On Sat, 21 Jul 2007, Ken Kousky wrote:
Zero day is a serious misnomer from vendors that suggest that the counting
of time an exposure is known BY THE GOOD GUYS is some kind of trigger date
when in reality, many serious exploits are know BY THE BAD GUYS so the day
zero is really months or maybe years prior to the disclosure or notification
date. Look at the WMF vulnerability that caused a mad rush to patch it once
the good guys were put on notice. In this case, the vulnerability had been
present in Windows products since the early 90s and according to Kapersky
Labs there was even malware being sold that took advantage of it long before
there was even day zero notification.
I reserve the word 0day to issues that have been found through exploits.
So a 0day exploit is an exploit out in the field were the vulnerability
is/was not publicly known before the exploit was found.
As such it would be a very rough indication of the score of good guys
(writing advisories) and the bad guys (writing exploits).
Hugo.
--
hvdkooij@xxxxxxxxxxxxxxx http://hugo.vanderkooij.org/
This message is using 100% recycled electrons.
Some men see computers as they are and say "Windows"
I use computers with Linux and say "Why Windows?"
(Thanks JFK, for the insight.)
