# This Is How They Tell Me the World Ends by Nicole Perlroth - Blinkist

What’s in it for me? Find out just how much of an impending threat cyber weapons are.

On December 23, 2015 – just before Christmas celebrations were about to start – Russia shut off the electricity and heat across western Ukraine.

Ever since Ukraine had won its independence in 2014, Russia had been retaliating by unleashing a digital assault on Ukraine's government and media agencies, and now they were proving just how effective those attacks had been.

Russian hackers had embedded themselves in networks that controlled Ukraine’s infrastructure, and to prove that they still had control over the nation, they turned the power off for six hours in the dead of winter.

For good measure, they did it again a year later, blacking out the city of Kiev.

Never before had a nation crossed this line and hijacked another country’s grid.

But the reality of the situation is that this attack wasn’t something that just happened out of the blue.

For years there’d been an escalating arms race going on around the world.

Only this time it wasn’t rockets and ballistic weapons; it was lines of digital code that allow almost any device that uses a computer chip to be hacked.

This is the story of how we got to this point, and how increasingly vulnerable we’re making ourselves by connecting more and more things to an internet that’s anything but secure.

Ground Zero-Days

In these blinks, you’ll learn  what a zero-day is and why they’re so important; how tax-payer money is used to pay hackers for new surveillance tools; and how the NSA’s best hacking tools were released to the public.

The author began covering the cybersecurity beat for the New York Times in 2010.

By 2013, she was already feeling the side-effects of the job.

She’d uncovered stories of Chinese hackers getting inside everything from printers to thermostats, and trying to steal intellectual property that ranged from military planes to the formula for Coca-Cola.

Iranian hackers had already brought down the network for the Saudi oil company Aramco, wiped its data, and destroyed 30,000 computers while leaving an image of a burning American flag on every screen.

So, after just a few years reporting on the topic, anything with a plug was beginning to look suspicious.

As a much-needed escape from the internet, the author booked a weeklong tour through Kenya.

But her African vacation was cut short when Edward Snowden decided to give the world a peek into the dark recesses of America’s National Security Agency, or NSA.

In his position as an NSA contractor, Snowden leaked thousands of highly classified NSA documents.

These documents revealed that America’s premier spy agency was – surprise – pretty good at spying.

In fact, its tools and capabilities were better than most.

The bigger surprise was that many people believed that digital encryption was still keeping networks and information safe.

Snowden’s leak blew that line of thinking wide open.

It was clear that the NSA had found a myriad of ways to hack around encryption.

In some cases, the NSA was paying companies to give it backdoor access to their data, but, in other cases, the backdoors came from what are known as zero-days.

Now, a zero-day is essentially a flaw in a piece of hardware or software that, when exploited, allows someone undetected access.

This means the flaw hasn’t been made public, so there’ve been zero days for the company to come up with a patch.

For example, if you surf the web using Microsoft Explorer, a zero-day flaw for that web browser could allow someone to invisibly hack into your browser, steal your passwords, credit card information, or emails – and even download your data or record your keystrokes.

The Snowden leaks showed that the NSA had accumulated a good number of zero-days that provided it with access to all of the most widely-used apps, social-media platforms, phones, computers, and operating systems.

When this news got out, some people assumed that companies like Apple and Microsoft were in cahoots with the NSA.

But this wasn’t the case.

These companies were livid when they learned that the NSA knew about these zero-days and didn’t let them fix the flaws.

Perhaps even more worrisome is the fact that the NSA didn’t always find and develop these zero-days itself.

It bought them, with taxpayer money, from hackers around the world.

As we’ll see in the next blink, the marketplace for zero-days is a morally dubious gray zone that has only gotten darker in recent years.

The First Rule of the Zero-Day Market

The Snowden leaks offered a glimpse of what zero-days are capable of.

But people familiar with cybersecurity and the hacking community were already well aware.

The author knew that hackers earned a lot of money by selling zero-days and exploits to brokers and bidders.

What she didn’t know was who those buyers were.

Months before Edward Snowden became a household name, the author was attending one of the world’s many hacker conventions.

This one was in South Beach, Florida.

