A zero-day vulnerability is a flaw in software that the vendor does not know about. No patch exists. No fix is available. The name comes from the fact that developers have had zero days to address the problem before it gets exploited. From the moment an attacker discovers it to the moment a patch is released, every single system running that software is exposed.
That window can last hours. It can also last years.
Why Zero-Days Are Different#
Most cyberattacks exploit known vulnerabilities. A patch exists, but someone forgot to apply it. An update was available for months, but the IT team never got around to installing it. These attacks are preventable. Zero-days are not.
When an attacker has a zero-day, there is no signature for your antivirus to detect. There is no firewall rule that blocks it. There is no CVE entry that your vulnerability scanner can flag. The exploit works because nobody knows it exists.
This is what makes them so valuable. A working zero-day for a widely used system like Windows, iOS, or Chrome can be worth millions of dollars on the open market. Governments buy them. Intelligence agencies stockpile them. Criminal organizations trade them. And a small but lucrative industry exists specifically to find and sell them.
The Zero-Day Market#
There are three main markets for zero-day exploits:
The white market. Security researchers discover vulnerabilities and report them to the vendor through bug bounty programs or responsible disclosure. Companies like Google, Microsoft, and Apple pay bounties ranging from a few thousand dollars to over $200,000 for critical findings. This is the ethical path.
The gray market. Brokers like Zerodium openly advertise bounty prices for zero-days. As of recent years, Zerodium offered up to $2.5 million for a full chain iOS remote code execution exploit. Their customers are primarily government agencies and law enforcement. The exploits are not made public. They are used for surveillance and intelligence operations.
The black market. Criminal forums and dark web marketplaces where zero-days are sold to the highest bidder with no questions asked about intent. Prices vary wildly, but a reliable remote code execution exploit for a popular target can fetch six to seven figures.
The price gap tells the whole story. A researcher who reports a critical iOS bug to Apple through their bounty program might get $100,000. The same exploit sold to a broker could fetch $2 million. That 20x difference is why the zero-day market exists the way it does.
The Zero-Day Lifecycle#
Every zero-day follows a lifecycle:
- Discovery. Someone finds the bug. This could be a security researcher, a government hacker, a criminal, or even an automated fuzzing tool.
- Weaponization. The bug is turned into a working exploit. Not every vulnerability is exploitable, and not every exploit is reliable. This step requires significant skill.
- Deployment. The exploit is used against targets. This could be a targeted attack against a specific organization or a mass campaign.
- Detection. Eventually, someone notices. Maybe an incident response team finds suspicious behavior. Maybe the exploit gets captured by a honeypot. Maybe the attacker gets sloppy.
- Disclosure. The vulnerability is reported to the vendor.
- Patch. The vendor releases a fix.
- Adoption. Users actually install the patch. This step takes far longer than it should.
The danger zone is everything between step 1 and step 6. That is the window where the vulnerability exists, the attacker knows about it, and the vendor does not.
Real-World Zero-Days That Changed Everything#
Stuxnet (2010)#
Stuxnet is the most famous zero-day story ever told, and it used not one but four zero-day exploits simultaneously.
Stuxnet was a computer worm designed to sabotage Iran's nuclear enrichment program at the Natanz facility. It targeted Siemens Step 7 industrial control software that operated the centrifuges used to enrich uranium. The worm spread via infected USB drives, exploiting a Windows Shell LNK vulnerability (CVE-2010-2568) to execute code simply by viewing a folder containing a malicious shortcut file. No clicking required.
Once inside the network, it used additional zero-days to escalate privileges and spread laterally. When it finally reached the programmable logic controllers (PLCs) running the centrifuges, it subtly altered their rotation speeds. Too fast, then too slow. The centrifuges tore themselves apart over weeks and months while the monitoring systems showed everything was operating normally.
Stuxnet destroyed roughly 1,000 centrifuges and set Iran's nuclear program back by an estimated two years. It was widely attributed to a joint US-Israeli operation codenamed Olympic Games. It proved that cyber weapons could cause physical destruction, and it changed how every government on the planet thinks about offensive cyber capabilities.
EternalBlue and WannaCry (2017)#
EternalBlue was a zero-day exploit developed by the NSA targeting a vulnerability in Microsoft's SMB protocol (CVE-2017-0144). The NSA used it for intelligence operations for years. Then in April 2017, a group called the Shadow Brokers leaked the entire NSA exploit toolkit online.
Microsoft had actually patched the vulnerability (MS17-010) one month before the leak, suggesting they were tipped off. But patching takes time, and millions of systems were still unpatched when the WannaCry ransomware hit in May 2017.
WannaCry used EternalBlue to spread across networks automatically, encrypting files and demanding Bitcoin payment. In a single day, it infected over 200,000 computers across 150 countries. The UK's National Health Service was hit hard. Hospitals cancelled surgeries. Ambulances were diverted. Patient records were inaccessible.
A 22-year-old security researcher named Marcus Hutchins accidentally discovered a kill switch in the malware by registering an unregistered domain name that the worm checked before executing. That single domain registration stopped the global spread.
The lesson: when a government agency stockpiles zero-days instead of reporting them, the eventual leak can be catastrophic. The same exploit was later used by NotPetya, which caused over $10 billion in damages worldwide.
Log4Shell (2021)#
Log4Shell (CVE-2021-44228) was a remote code execution vulnerability in Apache Log4j, a Java logging library used by virtually every Java application on the planet. The vulnerability allowed an attacker to execute arbitrary code on a server simply by sending a specially crafted string in a log message.
