A zero-day (or zero-hour or day zero) attack or threat is an attack that exploits a previously unknown vulnerability in a computer application, meaning that the attack occurs on "day zero" of awareness of the vulnerability.

learn more… | top users | synonyms (1)

11
votes
4answers
528 views

Unknown malware, how to report it and whom to report it to?

I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
4
votes
3answers
313 views

Where can I get security breach alerts?

I've been following a mish-mash of Google News alerts as well as some 'security' influencers on Twitter, but have a feeling there's a more efficient way to deal with this out there...
23
votes
3answers
2k views

Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this ...
27
votes
6answers
17k views

Heartbleed and Routers/ASAs/other

OK, so I first heard about heartbleed a few hours ago through the stack exchange questions feed, and after a moments panic, realised that the only web servers I have secured via OpenSSL are on the ...
6
votes
3answers
402 views

How to subscribe to information about new vulnerabilities in selected products?

In order to be informed about critical vulnerabilities in selected products I'd want to subscribe to some list about them. I'd want to configure the list of products by myself. The question: Where ...
19
votes
5answers
1k views

Designing in zero day attack mitigations

What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?
9
votes
1answer
974 views

Heartbleed how to find out applications using statically compiled version of openssl?

We're analysing issue at work and I wondering how to find out if there's any binary with a statically compiled version of openssl which includes this bug. Would it be possible to find a fingerprint ...
9
votes
2answers
127 views

Encouraging security researchers to disclose vulnerabilities

What are approaches to forming solid relationships with security researchers? For example, is publishing a public PGP key on the "contact us" page of a company's website for high levels of risk ...
13
votes
3answers
614 views

If I find or create a 0day exploit, can I be held liable for releasing out to the public?

If I found or created a 0day and decided to immediately release it into the wild (Giving a P.o.c w/ source). But not using it to actually exploit anything. Can I be held liable for it?