{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/zero-day","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/zero-day/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/zero-day/"},"term":{"en":"Zero-day vulnerability","da":"Zero-day-sårbarhed"},"aka":{"en":["zero-day","0-day"],"da":["zero-day","0-day","nuldagssårbarhed"]},"domain":["security"],"cluster":"fundamentals","layer":"application","status":"current","summary":{"en":"A flaw that attackers know about before the maker does, so on the day it is used there is no fix to install.","da":"En fejl, som angribere kender, før producenten gør, så der ikke findes nogen rettelse at installere, den dag den bliver udnyttet."},"body":{"formal":{"en":"A vulnerability in software or hardware that is unknown to its maker, or known but not yet fixed, at the time it is first exploited - the maker has had “zero days” to release a patch.","da":"En sårbarhed i software eller hardware, som producenten ikke kender, eller kender men endnu ikke har rettet, på det tidspunkt, den første gang udnyttes - producenten har haft “nul dage” til at udgive en patch."},"plain":{"en":"Like a burglar who has found a secret gap in the fence that even the owner does not know about - no lock can be fitted to a hole nobody has seen.","da":"Som en indbrudstyv, der har fundet et hemmeligt hul i hegnet, som selv ejeren ikke kender til - man kan ikke sætte lås på et hul, ingen har set."},"inPractice":{"en":"Attackers use an unknown flaw in a widely used file-transfer product to steal data from hundreds of organisations; at a Danish pension fund the IT operations lead must switch the service off until the maker ships a patch days later.","da":"Angribere bruger en ukendt fejl i et udbredt produkt til filoverførsel til at stjæle data fra hundredvis af organisationer; i en pensionskasse må driftschefen slukke for tjenesten, indtil producenten udsender en patch nogle dage senere."},"whyItMatters":{"en":"Patching, however fast, cannot help before a fix exists, so layers of defence, limited rights and watching for odd behaviour are what catch these attacks.","da":"Selv hurtig patching hjælper ikke, før der findes en rettelse; derfor er det lag af forsvar, begrænsede rettigheder og overvågning af usædvanlig adfærd, der fanger disse angreb."}},"deepDive":{"en":"The word \"zero-day\" is applied to three related but distinct things, and precision matters. A zero-day vulnerability is a flaw unknown to the vendor, or known but unpatched, at the moment it is first used against real targets. A zero-day exploit is the working technique or code that leverages it. A zero-day attack is the actual use of that exploit before a fix exists. The name reflects that the vendor has had zero days to remediate. Once a patch is released, the flaw stops being a zero-day; if attackers keep exploiting unpatched systems afterward it becomes an \"N-day\" or \"one-day\" vulnerability, which in practice causes far more compromises than true zero-days because many organisations patch slowly.\n\nThe defining property is the window of exposure - the interval between first exploitation and the availability and deployment of a fix - during which signature-based and patch-based defences are structurally unable to help, since neither a signature nor a patch yet exists. This is why zero-days command high value: legitimate bug-bounty programs and grey-market exploit brokers both pay large sums, and commercial spyware vendors (the Pegasus/NSO Group case being the most documented) have weaponised zero-click zero-days against mobile devices. State-grade operations have chained multiple zero-days for effect, as the Stuxnet campaign against Iranian centrifuges famously did around 2010.\n\nBecause prevention by patching is impossible during the window, defence relies on measures that do not depend on knowing the specific flaw: defence-in-depth and least privilege to limit what a successful exploit reaches; behavioural and anomaly detection (EDR/XDR) that flags the effects of exploitation - unexpected process behaviour, memory corruption, unusual outbound traffic - rather than a known pattern; exploit-mitigation technologies (ASLR, DEP, control-flow integrity, sandboxing) that raise the cost of turning a bug into reliable code execution; and virtual patching at a WAF or IPS to block exploit traffic before the vendor fix lands. Rapid patch deployment once a fix appears is what shrinks the far larger N-day exposure.