The first rule of zero-days is no one talks about zero-days (so we’ll explain)

How do you defend yourself against the unknown? That is crux of the zero-day vulnerability: a software vulnerability that, by definition, is unknown by the user of the software and often its developer as well.

Everything about the zero-day market, from research and discovery through disclosure and active exploitation, is predicated upon this fear of the unknown—a fear that has been amplified and distorted by the media. Is the world really at threat of destabilisation due to lone-wolf hackers digging up vulnerabilities in popular software packages and selling them to whichever repressive government offers the most money? Or is it just a classic case of the media and megacorp lobbyists focusing on the sexy, scary, offensive side of things, and glossing over the less alluring aspects?

And then what about legislation and regulation of zero-days? In most countries, there are scant legal mechanisms for discouraging or punishing the discovery of new zero-days. There are even fewer laws and directives dictating how zero-days should be responsibly disclosed. It isn't that lawmakers aren't aware of these problems, it's just that there isn't an easy solution. How do you craft a law that allows some research groups to keep on digging for vulnerabilities while at the same time blocking the black hats? What if the government's idea of "responsible disclosure" means disclosing all vulnerabilities to GCHQ or the NSA?

Recently, Europe began discussing how best to interpret the Wassenaar Arrangement—an agreement between 41 countries that was originally designed to limit the proliferation of physical, military weapons to non-desirables—when it applies to the proliferation of surveillance software, intrusion tools, and zero-day software vulnerabilities. In the US, the Senate is set to vote on the Cybersecurity Information Sharing Act as soon as today. The legislation would expand the Computer Fraud and Abuse Act to include security research. The US is trying to decide how to interpret Wassenaar when it comes to the exporting of intrusion software and zero-days too.

The outcome of these consultations and parliamentary processes will dictate whether security researchers, irrespective of the colour of their hat, can continue to operate in Europe and the US.

Who uses zero-days, and what are they used for?

A zero-day is a very specific thing, and it likewise has a very specific purpose: gaining access to something without someone else finding out. This specificity is what makes zero-days so powerful and at the same time so weak. The more boldly or broadly you use a zero-day, the more likely you are to be discovered—then the jig is up. If you've spent £200,000 on acquiring a zero-day and perhaps thousands of hours actually engineering and coordinating the attack, it's unlikely that your first port of call is to infect millions of computers and immediately raise the ire of the security research community.

In short, then, the actual usage of zero-days is quite limited. "It's not that zero-days aren't being used," explained Adriel Desautels, an experienced security researcher and CEO of Netragard. "It's that they hold no real threat for the average business or citizen."

Think of an exploit based on a zero-day vulnerability as a laser-targeted, bunker-busting bomb for solving a single problem rather than a panacea. "A prime example of zero-day usage: 2013, FBI, Firefox, child porn," said Desautels. He's referring to a high-profile case where the FBI is believed to have used a zero-day vulnerability in Firefox to catch a number of people who were browsing child porn. "That's the kind of thing that a government does when it purchases a zero-day. Very specialised."

Another, slightly more famous example of zero-day usage is Project Aurora, where a group of purportedly state-sponsored Chinese hackers used a zero-day vulnerability in Internet Explorer to penetrate and exfiltrate data from Google and a number of other US tech giants.

"On the black market, for stealing credit cards and things like that, you don't use zero-days," Desautels said. "So if you think 'who actually needs a zero-day?'—well, it's the people who are going after very hardened infrastructure, which is clearly not public or private businesses. They have to exfiltrate information without detection, and they're willing to spend a very large amount of money to do it one time. Who is willing to do that other than governments?"

Furthermore, Desautels pointed out, "the government doesn't need zero-days to spy on people." A prime example is PRISM, the giant surveillance program revealed in 2013 by Edward Snowden. "How does PRISM work? It tied into Verizon, AT&T—everyone was just freely providing information. People send text messages from their mobiles. They post status updates on Facebook."

Another thing to consider when it comes to zero-day discovery and exploitation is that the target is always moving. After years of assault, it's now quite hard to find a zero-day in Windows, and so the focus has shifted to applications. But as Java, Flash, and other regularly assaulted apps eventually get themselves into shape, the focus is beginning to shift again, ZDI chief Jewel Timpe told Ars in an interview. "The focus has turned to new areas in computing, like the Internet of Things and SCADA [Supervisory Control and Data Acquisition; industrial machines]." Just in recent months, we've reported on IoT attacks that run the gamut, including everything from baby monitors to cars to light bulbs.

"Researchers go after what is interesting to them, and they especially go after things others haven’t tried yet. This is true of attackers as well, which is why SCADA systems are also an attractive target," Timpe explained. "These systems are used to control different types of processes within large infrastructures, such as industrial power plants. While we may all be familiar with Stuxnet [which specifically targeted the centrifuges used by Iran to enrich uranium], SCADA vulnerabilities don’t end there, and the ZDI has seen a recent influx in remote code execution vulnerabilities in SCADA products."

All this isn't to say that private groups aren't buying or using zero-days to separate you from your credit card details or to carry out corporate espionage, but it's certainly not de rigueur.