It was reported yesterday that Microsoft has released a patch for a recently uncovered flaw in Internet Explorer. Thus Fahmida Rashid, "Microsoft Releases Emergency IE Patch", Security Watch 9/21/2012:
Microsoft has released an out-of-band update fixing at least five vulnerabilities in Internet Explorer, including the recently disclosed zero-day vulnerability already being exploited in the wild. [emphasis added]
If you don't know what a "zero-day vulnerability" is, Wikipedia will explain it to you:
A zero-day (or zero-hour or day zero) attack or threat is an attack that exploits a previously unknown vulnerability in a computer application, meaning that the attack occurs on "day zero" of awareness of the vulnerability. This means that the developers have had zero days to address and patch the vulnerability. Zero-day exploits (actual software that uses a security hole to carry out an attack) are used or shared by attackers before the developer of the target software knows about the vulnerability.
It's worth noting in this case that the vulnerability in question was still called "zero day" after being in the news for almost a week: it seems that zero day has come to mean something like "known to bad guys before a defense is available".
In any case, I'm curious about where this whole "zero day" business came from, and how widely it's spread.
Read the rest of this entry »