Nicole Perlroth is a cybersecurity journalist and author. Please support this podcast by checking out our sponsors:
- Linode: https://linode.com/lex to get $100 free credit
- InsideTracker: https://insidetracker.com/lex and use code Lex25 to get 25% off
- Onnit: https://lexfridman.com/onnit to get up to 10% off
- ROKA: https://roka.com/ and use code LEX to get 20% off your first order
- Indeed: https://indeed.com/lex to get $75 credit

EPISODE LINKS:
Nicole's Twitter: https://twitter.com/nicoleperlroth
Nicole's Website: https://nytimes.com/by/nicole-perlroth
Nicole's Book: https://amzn.to/3sOQjrs

PODCAST INFO:
Podcast website: https://lexfridman.com/podcast
Apple Podcasts: https://apple.co/2lwqZIr
Spotify: https://spoti.fi/2nEwCF8
RSS: https://lexfridman.com/feed/podcast/
Full episodes playlist: https://www.youtube.com/playlist?list=PLrAXtmErZgOdP_8GztsuKi9nrraNbKKp4
Clips playlist: https://www.youtube.com/playlist?list=PLrAXtmErZgOeciFP3CBCIEElOJeitOr41

OUTLINE:
0:00 - Introduction
0:55 - Zero-day vulnerability
6:56 - History of hackers
21:48 - Interviewing hackers
25:50 - Ransomware attack
38:34 - Cyberwar
51:42 - Cybersecurity
1:00:49 - Social engineering
1:17:42 - Snowden and whistleblowers
1:27:12 - NSA
1:36:59 - Fear for cyberattacks
1:44:30 - Self-censorship
1:48:51 - Advice for young people
1:54:08 - Hope for the future

SOCIAL:
- Twitter: https://twitter.com/lexfridman
- LinkedIn: https://www.linkedin.com/in/lexfridman
- Facebook: https://www.facebook.com/lexfridman
- Instagram: https://www.instagram.com/lexfridman
- Medium: https://medium.com/@lexfridman
- Reddit: https://reddit.com/r/lexfridman
- Support on Patreon: https://www.patreon.com/lexfridman

If 1 site is hacked, you can just unleash all hell.

We have stumbled into this new era of mutually assured digital destruction.

You can capture their location, you can capture their contacts that record their telephone calls, record their camera without them knowing about it.

Basically you can put an invisible ankle bracelet on someone without them knowing.

You could sell that to a zero-day broker for 2000000 dollars.

The following is a conversation with Nicole Perlroth, cybersecurity journalist and author of This Is How They Tell Me The World Ends, The Cyber Weapons Arm Race.

To support it, please check out our sponsors in the description.

And now, dear friends, here's Nicole Polaroth.

You've interviewed hundreds of cybersecurity hackers, activists, dissidents, computer scientists, government officials, forensic investigators, and mercenaries.

So let's talk about cybersecurity and cyber war.

So at the most basic level, let's say I'm a hacker and I find a bug in your iPhone iOS software that no 1 else knows about, especially Apple.

That's called a 0 day because the minute it's discovered, engineers have had 0 days to fix it.

If I can study that 0 day, I could potentially write a program to exploit it.

And that program would be called a zero-day exploit.

And for iOS, the dream is that you craft a zero-day exploit that can remotely exploit someone else's iPhone without them ever knowing about it.

And you can capture their location, you can capture their contacts that record their telephone calls, record their camera without them knowing about it.

Basically, you can put an invisible ankle bracelet on someone without them knowing.

And you can see why that capability, that zero-day exploit would have immense value for a spy agency or a government that wants to monitor its critics or dissidents.

And so there's a very lucrative market now for zero-day exploits.

Which 1 is the sexier thing to try to get to or the most impactful thing?

And the other thing you mentioned is remote versus like having to actually come in physical contact with it, is that the distinction?

So iPhone exploits have just been a government's number 1 priority.

Recently, actually, the price of an Android remote zero-day exploit, something that can get you into Android phones, is actually higher.

The value of that is now higher on this underground market for zero-day exploits than an iPhone iOS exploit.

So there's probably more Android devices, so that's why it's better.

But on the iPhone side, if I, so I'm an Android person, because I'm a man of the people.

But it seems like all the elites use iPhone, all the people at nice dinner parties.

So is that the reason that like the more powerful people use iPhones, is that why?

I actually, so it was about 2 years ago that the prices flipped.

It used to be that if you could craft a remote, zero-click exploit for iOS, then that was about as good as it gets.

You could sell that to a zero-day broker for $2 million.

The caveat is you can never tell anyone about it because the minute you tell someone about it, Apple learns about it, they patch it, and that $2.5 million investment that that zero-day broker just made goes to dust.

