The Register – (International) Hackers get 10 months to pwn victims with 0-days before world+dog finds out. Hackers exploit security vulnerabilities in software for 10 months on average before details of the holes surface in public, according to a new study. Researchers from Symantec believe that these zero-day attacks, so called because they are launched well before vendors are even aware of the vulnerabilities, are more prevalent and more potent than previously thought. Zero-day exploits are often closely guarded secrets and can be very valuable to criminals — but once details of the exploited flaws emerge in public, developers and system administrators can get to work to mitigate or halt the attacks. However, this also reveals to everyone else that these holes exist in systems. Two researchers from Symantec Research Labs identified 18 zero-day attacks between 2008 and 2011, and 11 of them were previously undetected. “A typical zero-day attack lasts 312 days on average and that, after vulnerabilities are disclosed publicly, the volume of attacks exploiting them increases by up to five orders of magnitude,” the researchers noted.
Source: http://www.theregister.co.uk/2012/10/24/zero_day_study/