3 ms·

Zero-day was coined to describe malware being found in the wild that exploits a previously unknown vulnerability. The terminology is literally referring to the

by roc 14y ago

Zero-day was coined to describe malware being found in the wild that exploits a previously unknown vulnerability. The terminology is literally referring to there being zero days between discovery of a vulnerability and discovery of malware in the wild that exploits it. They are prized in the black hat community specifically because they've never been disclosed and thus no-one has had any chance to patch the vulnerability. In this case the vulnerability was known and unpatched for three months. It was more like a 90-day exploit than a 0-day exploit.

lawnchair_larry 14y ago
That's not correct. We found and traded 0day exploits (referring to them as 0day at the time) on irc long before malware was exploiting it. Malware using 0day is a very new thing, and the advent of that certainly isn't when the term was coined. The term actually originates in the warez scene, referring to the days prior to RTM of some software. It was adopted in the hacker scene in the early 90s. And that doesn't make sense anyway. It was obviously known to someone if malware was written. These aren't found and written by skynet. I've been around since about as long as the term was used, and long before the media used it, and it was universally understood to mean something that wasn't patched. Over time, more and more people would know about the 0day. So what number are you using for "unknown"? 1 person knows about it? A hacker group? 2 hacker groups, because one of them stole it from the other? Or is that semi-0day? The zero days is between when it exists and when it is patched, even if it ends up on full disclosure or bugtraq. When it did hit a list, its status goes from "private" to "public", but this is orthogonal to its 0day status. Ask tptacek, he was around back then ;) According to that nytimes article, comex is 20 +/- 1 year, so I forgive him ;)
- roc 14y ago
  > "The term actually originates in the warez scene" A full etymology would certainly be interesting, but I was trying to stick to the subject matter at hand. > "It was obviously known to someone if malware was written." Again, in the context of security, 'known' -- at least as far as I've ever heard it used -- is shorthand for known to the security-minded public and/or to the vendor. It could be known to a million black-hats writing a million exploits and that still counts as 'unknown' until the day someone discloses it to the wider public and/or the vendor.
  - lawnchair_larry 14y ago
    "A full etymology would certainly be interesting, but I was trying to stick to the subject matter at hand." The point is that you said it was "coined" to describe malware usage. In fact that was neither the first use of the term in this context, nor where the term originated at all.

by roc 14y ago

lawnchair_larry 14y ago

That's not correct. We found and traded 0day exploits (referring to them as 0day at the time) on irc long before malware was exploiting it. Malware using 0day is a very new thing, and the advent of that certainly isn't when the term was coined. The term actually originates in the warez scene, referring to the days prior to RTM of some software. It was adopted in the hacker scene in the early 90s. And that doesn't make sense anyway. It was obviously known to someone if malware was written. These aren't found and written by skynet. I've been around since about as long as the term was used, and long before the media used it, and it was universally understood to mean something that wasn't patched. Over time, more and more people would know about the 0day. So what number are you using for "unknown"? 1 person knows about it? A hacker group? 2 hacker groups, because one of them stole it from the other? Or is that semi-0day? The zero days is between when it exists and when it is patched, even if it ends up on full disclosure or bugtraq. When it did hit a list, its status goes from "private" to "public", but this is orthogonal to its 0day status. Ask tptacek, he was around back then ;) According to that nytimes article, comex is 20 +/- 1 year, so I forgive him ;)

roc 14y ago
> "The term actually originates in the warez scene" A full etymology would certainly be interesting, but I was trying to stick to the subject matter at hand. > "It was obviously known to someone if malware was written." Again, in the context of security, 'known' -- at least as far as I've ever heard it used -- is shorthand for known to the security-minded public and/or to the vendor. It could be known to a million black-hats writing a million exploits and that still counts as 'unknown' until the day someone discloses it to the wider public and/or the vendor.
- lawnchair_larry 14y ago
  "A full etymology would certainly be interesting, but I was trying to stick to the subject matter at hand." The point is that you said it was "coined" to describe malware usage. In fact that was neither the first use of the term in this context, nor where the term originated at all.