Forum Thread: What Do You Do if There Is a Zero Day but No Patch Out Yet?

In most situations, companies notify their customers of the bug and notify them that a fix is currently being worked on. The next steps really depend on what the zero day exploit is.

If the zero day gives criminals access to passwords (or hashed passwords if you're good at that stuff), then tell customers to change their passwords while you're working on a fix.

If the zero day gives criminals back doors in victim machines, then it's probably best to shut down services so no damage can be done.

That does make alot of sense, I would be so nervous as a company, especially if I was a financial site. You also have to consider complaining customers. If the zero day isn't really bad and you can keep it quiet than I guess all customers would see is requests to set a new password.

Just to be clear, this doesn't mean this company was the one the zero day was used on.

It depends on the situation... I agree with Cameron 100%. If you are a huge business with lots of personal details about your customers (credit cards, etc.), I would probably shut down. However, things can be patched pretty quickly. I imagine Amazon almost completely freaked out when Shellshock was first discovered, but they got right on it.

I know that with Shellshock it depended if the server was configured a certain way so they might have sacrificed some functionality to change the configuration.

First, very few companies would consider shutting down because of a zero-day. Second, the time lag between discovery of a zero-day and the patch is very often more than days, often more like months.

In this type of situation, big online companies will become every vigilant in watching their traffic. Even though a patch may not be available, usually a IDS signature can be generated in hours to detect the zero-day.

I guess I wasn't thinking about IDS systems and how they could be used. I assume with zero days that require something to be configured a certain way (Shellshock) the company could change that and wait for a patch.