After a while, she found herself sitting at a table with Ralph Langner, a German security specialist, and two Italian hackers.

The author wanted to learn more about how the zero-day market worked, so she asked the two Italians to elaborate on their business practices.

For instance, who do they typically sell to?

Are there countries like Russia or Turkey that they might think twice about selling to?

But neither of the Italians would offer even a hint.

It turns out there’s often a legal component to such silence.

The author later learned that selling a zero-day often involves the seller signing a nondisclosure agreement.

Such NDAs usually stipulate that the hacker won’t mention the details of the sale for a certain period of time.

But this doesn’t mean nothing is known about the zero-day market.

In the early 2000s, hackers often posted their zero-day exploits on message boards.

Some would also attempt to bring flaws to the attention of companies like Microsoft.

But, for the most part, they were treated like someone who’s just told you they broke into your house last night.

Instead of thanks, the hackers were handed lawsuits.

One of the first companies to see a different way of doing things was iDefense.

A fledgling security outfit, iDefense offered its clients information about potential dangers so that they could start working on a patch.

For the most part, early security companies simply monitored places like BugTraq, but iDefense knew that not every hacker wanted to settle for the street cred that came with posting an exploit on a message board.

So, in 2002, iDefense started a new plan: it would offer hackers money for their zero-days, and then the security company could inform its clients.

Everyone would benefit.

The only problem was, companies like iDefense could only spend so much.

The most it could afford was a couple of thousand dollars per verified exploit.

By 2005, government-intelligence agencies were entering the market, armed with much bigger budgets.

The key difference here is that agencies like the NSA weren’t spending big bucks to inform the companies affected – instead, they did the exact opposite and kept the zero-days under wraps.

After all, a digital spy tool is only good if the vulnerabilities remain unpatched.

This is how Americans ended up having their tax dollars spent on keeping the vulnerabilities in their computers and phones a secret, both from the companies that made the products and from themselves.

Money vs. Morals

Any market where details are hidden, where buyers and sellers can’t discuss things, is bound to be trouble.

The zero-day market is no exception.

For starters, since zero-day sales are private, sellers can’t estimate a fair price for their work.

Sellers also don’t know how their zero-day will be used.

And if sellers think they’ve been cheated or misled, there could be consequences.

To further complicate things, buyers need to verify that a zero-day works before money changes hands.

What prevents them from testing it, declining to buy, and then using it anyway?

On the other hand, buyers have to put a lot of trust in sellers as well.

Who’s to say that a hacker won’t sell a zero-day to multiple countries around the world, even if that hacker has agreed not to?

It’s not like these agencies are going to openly compare their inventory.

As a result, the market relies on a ridiculous amount of trust.

Sellers essentially promise not to talk about their activities, much as mobsters adhere to omertà, a code of silence.

And everyone likes to think that buyers operate on a samurai code of Bushido, which dictates a morally upstanding way of life.

These are very dangerous things to rely upon when dealing with information that erodes liberties and puts the safety of the world at risk.

When the author was at the Florida hacker convention, and the two Italians refused to answer her question, Ralph Langner, the German security specialist, grew irritated.

He turned to the author and spoke loud and clearly, “These men are young.

They have no idea what they are doing.

All they care about is money.

They have no interest in learning how their tools will be used, or how badly this will end.

” It wasn’t until 2015 that a broker from the zero-day market finally agreed to speak openly but anonymously to the author.

Starting in the late 1990s, the broker began working at one of the major contractors who bought zero-days for US intelligence agencies.

The agencies came with requests, like finding a way into a Russian embassy or a Pakistani consulate.

The broker’s team would find out what kind of technology these places had and then find a way in.

So, while a Microsoft Windows bug in the early 2000s might have earned someone $50,000, a bug for some obscure program that was being used by a foreign target could go for double that amount.

But as the 2000s rolled on, it wasn’t just US agencies that were looking to buy.

Other governments began cold-calling hackers and brokers asking, What have you got?

The international market came in strong in the mid-2000s, offering unprecedented amounts of money for zero-days.

For some, the money was enough to trump any questions about morality.

For others, there wasn’t a question at all.