So a couple years ago, and don't quote me on the prices, but an Android zero-click remote exploit for the first time topped the iOS.

And actually, a lot of people's read on that was that it might be a sign that Apple's security was falling and that it might actually be easier to find an iOS zero-day exploit than find an Android zero-day exploit.

There are just more people around the world that use Android.

And a lot of governments that are paying top dollar for zero-day exploits these days are deep-pocketed governments in the Gulf that want to use these exploits to monitor their own citizens, monitor their critics, and so it's not necessarily that they're trying to find elites, it's that they want to find out who these people are that are criticizing them or perhaps planning the next Arab Spring.

So in your experience, are most of these attack targeted to cover a large population or is there attacks that are targeted towards specific individuals?

Some of the zero-day exploits that have fetched top dollar that I've heard of in my reporting in the United States were highly targeted.

know, there was a potential terrorist attack.

They wanted to get into this person's phone.

They approached hackers and say, we'll pay you X millions of dollars if you can do this.

But then you look at when we've discovered iOS 0 day exploits in the wild, Some of them have been targeting large populations like Uyghurs.

So a couple years ago, there was a watering hole attack.

It was actually, it had information aimed at Uyghurs, and you could access it all over the world.

And if you visited this website, it would drop an iOS zero-day exploit onto your phone.

And So anyone that visited this website that was about Uyghurs, anywhere, I mean Uyghurs living abroad, basically the Uyghur diaspora, would have gotten infected with this zero-day exploit.

So in that case, they were targeting huge swaths of this 1 population or people interested in this 1 population basically in real time.

From the individual level to the group level, psychologically speaking, what's their motivation?

These are big philosophical human questions, I guess.

So these are the questions I set out to answer for my book.

I wanted to know, are these people that are just after money?

If they're just after money, how do they sleep at night, not knowing whether that zero-day exploit they just sold to a broker is being used to basically make someone's life a living hell.

And what I found was there's kind of this long-sorted history to this question.

You know, it started out in the 80s and 90s when hackers were just finding holes and bugs in software for curiosity's sake, really as a hobby.

And some of them would go to the tech companies like Microsoft or Sun Microsystems at the time, or Oracle.

And they'd say, hey, I just found this 0 day in your software and I can use it to break into NASA.

And the general response at the time wasn't, thank you so much for pointing out this flaw and our software will get it fixed as soon as possible.

It was, don't ever poke around our software ever again, or we'll stick our general counsel on you.

And that was really sort of the common thread for years.

And so hackers who set out to do the right thing were basically told to shut up and stop doing what you're doing.

And what happened next was they basically started trading this information online.

Now, when you go back and interview people from those early days, they all tell a very similar story, which is they're curious, they're tinkers.

You know, they remind me of like the kid down the block that was constantly poking around the hood of his dad's car.

You know, they just couldn't help themselves.

They wanted to figure out how a system is designed and how they could potentially exploit it for some other purpose.

But they were basically kind of beat down for so long by these big tech companies that they started just silently trading them with other hackers.

And that's how you got these really heated debates in the 90s about disclosure.

Should you just dump these things online?

Because any script kiddie can pick them up and use it for all kinds of mischief.

But, you know, don't you want to just stick a middle finger to all these companies that are basically threatening you all the time.

So there was this really interesting dynamic at play.

And what I learned in the course of doing my book was that government agencies and their contractors sort of tapped into that frustration and that resentment.

And they started quietly reaching out to hackers on these forums.

And they said, hey, you know that 0 day you just dropped online, could you come up with something custom for me?

And I'll pay you 6 figures for it so long as you shut up and never tell anyone that I paid you for this.

So throughout the 90s, there was a bunch of boutique contractors that started reaching out to hackers on these forums and saying, hey, I'll pay you 6 figures for that bug you were trying to get Microsoft to fix for free.

And sort of so began or so catalyzed this market where governments and their intermediaries started reaching out to these hackers and buying their bugs for free.

And in those early days, I think a lot of it was just for quiet counterintelligence, traditional espionage.

But as we started baking the software, Windows software, Schneider Electric, Siemens Industrial Software, into our nuclear plants and our factories and our power grid and our petrochemical facilities and our pipelines, those same 0 days came to be just as valuable for sabotage and war planning.

Does the fact that the market sprung up and you can now make a lot of money change the nature of the attackers that came to the table?

I mean, what is, I guess, you told the psychology of the hackers in the 90s, what is the culture today?

So I think There are people who will tell you they would never sell a 0 day to a 0 day broker or a government.

1 because they don't know how it's going to get used when they throw it over the fence.

You know, most of these get rolled into classified programs and you don't know how they get used.

If you sell it to a zero-day broker, you don't even know which nation state might use it.

Or potentially which criminal group might use it if you sell it on the dark web.

The other thing that they say is that they wanna be able to sleep at night.

And they lose a lot of sleep if they found out their 0 day was being used to make a dissidence life living hell.

But there are a lot of people, good people, who also say, No, this is not my problem.

This is the technology company's problem.

If they weren't writing new bugs into their software every day, then there wouldn't be a market.

You know, then there wouldn't be a problem.

But they continue to write bugs into their software all the time and they continue to profit off that software.

So why shouldn't I profit off my labor too?

And 1 of the things that has happened, which is I think a positive development over the last 10 years are bug bounty programs.

You know, Companies like Google and Facebook and then Microsoft and finally Apple, which resisted it for a really long time, have said, okay, we are gonna shift our perspective about hackers, We're no longer going to treat them as the enemy here.

We're going to start paying them for what it's essentially free quality assurance.

And we're going to pay them good money in some cases, you know, 6 figures in some cases.

We're never going to be able to bid against a zero-day broker who sells to government agencies.

But we can reward them and hopefully get that to that bug earlier where we can neutralize it so that they don't have to spend another year developing the zero-day exploit and in that way we can keep our software more secure.

But every week I get messages from some hacker that says, I tried to see this zero-day exploit that was just found in the wild, being used by this nation state.

I tried to tell Microsoft about this 2 years ago and they were gonna pay me peanuts, so it never got fixed.

You know, there are all sorts of those stories that can continue on.

And, you know, I think just generally, hackers are not very good at diplomacy.

You know, they tend to be pretty snipey, technical, crowd, and very philosophical in my experience.

But, you know, diplomacy is not their strong suit.

Well, there almost has to be a broker between companies and hackers where you can translate effectively, just like you have a zero-day broker between governments and hackers.

Because you have to speak their language.

Yeah, and there have been some of those companies who've risen up to meet that demand.

And HackerOne is 1 of them, BugCrowd is another, Synack has an interesting model.

So that's a company that you pay for a private bug bounty program, essentially.

So you pay this company, they tap hackers all over the world to come hack your software, hack your system.

And then they'll quietly tell you what they found.

And I think that's a really positive development.

And actually The Department of Defense hired all 3 of those companies I just mentioned to help secure their systems.

Now, I think they're still a little timid in terms of letting those hackers into the really sensitive high side classified stuff, but you know, baby steps.

Just to understand what you were saying, you think it's impossible for companies to financially compete with the zero-day brokers with governments?

So like, the defense can't outpay the hackers?

It's interesting, you know, they shouldn't outpay them.

Because what would happen if they started offering 2.5 million dollars at Apple for any 0 day exploit that governments would pay that much for, is their own engineers would say, why the hell am I working, you know, for less than that and doing my 9 to 5 every day?

So you would create a perverse incentive.

And I didn't think about that until I started this research and I realized, okay, yeah, that makes sense.

You don't want to incentivize offense so much that it's to your own detriment.

And so I think what they have though, what the companies have on government agencies is if they pay you, you get to talk about it.

You get to brag about the fact you just found that $2.5 million iOS 0 Day that no 1 else did.

And if you sell it to a broker, you never get to talk about it.

And I think that really does eat at people.

Can I ask you a big philosophical question about human nature here?

So if you have, in what you've seen, If a human being has a 0 day, they found a 0 day vulnerability that can hack into, I don't know, what's the worst thing you can hack into?

Something that could launch nuclear weapons.

Which percentage of the people in the world that have the skill would not share that with anyone, with any bad party?

I guess how many people are completely devoid of ethical concerns in your sense?

So my belief is all the ultra-competent people or very, very high percentage of ultra-competent people are also ethical people.

That's been my experience, but then again, my experience is narrow.

So this was another question I wanted to answer.

You know, who are these people who would sell a zero-day exploit that would neutralize a Schneider Electric safety lock at a petrochemical plant?

Basically the last thing you would need to neutralize before you trigger some kind of explosion.

And I got my answer, Well, the answer was different.

A lot of people said I would never even look there because I don't even want to know.

I don't even want to have that capability.

I don't even want to have to make that decision about whether I'm going to profit off of that knowledge.

I went down to Argentina and this whole kind of moral calculus I had in my head was completely flipped around.

So just to back up for a moment, so Argentina actually is a real hacker's paradise.

People grew up in Argentina and you know I went down there I guess I was there around 2015, 2016 but you still couldn't get an iPhone.

know they didn't have Amazon Prime, you couldn't get access to any of the apps we all take for granted.

To get those things in Argentina as a kid, you have to find a way to hack them.

And it's the whole culture is really like a hacker culture.

They say like, it's really like a MacGyver culture.

