Zero Day Exploits: The Ugly Truths
Zero day exploits are software vulnerabilities that are unknown to the vendor and have no patch available, making them extremely dangerous. This article explains the uncomfortable realities of these exploits: why they are so valuable, who uses them, and why they inevitably get leaked or reused.
What Exactly Is a Zero Day?
A zero day is a vulnerability in software (operating system, browser, app, firmware) that the developer does not know about. The term “zero day” refers to the fact that the developer has had zero days to fix it. Until the vendor learns of it and issues a patch, every system running that software is exposed. A “zero day exploit” is the actual code or technique that takes advantage of that vulnerability to do something the developer never intended—run arbitrary code, escalate privileges, steal data, or spy on a user.
Once the vendor finds out, the clock starts: they scramble to develop and distribute a fix. But the exploit remains fully effective until every affected system applies that patch—and many never do.
Why Are Zero Days So Valuable?
Zero days are the crown jewels of the cyber world because they work against fully patched systems. That makes them worth a fortune on both legal and illegal markets.
- Governments: Intelligence agencies (e.g., the NSA, GCHQ, and counterparts in other countries) spend millions buying or developing zero days to spy on foreign leaders, military targets, and terrorist networks.
- Criminals: Ransomware gangs use zero days to breach high-value companies and demand huge payouts. A single zero day can be rented or sold for hundreds of thousands of dollars.
- Brokers: Companies like Zerodium openly buy zero days and resell them to governments. They publish price lists: a full-chain iPhone zero day has fetched over $2 million.
The value is so high because the exploit works against everyone—until it is burned. Once used in the wild, security researchers and vendors detect it, patch it, and the value drops to zero.
The Ugly Truth: They Get Burned Fast
The most uncomfortable fact about zero days is that they have a very short shelf life. The moment an exploit is used against a visible target, it is likely to be discovered. Security companies, antivirus vendors, and government defenders constantly monitor for unusual behavior. When they spot an attack using an unknown vulnerability, they reverse-engineer the exploit and report it to the vendor.
For example, a zero day used to attack a human rights activist is often caught quickly because the victim is under close monitoring. But an exploit used against a large company might remain hidden for months if the attackers are careful. Still, the average time from first use to public disclosure is often just a few weeks or days, not years.
This creates a brutal economics: you pay millions for a weapon that may work only once. That is why sophisticated attackers “burn” zero days only on high-value targets, not on random users.
Who Actually Uses Zero Days?
Zero days are not used by your average hacker. They are used by:
- Nation-state actors: Groups like Lazarus (North Korea), Fancy Bear (Russia), and Equation Group (NSA) have used zero days in espionage campaigns. Their targets: government networks, defense contractors, financial systems, and critical infrastructure.
- Cybercriminal syndicates: Ransomware groups like REvil and LockBit have purchased zero days to break into managed service providers (MSPs) and then push ransomware to all their clients.
- Private surveillance firms: Companies like NSO Group sell spyware (e.g., Pegasus) that exploits zero days in iOS and Android to infect journalists, lawyers, and dissidents.
What is striking is that these actors rarely write their own exploits. They buy them from independent researchers who either sell to the highest bidder or to legitimate brokers. The market is opaque, and the same exploit can end up in the hands of both a government and a criminal group.
The Leak Problem: Zero Days Never Die
Even after a zero day is patched, the exploit code does not disappear. It is often leaked, stolen, or reverse-engineered, and then reused against unpatched systems. The most famous case is the EternalBlue exploit, developed by the NSA to attack Windows. It was leaked in 2017 by a group called the Shadow Brokers. Within weeks, it was used in the WannaCry ransomware attack that hit hundreds of thousands of computers worldwide, including hospitals and factories.
Another ugly truth: many zero days are not reported to the vendor at all. Researchers who sell to governments may sign non-disclosure agreements that forbid them from ever telling the vendor. So the vulnerability remains open for years, even after the exploit has been used. When it is finally discovered, it may already be part of a criminal toolkit.
This “hoarding” problem is well known. Some argue that governments should disclose all zero days to vendors immediately, but they don’t, because they want to keep the capability. The result is that the public is left exposed to vulnerabilities that could have been patched years earlier.
How to Protect Yourself (Even Without a Patch)
You cannot patch a zero day, but you can reduce your attack surface. The following measures make you a harder target:
- Enable automatic updates: Even if you are not aware of a zero day, vendors often release “security updates” that silently fix it. The sooner you install them, the sooner you are protected.
- Use an up-to-date browser and OS: Modern browsers like Chrome and Edge have sandboxing and exploit mitigations that make zero days much harder to use.
- Disable macros and scripts: Many zero days are delivered via malicious Office documents or websites. Disabling macros and using a script blocker (like NoScript) can stop the attack before it starts.
- Segment your network: If one machine is compromised, segmentation prevents the attacker from moving laterally to your servers or other PCs.
- Back up your data: Ransomware attacks often use zero days. If you have offline backups, you can restore your files without paying.
Remember: zero days are rare and expensive. The vast majority of cyberattacks still exploit known vulnerabilities that were never patched. So the single most effective thing you can do is keep your software up to date.
Frequently Asked Questions
How long does a zero day stay effective?
It varies widely. Some zero days are used for years without detection, especially if they are used sparingly and only against high-value targets. Others are burned within days because they are used in a noisy attack that gets noticed. The average time from first use to public disclosure is roughly 30 days, but many are never disclosed and remain in use for years.
Can I find out if I was hit by a zero day?
Usually not directly. You may notice signs of a breach: unusual network traffic, new user accounts, or ransomware messages. However, sophisticated zero day attacks often leave no trace. If you suspect you were targeted, check your system logs, run a reputable antivirus scan, and consider a forensic analysis by a professional.
Why don’t vendors just test their software more?
Software is extremely complex. A modern operating system has millions of lines of code, and testing every possible input is impossible. Zero days often arise from subtle logic errors or interactions between components that no test suite covers. Even the best companies like Microsoft, Apple, and Google have zero days discovered in their products every year.
Is it legal to buy or sell zero days?
It depends on the country and the buyer. Selling to a government agency is often legal, though it may require export licenses. Selling to criminals is always illegal. Many security researchers choose to disclose vulnerabilities to the vendor through “bug bounty” programs, where they get paid for reporting the flaw rather than selling the exploit.
What is the difference between a zero day and a known vulnerability?
A known vulnerability has been publicly disclosed and has a patch or workaround available. A zero day is unknown to the vendor and has no patch. Once a zero day is disclosed and patched, it becomes a known vulnerability—but many systems remain unpatched for months, so attackers still use the old exploit code against them.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.