folder on the memory stick containing ...
3
votes
1answer
135 views

Suddenly scans for 'formvars.php'

Suddenly, starting from about yesterday-evening (gmt+2), I get lots of -what I suspect are- 'hits' from bots that are looking variations of this file: /somerealpath/includes/formvars.php I'm ...
13
votes
1answer
945 views

SCADA / PLC exploit code was released in metasploit. Now what?

Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities. They say it's so easy, the ...
3
votes
2answers
198 views

How to demo a new 0-day security product?

We are a development team working on a new 0-day protection security product. We aim to protect against new unknown 0-days attacks against servers. We have a very strong solution ready to demo. The ...
9
votes
2answers
187 views

Encouraging security researchers to disclose vulnerabilities

What are approaches to forming solid relationships with security researchers? For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
14
votes
4answers
943 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
6
votes
2answers
3k views

Known security vulnerabilities in JBoss 4.x.x?

We just had a breach of one of our servers, where an intruder got access using the JBoss account and started running exploit scripts. The server has been taken offline and is being investigated, but ...
11
votes
5answers
313 views

What are the areas to focus on to protect users and devices?

What are the areas or technologies to focus on to protect users and devices? Are patching, antivirus and firewalls still the main areas? How do you defend against attacks against vulnerabilities ...
12
votes
3answers
2k views

How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?

There are several commercial exploit kits available containing 0day vulnerabilities: White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml Agora Exploit Pack ...
20
votes
5answers
3k views

Designing in zero day attack mitigations

What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?