You have to figure out how to break into something with wire and tape.

And that means that there are a lot of really good hackers in Argentina who specialize in developing zero-day exploits.

And I went down to this Argentina conference called Echo Party, and I asked the organizer, okay, can you introduce me to someone who's selling zero-day exploits to governments?

Throw a stone anywhere and you're gonna hit someone.

And all over this conference, you saw these guys who were clearly from these Gulf states who only spoke Arabic.

You know, what are they doing at a young hacking conference in Buenos Aires?

And so I went out to lunch with kind of this godfather of the hacking scene there and I asked this really dumb question and I'm still embarrassed about how I phrased it.

But I said, so, you know, will these guys only sell these zero-day exploits to good Western governments." And he said, Nicole, last time I checked, the United States wasn't a good Western government.

You know, the last country that bombed another country into oblivion wasn't China or Iran.

So if we're gonna go by your whole moral calculus, you know, just know that we have a very different calculus down here and we'd actually rather sell to Iran or Russia or China maybe than the United States And that just blew me away.

He's like, we'll just sell to whoever brings us the biggest bag of cash.

Have you checked into our inflation situation recently?

So I had some of those reality checks along the way.

We tend to think of things as, is this moral, you know, is this ethical, especially as journalists.

we kind of sit on our high horse sometimes and write about a lot of things that seem to push the moral bounds.

But in this market, which is essentially an underground market, the 1 rule is like Fight Club.

First rule of the zero-day market, nobody talks about the zero-day market on both sides because the hacker doesn't want to lose their $2.5 million bounty and governments roll these into classified programs and they don't want anyone to know what they have.

And when you're operating in the dark like that, it's really easy to put aside your morals sometimes.

Can I, as a small tangent, ask you, by way of advice, you must have done some incredible interviews?

And you've also spoken about how serious you take protecting your sources.

If you were to give me advice for interviewing when you're recording on mic with a video camera, how is it possible to get into this world?

So you've spoken with a few people, what is it, like the godfather of cyber war, cybersecurity, so people that are already out.

And they still have to be pretty brave to speak publicly.

But Is it virtually impossible to really talk to anybody who's a current hacker?

It's a good question, and this is why I'm a print journalist.

But, you know, a lot, when I've seen people do it, it's always the guy who's behind the shadows, whose voice has been altered.

You know, when they've gotten someone on camera, that's usually how they do it.

You know, very, very few people talk in this space.

And there's actually a pretty well-known case study in why you don't talk publicly in this space and you don't get photographed and that's the Gruk.

So, you know, the Gruk is or was this zero-day broker South African guy lives in Thailand And right when I was starting on this subject at the New York Times, he'd given an interview to Forbes and he talked about being a zero-day broker.

And he even posed next to this giant duffel bag filled with cash, ostensibly.

And later he would say he was speaking off the record, he didn't understand the rules of the game.

But what I heard from people who did business with him was that the minute that that story came out, he became PNG'd.

You know, his business plummeted by at least half.

No 1 wants to do business with anyone who's gonna get on camera and talk about how they're selling 0 days to governments.

And I did hear that he got some visits from some security folks.

And it's another thing for these people to consider.

If they have those zero-day exploits at their disposal, they become a huge target for nation states all over the world.

You know, talk about having perfect OPSEC.

You know, you better have some perfect OPSEC if people know that you have access to those zero-day exploits.

Which sucks because, I mean, transparency here would be really powerful for educating the world and also inspiring other engineers to do good.

It just feels like when you're operating in shadows, it doesn't help us move in the positive direction in terms of like getting more people on the defense side versus on the attack side.

I mean, the best you can possibly do is have great journalists, just like you did, interview and write books about it and integrate the information you get while hiding the sources.

Yeah, and I think what HackerOne has told me was, okay, let's just put away the people that are finding and developing 0 day exploits all day long, let's put that aside.

What about the however many millions of programmers all over the world who've never even heard of a zero-day exploit?

Why not tap into them and say, hey, we'll start paying you if you can find a bug in United Airlines software or in Schneider Electric or in Ford or Tesla.

And I think that is a really smart approach.

Let's go find this untapped army of programmers to neutralize these bugs before the people who will continue to sell these to governments can find them and exploit them.

From a personal side, it's funny enough, after we agreed to talk, I've gotten, for the first time in my life, was a victim of a cyber attack.

So this is ransomware, it's called Deadbolt.

I have a QNAP device for basically kind of coldish storage.

So it's about 60 terabytes with 50 terabytes of data on it in RAID 5 and apparently about 4 to 5,000 QNAP devices were hacked and taken over with this ransomware.

See all Lex Fridman transcripts on Youtube

Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar | Lex Fridman Podcast #266