3 ms·

Can someone explain to me what "zero day" still means these days? I thought it was the time the developer was aware of the vulnerability, so once they're patchi

by mcv 5y ago

Can someone explain to me what "zero day" still means these days? I thought it was the time the developer was aware of the vulnerability, so once they're patching it or deciding not to patch it, it's by definition not a zero-day exploit anymore, isn't it? Or do I understand this completely wrong?

jedberg 5y ago
Nowadays a 0-day basically means the person who found it decided to exploit it instead of report it. So the company finds out because there is an active exploit instead of having it responsibly reported. It's shorthand for "an exploit that wasn't responsibly reported".
- creeble 5y ago
  Yes, it has essentially lost all meaning as most vulns are exploited before ever being reported. And even those who responsibly report them call them “0-days”, which is sort of true on the day they report them, but only if the company didn’t receive any other reports, and why would they divulge that information unless they had to, like to give someone else the bug bounty? “Sorry, it’s actually a 14-day, we’re working on the fix.” Right. So again, it’s lost any useful meaning I think.
  - jedberg 5y ago
    > as most vulns are exploited before ever being reported. I don't think that's even remotely true. And given that it's not true, it's still a useful distinction. 0-day means an exploit that is being exploited before it was reported to the vendor, which is different than most exploits, which are reported to the vendor first.
    - creeble 5y ago
      I guess it's true that most vulns are either reported to (or originate from) a vendor, and that these dominate the CVE db. But naturally, unless you are the vendor, you will likely not have heard of these. Otherwise, by definition, they would be zero-day vulns.
- Vladimof 5y ago
  > Nowadays a 0-day basically means the person who found it decided to exploit it instead of report it. So the company finds out because there is an active exploit instead of having it responsibly reported. Any vulnerability that was reported and not fixed could probably be considered one? Or any unfixed one for that matter (any widely exploitable vulnerability).
tylerhou 5y ago
I've always interpreted it as "zero days since a fix was released."
robotcookies 5y ago
I've always interpreted it as meaning no patch is available yet for a vulnerability. Does not matter whether a decision to patch or not has been made. Doesn't matter if it's been exploited yet.

by mcv 5y ago

jedberg 5y ago

Nowadays a 0-day basically means the person who found it decided to exploit it instead of report it. So the company finds out because there is an active exploit instead of having it responsibly reported. It's shorthand for "an exploit that wasn't responsibly reported".

creeble 5y ago
Yes, it has essentially lost all meaning as most vulns are exploited before ever being reported. And even those who responsibly report them call them “0-days”, which is sort of true on the day they report them, but only if the company didn’t receive any other reports, and why would they divulge that information unless they had to, like to give someone else the bug bounty? “Sorry, it’s actually a 14-day, we’re working on the fix.” Right. So again, it’s lost any useful meaning I think.
- jedberg 5y ago
  > as most vulns are exploited before ever being reported. I don't think that's even remotely true. And given that it's not true, it's still a useful distinction. 0-day means an exploit that is being exploited before it was reported to the vendor, which is different than most exploits, which are reported to the vendor first.
  - creeble 5y ago
    I guess it's true that most vulns are either reported to (or originate from) a vendor, and that these dominate the CVE db. But naturally, unless you are the vendor, you will likely not have heard of these. Otherwise, by definition, they would be zero-day vulns.
Vladimof 5y ago
> Nowadays a 0-day basically means the person who found it decided to exploit it instead of report it. So the company finds out because there is an active exploit instead of having it responsibly reported. Any vulnerability that was reported and not fixed could probably be considered one? Or any unfixed one for that matter (any widely exploitable vulnerability).

tylerhou 5y ago

I've always interpreted it as "zero days since a fix was released."

robotcookies 5y ago

I've always interpreted it as meaning no patch is available yet for a vulnerability. Does not matter whether a decision to patch or not has been made. Doesn't matter if it's been exploited yet.