3 ms·
There is "zero day" mentioned in the title, but nothing in the article text. I am confused: what does this has to do with "zero day" now? It's not "zero day" no
by watt 6y ago
There is "zero day" mentioned in the title, but nothing in the article text. I am confused: what does this has to do with "zero day" now? It's not "zero day" now, is it.
- biddlesby 6y agoYeah, it’s really confusing. Unless I don’t understand the term, it hasn’t been a zero day vulnerability for the past two years...
- PeterisP 6y agoThe days are counted from the release of a fix. If something been known for two years but a fix was released on 11th August, then it was a zero-day for the two years until 11th August and it's a "day-6" vulnerability today. IIRC the term was introduced to contrast with day-1 attacks with exploits developed by reverse engineering patches on the day they are released and attempting to exploit systems in the gap until they get patched.
- biddlesby 6y agoI see. Thank you for the explanation!
- gerdesj 6y agoIt isn't zero day now but it was for at least two years. That rather stretches the definition of zero day but for two years Windows machines have been vulnerable to something nasty that was known about.
- fulafel 6y agoIt was a bug in the third party scanning products though. ("This behaviour could be used to hide and distribute malicious code in MSI signed files, in fact several security solutions rely on the output of Microsoft Windows code signing validation to avoid an in-depth scan").