The attack was absurdly simple. An attacker could put a malicious JNDI lookup string in any input field that eventually got logged: a username field, a search box, a User-Agent header, even an iPhone device name. When Log4j processed the string, it would reach out to an attacker-controlled server, download a Java class file, and execute it. Full remote code execution from a single string in a log entry.
The impact was massive because Log4j is everywhere. It is embedded in Apache Struts, Apache Solr, Apache Kafka, Elasticsearch, Minecraft servers, iCloud, Twitter, Steam, Amazon, Cloudflare, and thousands of other products. Many organizations did not even know they were running Log4j because it was buried deep inside third-party dependencies.
Patching was a nightmare. You could not just update one application. You had to find every instance of Log4j across your entire infrastructure, including transitive dependencies in libraries you did not directly control. Some organizations spent weeks just inventorying where Log4j existed in their systems.
Pegasus and NSO Group (2016-Present)#
Pegasus is commercial spyware developed by the Israeli company NSO Group. It uses chains of zero-day exploits to compromise iPhones and Android devices with zero user interaction. No link to click. No attachment to open. A single incoming iMessage or WhatsApp call, even one you never answered, could fully compromise your device.
Once installed, Pegasus can read every message, access every photo, activate the microphone, activate the camera, track GPS location, and extract passwords. The target has no idea it is there.
NSO Group sells Pegasus exclusively to government clients, claiming it is used for counterterrorism and law enforcement. But investigations by Citizen Lab, Amnesty International, and a consortium of journalists (the Pegasus Project) revealed that it was used to target journalists, human rights activists, lawyers, political dissidents, and even heads of state.
The zero-days used by Pegasus are some of the most sophisticated ever seen. Apple has repeatedly patched iOS vulnerabilities that were being actively exploited by Pegasus, including a FORCEDENTRY exploit in 2021 that bypassed Apple's BlastDoor sandbox using a flaw in the CoreGraphics PDF parser. The exploit worked by sending a malicious PDF disguised as a GIF through iMessage.
Apple eventually sued NSO Group, and the US government added NSO to its trade restriction list. But the spyware industry continues to operate, and new zero-click exploits continue to surface.
SolarWinds (2020)#
SolarWinds was not a traditional zero-day exploit. It was a supply chain attack, which in some ways is even more dangerous.
Attackers (attributed to Russia's SVR intelligence service) compromised the build system for SolarWinds Orion, a network monitoring tool used by over 30,000 organizations including most Fortune 500 companies and multiple US government agencies. They injected a backdoor called SUNBURST into a legitimate software update. When customers installed the update, they installed the backdoor.
The attack went undetected for roughly nine months. During that time, the attackers had access to the internal networks of the US Treasury Department, the Department of Homeland Security, the Department of Commerce, and major corporations including Microsoft and FireEye. FireEye actually discovered the breach when they noticed their own red team tools had been stolen.
The sophistication was remarkable. The SUNBURST backdoor was designed to blend in with normal Orion traffic. It used a domain generation algorithm to communicate with command and control servers. It checked for security tools and analysis environments before activating. And it was delivered through a trusted channel, a signed software update from a trusted vendor, which meant it bypassed every traditional security control.
Heartbleed (2014)#
Heartbleed (CVE-2014-0160) was a vulnerability in OpenSSL, the cryptographic library used by roughly two-thirds of all web servers at the time. It allowed anyone on the internet to read the memory of systems running vulnerable versions of OpenSSL.
The bug was in the TLS heartbeat extension. An attacker could send a malformed heartbeat request claiming to have a payload of up to 64KB, but actually sending almost nothing. The server would respond with 64KB of whatever happened to be in its memory at that location. This could include private keys, session tokens, usernames, passwords, or any other data the server was processing.
The vulnerability existed in OpenSSL for over two years before it was publicly disclosed. During that window, anyone who knew about it could silently extract sensitive data from any vulnerable server without leaving a trace.
The most chilling part: the exploit left no logs. There was no way to tell if your server had been compromised. After disclosure, many organizations had to assume they had been breached and rotate every certificate, password, and session token on their infrastructure.
What Can You Actually Do?#
You cannot prevent zero-day attacks. That is the whole point. But you can make them harder to exploit and limit the damage when they succeed:
Defense in depth. No single security control stops everything. Layer your defenses so that exploiting one vulnerability does not give an attacker full access to everything.
Patch fast. Once a zero-day becomes a known vulnerability, the clock is ticking. The window between public disclosure and widespread exploitation is getting shorter every year. Sometimes it is hours.
Network segmentation. Even if an attacker gets into your network, segmentation limits how far they can move. The Stuxnet and SolarWinds attacks both relied on lateral movement within flat networks.
Least privilege. Every user, every service, every application should have only the permissions it needs and nothing more. A zero-day exploit that lands in a low-privilege context is far less dangerous than one that lands with admin rights.
Monitor everything. You might not detect the exploit itself, but you can detect the behavior that follows. Unusual network connections, unexpected process execution, abnormal data access patterns. Behavioral detection catches what signature-based tools miss.
Assume breach. Design your systems and your incident response plans around the assumption that you will be compromised at some point. The question is not if, but when, and how quickly you detect and contain it.
Takeaway#
Zero-days are not theoretical. They are actively traded, actively exploited, and actively shaping geopolitics. Stuxnet destroyed physical infrastructure. WannaCry shut down hospitals. Pegasus surveilled journalists and activists. SolarWinds breached the most secure government networks on the planet.
The zero-day market is not going away. As long as software has bugs and those bugs have value, people will find them and people will sell them. The best we can do is build systems that are resilient enough to survive when the inevitable happens.
Comments (0)
Sign in to join the conversation