\n\nCoordinated Vulnerability Disclosure shapes how zero-days become known: researchers typically report privately and allow a remediation window (Google's Project Zero uses a 90-day policy) before public disclosure, whereas full disclosure or a leak can turn a quietly held flaw into mass exploitation overnight. CISA's Known Exploited Vulnerabilities catalogue records flaws confirmed to be exploited, several of which began as zero-days. A common misconception is that zero-days are the main threat to most organisations; for the majority, known-but-unpatched vulnerabilities, misconfiguration and phishing account for far more incidents, so basic hygiene usually reduces risk more than defending against exotic zero-days. A zero-day is a special case of a vulnerability defined by timing - the absence of an available patch when exploitation begins - not by any different underlying nature.","da":"Ordet \"zero-day\" bruges om tre beslægtede, men adskilte ting, og præcision er vigtig. En zero-day-sårbarhed er en fejl, som leverandøren ikke kender, eller kender men ikke har rettet, i det øjeblik den første gang bruges mod rigtige mål. Et zero-day-exploit er den virkende teknik eller kode, der udnytter den. Et zero-day-angreb er den faktiske brug af det exploit, før en rettelse findes. Navnet afspejler, at leverandøren har haft nul dage til at rette. Når en patch er udgivet, ophører fejlen med at være en zero-day; hvis angribere fortsat udnytter upatchede systemer bagefter, bliver den til en \"N-day\"- eller \"one-day\"-sårbarhed, som i praksis fører til langt flere kompromitteringer end egentlige zero-days, fordi mange organisationer patcher langsomt.\n\nDen definerende egenskab er eksponeringsvinduet - intervallet mellem den første udnyttelse og en rettelses tilgængelighed og udrulning - hvor signatur- og patchbaserede forsvar strukturelt ikke kan hjælpe, da hverken en signatur eller en patch endnu findes. Derfor har zero-days høj værdi: både legitime bug bounty-programmer og grå-markedets exploit-mæglere betaler store beløb, og kommercielle spyware-leverandører (Pegasus/NSO Group-sagen er den bedst dokumenterede) har udnyttet zero-click-zero-days i praksis mod mobile enheder. Operationer på statsniveau har kædet flere zero-days sammen for effekt, som Stuxnet-kampagnen mod iranske centrifuger berømt gjorde omkring 2010.\n\nFordi forebyggelse via patching er umulig i vinduet, hviler forsvar på foranstaltninger, der ikke afhænger af at kende den konkrete fejl: defence-in-depth og least privilege for at begrænse, hvad et vellykket exploit når; adfærds- og anomalidetektion (EDR/XDR), der markerer effekterne af udnyttelse - uventet procesadfærd, hukommelseskorruption, usædvanlig udgående trafik - frem for et kendt mønster; exploit-mitigeringsteknologier (ASLR, DEP, control-flow integrity, sandboxing), der hæver omkostningen ved at gøre en fejl til pålidelig kodeeksekvering; og virtuel patching i en WAF eller IPS til at blokere exploit-trafik, før leverandørens rettelse lander. Hurtig udrulning af patches, når en rettelse dukker op, er dét, der mindsker den langt større N-day-eksponering.\n\nCoordinated Vulnerability Disclosure former, hvordan zero-days bliver kendt: forskere rapporterer typisk privat og giver et rettelsesvindue (Googles Project Zero bruger en 90-dages-politik), før offentliggørelse, mens fuld offentliggørelse eller et læk kan gøre en stille tilbageholdt fejl til masseudnyttelse på én nat. CISA's Known Exploited Vulnerabilities-katalog registrerer fejl, der er bekræftet udnyttet, hvoraf flere begyndte som zero-days. En udbredt misforståelse er, at zero-days er den vigtigste trussel mod de fleste organisationer; for flertallet står kendte, men upatchede sårbarheder, fejlkonfiguration og phishing for langt flere hændelser, så basal hygiejne mindsker som regel risikoen mere end at forsvare sig mod eksotiske zero-days. En zero-day er et specialtilfælde af en sårbarhed defineret ved timing - fraværet af en tilgængelig patch, når udnyttelsen begynder - ikke ved nogen anderledes underliggende natur."},"edges":[{"type":"requires","to":"cs/patch","confidence":"high","strength":"normal"},{"type":"requires","to":"security/exploit","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/vulnerability","confidence":"high","strength":"normal"},{"type":"causes","to":"security/security-incident","why":{"en":"With no fix and no warning, a working exploit for the flaw can be used freely until defenders notice.","da":"Uden rettelse og uden varsel kan et virkende exploit mod fejlen bruges frit, indtil forsvarerne opdager det."},"confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"NIST Glossary - Zero Day Attack","url":"https://csrc.nist.gov/glossary/term/zero_day_attack","tier":"standard","publisher":"NIST"}],"draft":true}