The words “zero-day virus” may seem very odd, as if a virus is some sort of zombie outbreak! Despite this, day zero viruses are very important to security and antivirus companies, as it makes up the backbone of the work they do. So, what are they, and why are they so scary?
To answer this, let’s look at how an antivirus works. To make sure nothing nasty creeps into your computer, an antivirus has a log of every virus known to man. This is known as the “virus definitions,” and is essentially a log of programs known to be bad. If antivirus detects one of these programs trying to sneak onto your PC, it locks it away — known as “quarantining”.
Let’s imagine the above scenario like a group of stores. These stores have a nasty shoplifting outbreak, so they all hire the same security company to protect them. This security company sets up a camera at the front door at every store to read people’s faces as they enter.
When the security company catches wind that someone is shoplifting, they take a face scan of that person and put it in their database of shoplifters. Then, when a shoplifter enters the store, the security company can warn the store about them.
This sounds great at first, but there is a problem. This method doesn’t stop someone who hasn’t shoplifted at all from stealing. Someone can enter a shop, take something, and leave without the camera altering the store of the problem. Only if the thief is actually caught are their details uploaded to the database.
A zero-day virus is like this shoplifter. They’re viruses that were learned of on that very day; hence, “zero-day.” Because they were made that day, antiviruses don’t have a definition for them. That means the virus can sneak onto computers without being detected and cause havoc.
Antivirus companies have to be on constant guard for these zero-day attacks. As soon as they spot one, they need to design a definition for it and upload it to everyone’s antivirus software. If they don’t do it fast enough, people’s PCs may get infected as a result!
This is why it’s very important to keep your antivirus updated. When you update it, you’re giving it all the latest news on the virus scene so it can do a better job protecting you. This means fewer viruses can sneak under your antivirus’ radar as a result.
Of course, there are ways to detect viruses without a definition. In the shoplifting example, the security company can fix this flaw by installing cameras around the stalls and watching for people stealing expensive things. Similarly, an antivirus can look for programs trying to mess with important files and stop them before they can.
But what if we didn’t have to rely on definitions, and can instead tell a computer what a virus looks like and how to stop it? That’s exactly what antivirus companies plan to do in the future with AI-driven decisions. Instead of relying on sending virus definitions to users, an AI-based antivirus can catch a zero-day virus the moment it appears and keeps it from spreading. Very smart stuff!
The next time your antivirus asks permission to update itself, be sure to let it. WHo knows; it may be protecting you from a nasty day-zero virus!
Learn More
Virus definition
https://techterms.com/definition/virus_definition
How does an anti-virus work?
https://www.computerhope.com/issues/ch001738.htm
Zero-day virus definition
https://www.techopedia.com/definition/29740/zero-day-virus
Zero day vulnerabilities
Zero Day
https://www.avast.com/c-zero-day
Top ten anti-virus sites
https://antivirus.thetop10sites.com/h
What is Stuxnet
https://www.csoonline.com/article/3218104/what-is-stuxnet-who-created-it-and-how-does-it-work.html
