What are they: Zero Days

Put simply, a Zero-Day (O-Day) is a vulnerability or exploit that has been known to the developer for Zero Days. Essentially, it’s a brand new vulnerability.

Why are these important?

Typically, we see on the news headline something like “Apple patches zero-day vulnerability”. While these technically aren’t Zero-Days since the developer has known about them long enough to develop and release a patch, they refer a vulnerability that was once a zero-day implying that it was potentially used actively in the wild by attackers.

In the wild simply refers to outside of testing, such as something being actively exploited in the real world.

With the implied aspect of a zero-day being actively used in the real world on real people, it’s important that patches for these vulnerabilities are updated as soon as possible.

Zero-Day Vulnerability vs. Zero-Day Exploit

Vulnerability Zero-Day Vulnerabilities refer to vulnerabilities in the software that can be used by malicious attackers. These, however, are just vulnerabilities and doesn’t necessarily mean that they have been exploited, or have an exploit written for them.

Vulnerability vs Exploit: A vulnerability, for example, would be having a front door with a really bad lock that can be unlocked by keys that are pretty close to the real key. The exploit for this then, would be a key that is close (but not quite right) that still gets through the lock.

Exploit Zero-Day Exploits refer to the actual written exploits for a vulnerability; for example a key that was made to look like the real key, but still let them unlock the door. Comparing the severity of an exploit vs a vulnerability, an exploit is much more critical since the vulnerability simply indicates the possibility of an exploit. A bad door lock won’t necessarily mean someone is going to break into your house, but when those fake keys that work can be made, that’s when it’s more dangerous.