These people merely exposed flaws in programs and systems; they didn’t weaponize them or use them to spy on people.

They were happy to let somebody else worry about that.

Going Public

Of course, some hackers do have a strong sense of right and wrong.

Take Charlie Miller, for example.

Miller worked at the NSA before stepping down for family reasons.

But he never stopped dismantling code and finding new vulnerabilities.

In fact, he once created a fake stock-market app for the iPhone that gave him access to every other app a person had installed.

This proved to Apple that its screening process wasn’t so flawless after all, and earned Miller the nickname Zero-Day Charlie.

But that wasn’t his biggest discovery.

He later uncovered a zero-day for the Linux operating system worth a lot of money.

But when he went to try and sell it, he immediately discovered just how inefficient and unfair the market was.

He couldn’t tell how much he should be asking, and he couldn’t be sure that a potential buyer wouldn’t just rip it off and not pay him.

Ultimately, Miller sold his zero-day to an unnamed government agency for $50,000 and a two-year period of silence.

But he wanted to expose the problems in the market so that sellers weren’t at such a disadvantage.

After the two-year waiting period, Miller planned on publishing an academic paper entitled “The Legitimate Vulnerability Market: Inside the Secretive World of Zero-Day Exploit Sales.

” Unsurprisingly, the NSA wasn’t too happy about this.

Agents even flew out to St.

Louis to meet with Miller at the airport.

Miller was expecting a buyout, a nice bag of cash in order to keep him quiet.

Instead, the agents simply urged him to keep his mouth shut.

But Miller didn’t shut up.

In 2007, he presented his paper at a conference at Carnegie Mellon.

This was the day the world at large was made aware of the zero-day market.

To the general public, it barely made a ripple, but to hackers and the companies whose hardware and software were being exploited, it was a momentous occasion.

Some hackers thought Miller was committing a grave offense: breaking the omerta.

But others cheered him on.

By exposing the government-funded market, he was showing that hackers weren’t just the criminals the computer companies were making them out to be.

Their work was worth something.

For a while, Miller thought this would change everything.

He soon uncovered a zero-day that could remotely control someone’s iPhone.

But this time he handed it over to Apple.

And when he found another zero-day for the new Android operating system, he brought it to Google.

At first, Google seemed interested in working with Miller to patch the vulnerability, but he soon discovered that Google was communicating with Miller’s boss, trying to get him fired.

This was the last straw.

In 2009, Miller started a No More Free Bugs campaign that caught on like wildfire.

After all this, they still wanted to treat hackers like the enemy?

Then it would only mean that those hackers would go back to selling their zero-days elsewhere.

An Impossible Mission

For a long time, each country used different equipment.

Russia had its hardware and software, the US had its, and never the twain shall meet.

If something infected a Russian computer, the US didn’t have to worry about that infection crossing the globe and plaguing US computers.

Of course, those days are long gone.

Now, everyone’s using the same type of hardware and software and we’re all connected by the same internet.

So, anything that gets used on an adversary can easily turn around and bite the hand that released it.

In the US, the ever-growing stockpile of weaponized zero-days grew incredibly in the wake of 9/11.

After 9/11, new cybersecurity laws meant that electronic surveillance no longer required a court order, and the intelligence budget ballooned from a few billion to $75 billion.

Suddenly, agencies had a lot more money to buy and develop zero-days, just as more and more people around the world were getting online and digitizing their information.

American advancement in using and weaponizing zero-days can best be understood by looking at what happened in Tehran in 2007.

As Iran was ramping up its nuclear-weapons program, Israel was getting ready to strike.

Things weren’t looking good.

In the US, George W.

Bush was being briefed on possible outcomes of this conflict and many were pointing to a possible World War III situation.

Bush called for a new option.

Naturally, the NSA had already analyzed every detail of Iran’s nuclear facilities.

It already had zero-days lined up for every kind of machine being used.

At the time, this was all standard espionage stuff, used for information gathering.

But now it was going to weaponize these tools in the hopes of preventing war from breaking out.

It was called Operation Olympic Games and, in some ways, it was a marvel of ingenuity.

A string of seven zero-days found its way into a compound that wasn’t connected to the internet.

