159

It's more likely that you'll burn a 0day by using it than by sitting on it. There's a fine balance between sitting on a 0day so long that it gets discovered by someone else and patched, and using it too early and unnecessarily, burning it. The balance tends to weigh in favor of waiting longer, since a good 0day is going to be obscure enough that it won't be ...


44

The person who discovers a security issue often reports it to the software vendor or developer first. This gives the software vendor time to fix the issue before publication. Then, after it is fixed, the bug is publicly disclosed. This process is called responsible disclosure. Sometimes, someone doesn't disclose the zero-day to the software vendor but uses ...


42

The 0 day depends on another vulnerability being discovered to be effectively used. For example you can't use a privilege escalation if you don't have code execution in the first place. This can also work the other way where you'd like another 0 day to chain after the one you currently have. The attacker doesn't have a worthy target to use it on. I'll also ...


37

You should request a CVE ID from MITRE (https://cve.mitre.org/cve/request_id.html), which is the responsible CNA for this. You can then disclose it on security mailing lists like Bugtraq or FullDisclosure. Security magazines and news sites might also be interested in the vulnerability. You can contact them directly and ask if they are interested to publish ...


34

When a 0day is published, how can an administrator secure his application/website between the time the 0day is published and the patch is developed ? They use temporary workarounds until a patch rolls out. When news of a 0day comes out, there are often various workarounds that are published which break the exploit by eliminating some prerequisite for ...


27

Because the old ways are the best. Why blow an expensive 0-day when you can just use a sweet SMBv1 attack or SQLi that will give you the same result? Using an 0-day can result in discovery from a forensics response reducing value and eliminating the number of targets it will be effective against.


21

From the standpoint of the attacker, a zero-day exploit is a valuable resource because it is not publicly known. This gives the attacker the element of surprise when it is actually deployed, as the target will not be able to proactively defend against it. Each time a zero-day is used, there's a chance it'll be discovered by the target and the vulnerability ...


12

Maybe an attacker with a 0day is waiting for a good opportunity. Most targets have their highs and lows. If one's goal is to wreck havoc, and make as much dammages as possible, then using a 0day immediately after uncovering it might not be the best idea. Some targets have frozen periods, where they lack manpower and must not touch their critical ...


10

When a zero-day is released or published, it comes with more than just a fancy name and icon. There are details about how the zero-day is used to exploit the system. Those details form the basis of the defender's response, including how the patch needs to be designed. For example, with WannaCry/EternalBlue, the vulnerability was found by the NSA and they ...


10

If you want to disclose a vulnerability I would suggest to contact the right CNA. You can find a list under this link. Now you can request a CVE ID and everything goes on if this vulnerability is really existing.


6

When a 0day is published, how can a whitehat secure his application/website between the time the 0day is published and the patch is developed? Sometimes there are workarounds which fix or mitigate the problem. Sometimes you can disable some feature or change some setting in the software which causes the exploit to not work anymore. For example, infection ...


6

This answer only touches on the process of selling 0days to resellers like Zerodium and is only guesswork. From the Zerodium FAQ: What happens after accepting an acquisition offer from ZERODIUM? After evaluating and approving the research, ZERODIUM will send you the final acquisition offer and the agreement to sign. By signing the agreement, ...


6

When you infect a computer and use a 0-day exploit, evidence of how you got in is often left behind. Preventing yourself from leaving any evidence is about as hard as having software that has no exploits in it; next to impossible. Many computer systems aren't patched regularly; on such a system, an old exploit will usually get you in just fine. This ...


5

Another reason is they can't use it (optimally) at the moment. Examples are: They might have a specific target like a diplomat in mind but the exploit requires to be in the same Ethernet-/WiFi-network or physical access. So they have to wait until this condition is met or arrange it so the condition is met. They don't have enough information about the ...


4

If I had the means to automatically detect a 0-day exploit in a piece of software, the vendor of that software has the same potential, thus these exploits would be caught before the software was ever released. Such things are done, of course, and they are called Source Code Analysis. They do exactly what you are trying to do: Automatically look for ...


3

Another key defense is monitoring, and knowing your system. Where are your valuable secrets, and who has access to them. If someone tries to connect to your mail server on port 80, red flag. Why is the mail server, all of a sudden, sending traffic to an unusual IP. The mail server now has 10x the traffic why? Monitor people connecting to your external ...


2

A 0-day exploit is an exploit which is not yet known to the public, specifically the vendor. As such, statistics about such exploits are difficult to make. But in order to make this answer more satisfactory, we can have a deeper look into how 0-day exploits are dealt with. When would you use a 0-day exploit? Most likely, you will use a 0-day exploit when ...


2

It depends on your definition of "exploit", what piece of software you're targeting, and where the bug is. For example, if I found a bug in Chrome's renderer (i.e. the thing that draws webpages on your screen) that gave me code execution, I'd only have code execution in the sandboxed context of the renderer process that runs in low integrity mode. I'd then ...


2

Relatively few hacks allow the attacker to break into a system. Most are "privilege escalation" bugs that allow an attacker to have greater control over the system after they have access to it. There are so many ways to achieve administrative control of a machine once a hacker has access to it, that it is more or less a waste of time to try to secure a ...


1

The best practise¹ would be to open them on a Virtual Machine (or even in a separate, physical machine that you could easily reimage after each use). On Qubes OS, the ability to open a PDF on a separate, disposable VM is (mainly) integrated in the system: How Qubes makes handling PDFs way safer They also include an option to create a trusted PDF, whiih ...


1

The problem is not only with zero-days. There are plenty of companies which still drag on 200-days patches for a multitude of reasons (some good, some bad). You have a large list of solutions, another one is to use virtual patching. It usually creates a mitigation for the issue before it hits the service (I learned about it years ago though a Trend Micro ...


Only top voted, non community-wiki answers of a minimum length are eligible