Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar | Lex Fridman Podcast #266

If one site is hacked, you can just unleash all health.

We have stumbled into this new era of mutually assured digital destruction.

How far are people willing to go?

You can capture their location. You can capture their contacts that record their telephone calls, record their camera without them knowing about it. Basically, you can put an invisible ankle bracelet on someone without them knowing. You could scan, sell that to a zero day broker for $2,000,000.

The following is a conversation with Nicole Perlroth, cybersecurity journalist and author of this Is How They Tell Me the World Ends the Cyber Weapons Arm Race. This is the Lex Friedman podcast to support it. Please check out our sponsors in the description. And now, dear friends, here's Nicole Prolaroth. You've interviewed hundreds of cybersecurity hackers, activists, dissidents, computer scientists, government officials, forensic investigators and mercenaries. So let's talk about cybersecurity and cyber war. Start with the basics. What is a zero day vulnerability? And then a zero day exploit or attack.

So at the most basic level, let's say I'm a hacker and I find a bug in your iPhone iOS software that no one else knows about, especially Apple, that's called a zero day because the minute it's discovered, engineers have had zero days to fix it. If I can study that zero day, I could potentially write a program to exploit it. And that program would be called a zero day exploit. And for iOS, the dream is that you craft a zero day exploit that can remotely exploit someone else's iPhone without them ever knowing about it. And you can capture their location, you can capture their contacts that record their telephone calls, record their camera without them knowing about it. Basically, you can put an invisible ankle bracelet on someone without them knowing. And you can see why that capability, that zero day exploit, would have immense value for a spy agency or a government that wants to monitor its critics or dissidents. And so there's a very lucrative market now for zero day exploits.

So you said a few things there. One is iOS. Why iOS? Which operating system? Which one is the sexier thing to try to get to, or the most impactful thing? And the other thing you mentioned is remote versus like having to actually come in physical contact with it. Is that the distinction?

So iPhone exploits have just been a government's number one priority recently? Actually, the price of an Android remote zero day exploit, something that can get you into Android phones, is actually higher. The value of that is now higher on this underground market for zero day exploits than an iPhone iOS exploit. So things are changing.

So the there's probably more Android devices, so that's why it's better. But then the iPhone side, if I. So I'm an Android person because I'm a man of the people, but it seems like all the elites use iPhone, all the people at nice dinner parties. So is that, is that the reason that like the more powerful people use iPhones? Is that why?

I don't think so. I actually. So it was about two years ago that the prices flipped. It used to be that if you could craft a remote zero click exploit for iOS then that was about as good as it gets. You could sell that to a zero day broker for $2 million. The caveat is you can never tell anyone about it because the minute you tell someone about it, Apple learns about it, they patch it and that $2.5 million investment that that zero day broker just made goes to dust. So a couple years ago, and don't quote me on the prices, but an Android zero click remote exploit for the first time topped the iOS and actually a lot of people's read on that was that it might be a sign that Apple security was falling and that it might actually be easier to find an iOS zero day exploit than find an Android zero day exploit. The other thing is market share. There are just more people around the world that use Android and a lot of governments that are paying top dollar for zero day exploits these days are deep pocketed governments in the Gulf that want to use these exploits to monitor their own citizens, monitor their critics. And so it's not necessarily that they're trying to find elites, uh, it's that they want to find out who these people are that are criticizing them or perhaps planning the next Arab spring.

So in your experience are most of these attack targeted to cover a large population or is there attacks that are targeted towards specific individuals?

So I think it's both. Some of the zero day exploits that have fetched top dollar that I've heard of in my reporting in the United States were highly targeted. You know there was a potential terrorist attack. They wanted to get into this person's phone. It had to be done in the next 24 hours. They approached hackers and say we'll pay you x millions of dollars if you can do this. But then you look at when we've discovered iOS zero day exploits in the wild, some of them have been targeting large populations like Uyghurs. So a couple years ago there was a watering hole attack. Okay, what's a watering hole attack? There's a website, it was actually had information aimed at Uyghurs and you could access it all over the world. And if you visited this website, it would drop an iOS zero day exploit onto your phone. And so anyone that visited this website that was about Uyghurs anywhere, I mean Uyghurs, Uyghurs living abroad, basically the Uyghur diaspora would have gotten infected with this zero day exploit. So in that case, you know, they were targeting huge swaths of this one population or people interested in this one population, basically in real time.

Who are these attackers from the individual level to the group level, psychologically speaking, what's their motivation? Is it purely money? Is it the challenge? Are they malevolent? Is it power? These are big philosophical, human questions, I guess.

