In terms of hacking, what are zero days?
In: 682
Some of these replies really don’t make sense. People distinguishing between an “attacker” and “researcher” that doesn’t matter…
A zero day is a vulnerability found in a platform/framework/code… that has never been found/exploited by another person and which remained unknown to the developers until… the 0day vulnerability was found and reported/patched.
Anyone can find a 0day, the difference between attacker and researcher solely matters with regards to the goal of leveraging the exploit. If you decide not the abide by the ethical code, and not report the 0day to the developers and exploit it for your own benefit OR sell the 0day to other malicious actors you would be regarded as an attacker/blackhat.
Whereas a security researcher who abides by the moral code and finds the vulnerability (legally) by using a bug bounty platform/private host in a VM of the software/by abiding by the responsible disclosure policy etc… and reporting the vulnerability to the developers, working with them to patch it and once patched/approved by the developers makes his research public(=this is where its no longer a 0day) and files for a CVE at Mitre (a CVE is a code that identifies the 0day vulnerability in a database along with the report and usually the researchers name) (Mitre is the organisation maintaining this database)
So tldr: a 0day is a weakness in code that has never been found/exploited publicly before.
For your own entertainment, these were all CVE’s and thus 0days found with the keyword “Reddit”:
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Reddit
Latest Answers