5

A zero day vulnerability refers to a hole in software that is unknown to the vendor.

Since, zero day vulnerabilities are unknown can any estimation of amounts be made? What are possible scenarios to estimate the amount of zero-days? For example, based on experience with buying/selling zero day vulnerabilities.

I wonder how many undiscovered bugs there approximately are in the world and how many known zero day vulnerabilities with exploits there are approximately.

7
  • Do you mean zero days that someone has a working exploit for? Or undiscovered bugs in total.
    – paj28
    Mar 19, 2017 at 22:04
  • @paj28 both would be interesting numbers, I'll change the question.
    – Bob Ortiz
    Mar 19, 2017 at 22:06
  • 1
    For organizations such as the NSA, CIA, Mossad, PRC, a zero-day exploit has great value and is usually kept secret for their own personal use. These organizations have people whose sole job is to discover these for the organization's use. With that said, I am going to say any numbered published about 0days is not going to be reliable.
    – nd510
    Mar 19, 2017 at 22:41
  • @ncd275 Unreliable? More like flat out wrong. If those exploits are published, they aren't zero day anymore.
    – Aron
    Mar 20, 2017 at 2:10
  • If you are talking about unknown ones and are including any deployment of bad code on any number of poorly written websites or applications I would say Millions easily. If you are talking about ones only known to a few people or organizations there is truly no way to accurately know because we can't determine levels of effort spent finding them but there would be a huge gap between these two amounts. Mar 20, 2017 at 2:56

2 Answers 2

3

Vulnerabilities, in general, exist before they are found by researchers so the number already in existence but not yet known could be very high. As for known Vulnerabilities that would constitute Zero-Days where an exploit exists but are still held privately by a few people or organizations, there is really no way to know because too many of these organizations are very secretive for obvious reasons. It is too hard to speculate how much effort has been put into finding Zero-Days globally much less how productive those people or organizations have been at doing so.

That said the following Rand Corporation paper has a lot of very relevant information to your question.

Zero Days, Thousands of Nights "The Life and Times of Zero-Day Vulnerabilities and Their Exploits http://www.rand.org/content/dam/rand/pubs/research_reports/RR1700/RR1751/RAND_RR1751.pdf

Something to also keep in mind is there has been a lot of advances in fuzzing technology in the last few years which may make finding new zero-days easier for attackers.

0

We can approximate the number of unknown bugs from the number of known bugs. There aren't many reliable numbers on that, because vendors have different disclosure policies, so even the numbers we have are hard to compare. But when we're talking about security-relevant bugs, not just, say, cosmetics or usability, we can look at disclosed vulnerabilities and get an image, such as:

https://www.cvedetails.com/

(ignore the CVSS scores, CVSS is nonsense)

we also see the numbers over time: https://www.cvedetails.com/browse-by-date.php

and by vendor: https://www.cvedetails.com/top-50-vendors.php

We note that the number of vulnerabilities is going up over time, not down. Even looking at individual vendors over time, this is largely true. The question of whether this is because software is getting worse, there simply is more and more complex software, or people are more aggressively discovering and publishing bugs is for another day.

To estimate how many bugs are currently discovered but not publicly known, we would have to guess at the time between the first discovery by someone and the making public. That's pretty much impossible and it varies widely. We know about some high-profile vulnerabilities that they were known in certain circles for many months and sometimes several years. Other vulnerabilities have no known exploitations before they became public, so if someone knew about them before they played it very close to the chest. So all we can do is rough estimates.

Given this data, I believe it is safe to say that at any given moment, there is somewhere on the order of magnitude of 1,000 zero-days out there. Maybe this week it's only a few hundred, maybe in a bad month last year it was a few thousand, but somewhere in this order of magnitude. Breaking that down to the top vendors, it is probably safe to say that for any of the major players (like Microsoft, Apple, Google, IBM, Cisco, etc.) at any given time there are most likely one or several zero-days out there.

So in summary: No matter what, there is someone out there right now who could break into your systems if they really wanted to.

8
  • order of magnitude of 1,000 zero-days – Huh? It's far, far greater than that. And we really cannot possibly estimate the number based only on published vulnerabilities for countless reasons. How many vulnerabilities do you think have been published for ReactOS? Probably close to 0, but it almost certainly has more 0days than, say, VxWorks which has a lot of published vulns. A thousand for MS products alone is likely an underestimation.
    – forest
    Mar 10, 2021 at 8:04
  • @forest like I said, a rough estimate based on the available data. Anything beyond that would be speculation. You can certainly speculate, but if you can't back it up with data then it's just throwing something out there.
    – Tom
    Mar 10, 2021 at 8:05
  • @forest also, that is my estimate for the number RIGHT NOW. When some of them get published tomorrow, they aren't zero-days anymore. If you think of the 12k or so from 2019 as a rolling number, you'll come to such figures. (also also: fun fact: ReactOS has 1 CVE - cvedetails.com/product/10706/…)
    – Tom
    Mar 10, 2021 at 8:07
  • That's still a very low estimate. And your method for estimating it still isn't correct. You simply can't judge the number of unpatched vulnerabilities by the number of patched vulnerabilities. Case in point: A few years ago there was a talk at some security con comparing Linux, OpenBSD, FreeBSD, and NetBSD kernels. It showed that, despite Linux having far more CVEs, the code was a lot higher quality than any of the others and has less room for bugs. The developer's handling of security bugs and disclosure culture have more of an impact than the raw number of published bugs.
    – forest
    Mar 10, 2021 at 8:10
  • Also strictly speaking, a 0day does not need to be known by anyone to still be a 0day. The number of security bugs in Linux pre-2.4 that will never be discovered simply because no one cares about that anymore and natural code churn got rid of the vulnerable code before issues were found out is vast.
    – forest
    Mar 10, 2021 at 8:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .