"Tell no one, compromise everyone" -- Hackers exploit security vulnerabilities in software for 10 months on average before details of the holes surface in public, according to a new study based on a paper [PDF] on the research - Before We Knew It: An Empirical Study of Zero-Day Attacks In The Real World.
Two researchers from Symantec Research Labs identified 18 zero-day attacks between 2008 and 2011, and 11 of them were previously undetected. “A typical zero-day attack lasts 312 days on average and that, after vulnerabilities are disclosed publicly, the volume of attacks exploiting them increases by up to five orders of magnitude,” the researchers noted.
Researchers from Symantec believe that these zero-day attacks, so called because they are launched well before vendors are even aware of the vulnerabilities, are more prevalent and more potent than previously thought. Zero-day exploits are often closely guarded secrets and can be very valuable to criminals — but once details of the exploited flaws emerge in public, developers and system administrators can get to work to mitigate or halt the attacks.
Source: http://www.theregister.co.uk/2012/10/24/zero_day_study/
