What the Heck are Zero-Day Attacks? (And 3 Ways to Avoid Them)

If you look for the term zero-day attack in your home dictionary, you probably won’t find it.

Go ahead and check…I’ll wait.

You might not even find the term in some online dictionaries (though to be fair, it does appear in others.).

Nevertheless, if you google the term, you’ll find thousands of references to it, many of them from mainstream sources including Forbes, Time, and USA Today. So what’s the deal? If the term is so important, why isn’t in the dictionary yet?

As with so many computer-related terms, the phrase zero-day attack has recently crept into the lexicon of the common person, after being used by technical types for more than a decade. Also known as 0day attacks, zero-hour attacks and 0hour attacks, these are attacks that exploit a vulnerability in a computer application or program.

A vulnerability, by the way, is simply an error in a software that could be exploited. It isn’t a problem in itself, and it isn’t something that stops an application or program from working properly. However, if a vulnerability is discovered by a hacker, and if the hacker uses the vulnerability to conduct nefarious activities, then the moment these nefarious activities are discovered, it is known as a zero-day attack.

Hackers look for vulnerabilities that they can exploit.

Hackers look for vulnerabilities that they can exploit.

The term zero-day stems from the fact that developers have had zero time to defend their software against the attack. From the moment it is revealed, developers must work quickly to fix the vulnerability and stop the damage from spreading.

There are several related terms, by the way, including zero-day vulnerability (a vulnerability that has been revealed to the public at large – including both hackers and developers – and could lead to a zero-day attack unless fixed) and a zero-day exploit (an effort by a hacker to exploit a vulnerability on the same day that it is revealed to the public). Prior to these zero-day events, developers have had zero time to do anything. Once the vulnerability is revealed, developers are pressed to find fixes (known as patches) before exploitation can occur.

A Short History of Zero-Day Attacks

There have been scores of reports about zero-day vulnerabilities, exploits, and out-and-out attacks in the news recently. After all, that’s why you’re reading this blog right? Some major zero-day events include the following.

If that looks like a worrisome shopping list of trouble – it is. And experts warn that things are getting worse. From 2006 to 2012, the number of zero-day attacks varied between 8 and 14 each year. By 2014, the number had increased to 25.

Things aren’t getting better because the business of hacking people’s computers is becoming increasingly lucrative. Indeed, there is a serious underground market for buying and selling knowledge about vulnerabilities. This knowledge, when purchased by software developers, can enable vulnerabilities to be repaired without any damage to the software, its users, or a company’s reputation. However, if this knowledge is sold to bad guys, the vulnerability can be used to cause extensive and wide-ranging damage.

3 Ways to Avoid Zero-Day Attacks

You don’t need to be an IT expert to protect yourself against zero-day attacks. Just by reading this blog, in fact, you’re one step closer to protecting yourself. Because the more you know about dangers on the internet, the better you’ll be able to protect yourself.

Update your Antivirus

Choose a top-notch antivirus that protects against both known and unknown threats.

1. Use a top-notch antivirus.
The first thing you can do is get yourself an excellent antivirus. Make sure the antivirus you choose doesn’t just protect against known threats, since zero-day attacks are, by definitions, attacks that were not known just one day earlier. So when you choose your antivirus software, make sure it protects you from both known and unknown attacks. At ZoneAlarm, we call this process Threat Emulation, and it means email attachments and downloads are tested for threats in a safe, cloud-based environment before being allowed to enter your computer.

 

2. Update your software.
Another important way of protecting yourself against zero-day attacks is to make sure that you use the most updated version of your software. If software you trust sends you a notice to update your version, do it. If the software update explains that this a critical update (it may be referred to as a “critical security release” or similar), believe them. The update may include a patch to a recently discovered vulnerability. By updating your software, you immunize yourself against possible future infections through that vulnerability.

Many software vendors automatically update your software for you. Windows, for example, automatically installs important and recommended updates to your Windows software. While it is possible to turn off these automatic updates, it is highly recommended that you don’t, as they protect you from potentially dangerous security and reliability issues.

3. Use only updated browsers.
Firefox, Chrome and Internet Explorer all push out automatic updates of their browsers on a regular basis. These updates, which often include patches to newly discovered vulnerabilities, generally take place in the background. The updates are installed when you close and reopen your browser, and won’t disturb your use of the browser at all.

If you’ve left your browser open for several days, you might see your browser prompt you to update manually. For example, in Chrome, you’ll see the colors of the Chrome menu in the top right corner switch to green, orange or red. This is a subtle reminder to update your Chrome browser, and this can be done through the Chrome menu. Make sure you click Restart afterwards so the changes are applied.

An ounce of prevention…

Protecting yourself online isn’t much different from protecting yourself in other aspects of life.
You buckle up your safety belt BEFORE you start driving.
You buy travel insurance BEFORE you board the plane.
You set your alarm clock BEFORE your 9 a.m. job interview.

When it comes to the internet, protecting yourself from online threats also requires advance planning. Make sure your antivirus is powerful and up-to-date. Make sure your browsers and software are up-to-date.

What precautions do you take in your online life to prevent unseen hazards?

 

How Secure is Your WiFi-Enabled Camera?

eye in camera_header

In this day and age, digital cameras such as still image and video recording cameras, home surveillance devices, and baby monitors all come with WiFi capabilities. While there are benefits of WiFi-enabled cameras, unfortunately, there’s also the potential for security concerns. For example, just in November 2014, the BBC reported that a Russian website displayed live feeds from private webcams, baby monitors, and CCTV systems from more than 250 countries to prove how easy it can be for attackers to access these cameras.
Continue Reading… How Secure is Your WiFi-Enabled Camera?

Are You Being Watched Through Your Webcam?

Hacked webcam_404_header2
A few clicks of the mouse, and your webcam is activated and ready to be used. But have you considered the possibility that someone else could be watching you through your own webcam? The thought of this probably sends chills down your spine, and it should, as this is very real- and extremely creepy.
Continue Reading Are You Being Watched Through Your Webcam?