Zero-Day Vulnerabilities: The Hidden Flaws Governments Pay Millions For

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

You can use long passwords, multi-factor authentication, and prompt updates and still be exposed to a zero-day: a flaw the software vendor has known about for exactly zero days. This episode separates terms that are often blurred. A vulnerability is the opening, like a bank vault air vent built an inch too wide. An exploit is the specialized tool built to get through it. A 2017 RAND Corporation data set found exploits took an average of 22 days to develop and stayed usable for 6.9 years.

Around these flaws sits a three-part economy. On the white market, researchers report bugs for bounties. On the black market, criminal groups buy working exploits. The largest buyers are in the gray market: governments and intelligence agencies, where a single zero-click exploit can fetch millions. That feeds the debate over disclosure versus stockpiling, which stopped being theoretical with Stuxnet in 2010 and the Shadow Brokers leak in 2016. The episode closes with defense in depth, the practice of making a breach too slow, costly, and noisy to pay off.

• Releasing a patch can raise risk for a time, since attackers compare old and new code to locate the flaw before users install the fix.
• Stuxnet used four zero-days at once, spread by USB drives into the air-gapped Natanz facility, and fed operators fake readings while centrifuges tore themselves apart.
• EternalBlue, an exploit stolen from the NSA, powered the 2017 WannaCry and NotPetya attacks, with damage estimated at $10 billion.
• Pegasus spyware from the NSO Group uses zero-click exploits against apps such as iMessage and WhatsApp, requiring no action from the target.
• A 2022 study of an exploit broker found a 44 percent annualized inflation rate in exploit prices.