Question

Explain why a zero-day attack is potentially so harmful.

(Computer Security II)

Answer 1

Ans-> When user make a software then use so many language and codes of other language , through which we can hacker hacked software

The means in short ,” hacker attack weak part of code “

User use in programming so many plug-in, he don’t which part of leak my information, that’s main reason

Hacker know a week code and sale it also ,

Zero-day is a flaw in software, hardware or firmware that is unknown to the party or parties responsible for patching or otherwise fixing the flaw. The term zero day may refer to the vulnerability itself, or an attack that has zero days between the time the vulnerability is discovered and the first attack. Once a zero-day vulnerability has been made public, it is known as an n-day or one-day vulnerability.

Ordinarily, when someone detects that a software program contains a potential security issue, that person or company will notify the software company (and sometimes the world at large) so that action can be taken. Given time, the software company can fix the code and distribute a patch or software update.

Even if potential attackers hear about the vulnerability, it may take them some time to exploit it; meanwhile, the fix will hopefully become available first. Sometimes, however, a hacker may be the first to discover the vulnerability. Since the vulnerability isn't known in advance, there is no way to guard against the exploit before it happens. Companies exposed to such exploits can, however, institute procedures for early detection.

Zero-day exploit detection

Zero-day exploits tend to be very difficult to detect. Antimalware software and some intrusion detection systems

(IDSes) and intrusion prevention systems (IPSes) are often ineffective because no attack signature yet exists.

This is why the best way to detect a zero-day attack is user behavior analytics. Most of the entities authorized

to access networks exhibit certain usage and behavior patterns that are considered to be normal.

Activities falling outside of the normal scope of operations could be an indicator of a zero-day attack.