It then spread throughout the computers undetected, found its way to the program that controlled the centrifuges, and attacked those centrifuges without anyone noticing what was happening.

It took a long time before Iran figured out what was wrong.

And then, in June 2010, the worm escaped the facility.

An outside laptop was probably brought in to conduct a test – but, whatever the case may be, once the worm got onto a connected computer, it was pandemonium.

Russia, California, India, Europe, Indonesia – the bug was everywhere, and it quickly picked up an official name: Stuxnet.

Over a hundred countries and tens of thousands of machines were infected.

And one German, Ralph Langner, put the pieces together.

He took apart the code and noticed one important target number, 164, which happened to be the number of centrifuges in Iran’s nuclear facility.

But Langner wasn’t the only one pulling Stuxnet’s code apart and figuring out how this unprecedented cyberweapon worked.

Now, the weapon was ready to be turned against its maker.

A Booming Stockpile

In 2011, Langner gave a presentation at an annual TED conference.

He provided a thorough and understandable description of Stuxnet, and explained the ramifications of what happened when this advanced cyberweapon found its way into the wild.

His point was clear: there was nothing stopping a person from making a few adjustments and pointing Stuxnet at a chemical plant, a factory, or a power grid.

This was serious.

The irony wasn’t lost on Langner: the US had used a dangerous cyberweapon to avert a conventional war; in the process, that weapon had become available to enemies of the US; and this had happened right at the dawn of a new, cyber-based era in warfare.

Meanwhile, Iran was upset and looking for revenge.

With the ingenuity of Stuxnet making headlines around the world, the marketplace for zero-days only got bigger.

Every country with a security agency was eager to start its own stockpile of cyberweapons.

Some NSA employees were getting poached to start working overseas in places like the Emirates, where a company called CyberPoint paid a lot more than a government agency like the NSA ever could.

One such employee was David Evenden.

He abruptly left when it became apparent that, more often than not, his efforts were being used to spy on activists and political dissidents, not terrorists.

In the US alone, from 2013 to 2016, there was a twofold increase in the number of brokers selling surveillance technology.

Vupen, a French company run by Chaouki Bekrar, saw its sales to government agencies double year-over-year.

Israel, Russia, India – they were all willing to spend just as much as the US on cyberweapons.

By 2013, Antarctica seemed to be the only part of the world that wasn’t buying.

Bekrar flaunted the fact that Vupen’s clients didn’t heed the moral principles of Bushido.

His Twitter avatar was Darth Vader.

He took no responsibility for what governments did with his zero-days.

In 2015, the Hacking Team, an Italian brokerage, had its internal emails and contracts leaked to the public.

The leak revealed the brokerage’s callous disregard for vetting clients.

Any government was acceptable, regardless of its human-rights record, as long as the money was good.

So they sold zero-days to Russia, Egypt, Saudi Arabia, Kazakhstan, and even Sudan, a place described by US aid workers as “one of the most horrendous human rights situations in the world.

” The Hacking Team, as well as other sellers, was helping to supply all these governments with the tools to monitor and suppress dissidents, journalists, and innocent people.

Like the nuclear weapons of the Cold War, some countries weren’t stockpiling cyberweapons for everyday use.

There was simply an increasing sense that it was better to have them than not.

The sheer number of zero-days was also increasing rapidly, with books like The Shellcoder’s Handbook: Discovering and Exploiting Security Holes giving new hackers a leg up in the business.

But it would all pale in comparison to what would be released in the years to come.

Install Now!

In mid-December 2009, Google’s information-security team noticed something was amiss.

Alarms were being triggered throughout its network.

Something was inside, ping-ponging wildly around the system.

Usually, some malware might show up when a careless intern visited an online gambling site, but this was different.

This intruder was looking for something.

It took weeks of round-the-clock work by a team of around 250 workers, but the intruder was eventually rooted out and shown to be of Chinese origin.

Remarkably, China had hacked Google’s network and stolen its source code.

More specifically, it was an operation pulled off by Legion Yankee, one of the most elite hacking groups that works under contract for the Chinese government.

