{"id":70958,"date":"2017-03-31T10:49:24","date_gmt":"2017-03-31T17:49:24","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=70958"},"modified":"2025-08-14T07:11:31","modified_gmt":"2025-08-14T14:11:31","slug":"quick-guide-zero-day-threats-affect","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/quick-guide-zero-day-threats-affect\/","title":{"rendered":"A Quick Guide to ‘Zero-Day Threats’ and How They Affect You"},"content":{"rendered":"

If you\u2019re looking for a cybersecurity term that sounds intimidating and impressive to those who aren\u2019t familiar with the field, you\u2019d be hard pressed to find a better phrase than \u201czero-day threat.\u201d It\u2019s catchy, it hints at clandestine activity, and it\u2019s taken advantage of vulnerabilities found with the systems of a large health organization<\/a> and one of the biggest technology companies in the world<\/a>. But what does it mean actually?<\/p>\n

What it is\u00a0<\/strong><\/h2>\n

In truth, the term \u201czero-day threat\u201d is an umbrella term used to describe a cyberattack that takes advantage of a previously unknown bug or vulnerability that has not been fixed, or \u201cpatched,\u201d in a program. The \u201czero-day\u201d part of a zero-day exploit is simply a measurement tool, much like a calendar. It describes the amount of days between when the vulnerability is discovered and when a fix for that vulnerability is made available. For example, let\u2019s say I have discovered a previously unknown bug in a program and report it to the program\u2019s developers. That bug is considered a zero-day vulnerability because the developers have had zero days to work on a fix. If the developers fail to fix or mitigate the bug the next day, it becomes a \u201cone-day\u201d exploit. This measurement continues until a patch is issued.<\/p>\n

Why it\u2019s important<\/strong><\/h2>\n

We\u2019ve covered what \u201czero-day threat\u201d means, but why are these vulnerabilities such a big deal? Well, zero-day vulnerabilities, like most bugs, are fairly harmless on their own. But when they\u2019re used in conjunction with other exploits \u2014 known malware variants for example and, in extreme cases, other zero-day exploits \u2014 they become incredibly powerful tools<\/a>.<\/p>\n

For example, let\u2019s say a cybercriminal wants to install a Remote Access Trojan (RAT<\/a>)\u2014 a tool used to spy on a victim\u2019s activities and manipulate an infected computer \u2014 onto a targeted computer, but simply cannot get access to the target\u2019s computer. If the cybercriminal was resourceful enough, they could theoretically use a zero-day vulnerability (which, in this scenario, would become a zero-day exploit since it\u2019s being actively used to exploit a system) as a means of getting onto the target\u2019s system. Once they\u2019ve gained that foothold they can begin to spy, steal and sabotage a target\u2019s network or system.<\/p>\n

Zero-day threats are incredibly valuable simply because they offer cybercriminals a better opportunity to compromise a victim\u2019s device. In fact, these threats can fetch a lot of money. A zero-day vulnerability for iOS (Apple\u2019s operating system), for example, can be worth as much as a half a million dollars, according to WIRED<\/a>, and can likely bring in even more on the black market. Zero-day vulnerabilities are such a big concern that tech companies often offer cybersecurity researchers bug bounties<\/a> for identifying and documenting these bugs.<\/p>\n

What you can do<\/strong><\/h2>\n

So, what can you do to stay secure in a world filled with zero-day threats? Well there are actually a few steps you can take to reduce the risk of falling victim to one of these exploits. Let\u2019s take a look:<\/p>\n