So these are the questions I set out to answer for my book. I wanted to know, are these people that are just after money? If they're just after money, how do they sleep at night not knowing whether that zero day exploit they just sold to a broker is being used to basically make someone's life a living hell. And what I found was there's kind of this long, sordid history to this question. It started out in the 80s and 90s when hackers were just finding holes and bugs in software for curiosity's sake, really, as a hobby. And some of them would go to the tech companies like Microsoft or Sun Microsystems at the time, or Oracle, and they'd say, hey, I just found this zero day in your software and I can use it to break into NASA. And the general response at the time wasn't, thank you so much for pointing out this flaw and our software will get it fixed as soon as possible. It was, don't ever poke around our software ever again or we'll stick our general counsel on you. And that was really sort of the common thread for years. And so hackers who set out to do the right thing were basically told to shut up and stop doing what you're doing. And what happened next was they basically started trading this information online. Now, when you go back and interview people from those early days, they all tell a very similar story, which is they're curious, they're tinkerers. You know, they remind me of like the kid down the block that was constantly poking around the hood of his dad's car. You know, they just couldn't help themselves. They wanted to figure out how a system is designed and how they could potentially exploit it for some other purpose. It doesn't have to be good or bad, but they were basically kind of beat down for so long by these big Tech companies that they started just silently trading them with other hackers. And that's how you got these really heated debates in the 90s about disclosure. Should you just dump these things online? Because any script kitty can pick them up and use it for all kinds of mischief. But you know, don't you want to just stick a middle finger to all these companies that are basically threatening you all the time? So there was this really interesting dynamic at play. And what I learned in the course of doing my book was that government agencies and their contractors sort of tapped into that frustration and that resentment and they started quietly reaching out to hackers on these forums. And they said, hey, you know that zero day you just dropped online, could you come up with something custom for me and I'll pay you six figures for it, so long as you shut up and never tell anyone that I paid you for this. And that's what happened. So throughout the 90s, there was a bunch of boutique contractors that started reaching out to hackers on these forums and saying, hey, I'll pay you six figures for that bug you were trying to get Microsoft to fix for free. And sort of so began or so catalyzed this market where governments and their intermediaries started reaching out to these hackers and buying their bugs for free. And in those early days, I think a lot of it was just for quiet counterintelligence, traditional espionage. But as we started baking the software, Windows software, Schneider Electric, Siemens industrial software into our nuclear plants and our factories and our power grid and our petrochemical facilities and our pipelines, those same zero days came to be just as valuable for sabotage and war planning.

Does the fact that the market sprung up and you can now make a lot of money change the nature of the attackers that came to the table or grow the number of attackers? I mean, what is, I guess you told the psychology of the hackers in the 90s? What is the culture today and where is it heading?

So I think there are people who will tell you they would never sell a zero day to a zero day broker or a government one, because they don't know how it's going to get used when they throw it over the fence. You know, most of these get rolled into classified programs and you don't know how they get used to. If you sell it to a zero day broker, you don't even know which nation state might use it or potentially which criminal group might use it if you sell it on the dark web. The other thing that they say is that they want to be able to sleep at night, and they lose a lot of sleep if they found out their zero day was being used to make a dissident's life living hell. But there are a lot of people, good people, who also say, no, this is not my problem. This is the technology company's problem. If they weren't writing new bugs into their software every day, then there wouldn't be a market, you know, then there wouldn't be a problem. But they continue to write bugs into their software all the time and they continue to profit off that software. So why shouldn't I profit off my labor too? And one of the things that has happened, which is I think a positive development over the last 10 years, are bug bounty programs. Companies like Google and Facebook and then Microsoft and finally Apple, which resisted it for a really long time, have said, okay, we are going to shift our perspective about hackers. We're no longer going to treat them as the enemy here. We're going to start paying them for what it's essentially free quality assurance. And we're going to pay them good money in some cases, you know, six figures in some cases. Some cases we're never going to be able to bid against a zero day broker who sells to government agencies, but we can reward them and hopefully get that to that bug earlier where we can neutralize it so that they don't have to spend another year developing the zero day exploit. And in that way we can keep our software more secure. But every week I get messages from some hacker that says, you know, I tried to this zero day exploit that was just found in the wild, you know, being used by this nation state. I tried to tell Microsoft about this two years ago and they were going to pay me peanuts. So it never got fixed. You know, there are all sorts of those stories that can continue on. And you know, I think just generally hackers are not very good at diplomacy. You know, they tend to be pretty snipy, technical crowd and very philosophical in my experience. But you know, diplomacy is not their strong suit.

Oh, there almost has to be a broker between companies and hackers where you can translate effectively. Just like you have a zero day broker between governments and hackers.

Yeah.

Because you have to speak their language.

Yeah. And there have been some of those companies who've risen up to meet that demand. And HackerOne is one of them. Bugcrowd is another. Synac has an interesting model. So that's a company that you pay for a private bug bounty program, essentially. So you pay this company, they tap hackers all over the world. To come hack your software, hack your system, and then they'll quietly tell you what they found. And I think that's a really positive development. And actually the Department of Defense hired all three of those companies I just mentioned to help secure their systems. Now, I think they're still a little timid in terms of letting those hackers into the really sensitive, high side, classified stuff, but, you know, baby steps.

Just to understand what you were saying. You think it's impossible for companies to financially compete with the zero day brokers, with governments, so, like the defense can't outpay the hackers.

It's interesting, you know, they, they shouldn't outpay them because what would happen if they started offering $2.5 million at Apple for any, you know, zero day exploit that governments would pay that much for is their own engineers would say, why the hell am I working, you know, for less than that and doing my nine to five every day? So you would create a perverse incentive. And I didn't think about that until I started this research and I realized, okay, yeah, that makes sense. You don't want to incentivize offense so much that it's to your own detriment. And so I think what they have, though, what the companies have on government agencies is if they pay you, you get to talk about it. You know, you get the street cred.

Yes.

You get to brag about the fact you just found that $2.5 million, you know, iOS0 day that no one else did, and if you sell it to a broker, you never get to talk about it. And I think that really does eat at people.

Can I ask you a big philosophical question about human nature here? So if you have, in what you've seen, if a human being has a zero day, they found a zero day vulnerability that can hack into, I don't know what's the worst thing you can hack into something that could launch nuclear weapons. Which percentage of the people in the world that have the skill would not share that with anyone, with any bad party, I guess. How many people are completely devoid of ethical concerns in your, in your sense? So my, my belief is all the ultra competent people or very, very high percentage of ultra competent people are also ethical people. That's been my experience, but then again, my experience is narrow. What's, what's, what's your experience been like?

So this was another question I wanted to answer. You know, who are these people who would sell a zero day exploit that would neutralize a Schneider electric safety lock at a, at a Petrochemical plant. Basically the last thing you would need to neutralize before you trigger some kind of explosion. Who would sell that? And I got my answer. Well, the answer was different. A lot of people said I would never even look there because I don't even want to know. I don't even want to have that capability. I don't like. I don't even want to have to make that decision about whether I'm going to profit off of that knowledge. I went down to Argentina, and this whole kind of moral calculus I had in my head was completely flipped around. So just to back up for a moment, so Argentina actually is a real hacker's paradise. People grew up in Argentina. And, you know, I went down there. I guess I was there around 2015, 2016, but you still couldn't get an iPhone. You know, they didn't have Amazon Prime. You couldn't get access to any of the apps we all take for granted. To get those things in Argentina as a kid, you have to find a way to hack them, you know, and it's. The whole culture is really like a hacker culture. They say, like, it's really like a MacGyver culture. You know, you have to figure out how to break into something with wire and tape. And that means that there are a lot of really good hackers in Argentina who specialize in developing zero day exploits. And I went down to this Argentina conference called EchoParty, and I asked the organizer, okay, can you introduce me to someone who's selling zero day exploits to governments? And he was like, just throw a stone. Throw a stone anywhere and you're going to hit someone. And all over this conference, you saw these guys who were clearly from these Gulf states, who only spoke Arabic. What are they doing at a young hacking conference in Buenos Aires? And so I went out to lunch with kind of this Godfather of the hacking scene there, and I asked this really dumb question, and I'm still embarrassed about how I phrased it, but I said, so will these guys only sell these zero day exploits to good Western governments? And he said, nicole, last time I checked, the United States wasn't a good Western government. You know, the last country that bombed another country into oblivion wasn't China or Iran. It was the United States. So if we're going to go by your whole moral calculus, you know, just know that we have a very different calculus down here. And we'd actually rather sell to Iran or Russia or China maybe than the United States. And that just blew me away. Like, wow. He's like, we'll just sell to whoever brings us the biggest bag of cash. Have you checked into our inflation situation recently? So I had some of those reality checks along the way. We tend to think of things as is this moral? Is this ethical? Especially as journalists, we kind of sit on our high horse sometimes and write about a lot of things that seem to push the moral bounds. But in this market, which is essentially an underground market, that the one rule is like fight club, no one talks about fight club. First rule of the zero day market. Nobody talks about the zero day market on both sides because the hacker doesn't want to lose their $2.5 million bounty. And governments roll these into classified programs and they don't want anyone to know what they have. So no one talks about this thing. And when you're operating in the dark like that, it's really easy to put aside your morals sometimes.

Can I at a small tangent, ask you by way of advice? You must have done some incredible interviews and you've also spoken about how serious you take protecting your sources. If you were to give me advice for interviewing when you're recording on mic with a video camera, how is it possible to get into this world? Like, is it basically impossible? So you've, you've spoken with a few people. What is it like the Godfather of cyber war, cybersecurity. So people that are already out and they still have to be pretty brave to speak publicly, but is it virtually impossible to really talk to anybody who's a current hacker? You're always like 10, 20 years behind.

It's a good question, and this is why I'm a print journalist.