Information about satellite technology, missiles, aerospace, nuclear propulsion – elite Chinese hackers have broken in and stolen all of this and more.

And now they’d gotten their hands on the backbone technology behind Google’s operations, likely in an effort to set up backdoors that would allow China to indefinitely monitor the Gmail accounts of political dissidents.

This break-in changed the way Google dealt with zero-days from then on.

The general consensus was: this can’t happen again.

Part of the new plan?

Paying hackers for zero-days.

Starting in 2010, hackers who could report verified flaws in Google products could earn a bounty of up to $31,337 – that’s “elite” spelled out in hacker code.

That was nowhere near as much as the amount the international market was paying out, but it did come with some bonuses.

Hackers were free to brag about their newly discovered exploit, and they didn’t have to worry about playing a role in helping some nation-state stomp on people’s liberties.

Companies like Microsoft and Facebook also began to pay bounties rather than hand out lawsuits to hackers who turned over zero-days.

But some sellers balked at the low rewards.

In 2012, Vulpen’s Chaouki Bekrar broke into the newest Chrome browser in three hours and laughed off the idea of reporting it to Google.

He told a reporter, “We wouldn’t share this with Google for even $1 million.

We want to keep this for our customers.

” Naturally, this drove the tech companies crazy.

But it did finally strengthen their resolve to start getting serious about security, rather than only concerning themselves with getting products out faster than the competition.

Soon, Microsoft was getting 200,000 vulnerabilities turned over to them every year.

Two-hundred thousand different ways for its products to be abused.

That translates to 200,000 patches that Microsoft, one of the best tech companies in the world, has to come up with every year.

Now just think about all the unreported vulnerabilities, across all platforms and all devices.

For people like Bekrar, each one is a potential payday.

Needless to say, when your operating system offers a verified update, don’t wait – install it now!

Cyberweapon Diplomacy

During the Obama administration, everything was being digitized.

Smartphones became ubiquitous.

With social media and cloud servers, people were dumping their entire lives onto the internet.

And during this time, there were three main threats to US cybersecurity: Iran, China, and Russia.

In 2015, Obama tried to neutralize two of these threats.

First, he struck a nuclear deal with Iran, and it seemed to work.

Attacks from Iran largely stopped.

The focus then shifted to Beijing.

For years, Chinese hackers had been relentless, stealing intellectual property with abandon.

They stole everything from the formulas for Benjamin Moore paints to the plans for F-35 fighter jets.

By 2015, they’d even been found sitting inside the network at the Office of Personnel Management, the US agency that stores the personal information, including fingerprints, of all government employees.

They’d likely been hiding there for years before anyone noticed.

In September 2015, Obama invited Xi Jinping to the White House.

The red carpet was rolled out.

There was cannon fire, a military band playing the Chinese anthem, and kids waving Chinese flags.

But it was still a tense couple of days as Obama pressed the issue.

This wasn’t about espionage.

Both parties knew that the US was eavesdropping as well.

But the stealing had to stop, or else there’d be sanctions.

The two sides agreed.

No more intellectual-property theft, and no targeting of critical infrastructure during peacetime.

For two years the Chinese cyberattacks dropped by 90 percent.

But neither of these digital truces was going to last.

Not with Trump in the White House.

Meanwhile, the Russians had embedded themselves in the system.

By early 2013, there’d been at least 198 attacks on US infrastructure systems, and security outfits trying to pick apart the code kept finding traces of Russian language and Moscow timestamps.

Russia’s weapon of choice for these attacks was dubbed Sandworm.

It specifically targeted General Electric software, the kind used around the world to control water treatment facilities, electric grids, and oil and gas pipelines.

In 2014 and 2015, the world got a taste of what this weapon was capable of when, on two separate occasions, Russia turned off the power in Ukraine.

As far as US intelligence could determine, Russia was sitting in the systems and networks of US infrastructure as a warning.

The message was, Beware how you respond to our actions in Ukraine.

We can turn off your electricity, too.

It was a new age of mutually assured destruction.

So, despite the unprecedented nature of these attacks, the world’s response has only been to continue hooking up more devices and critical infrastructure to the internet, thus increasing our vulnerability.

The Keys to the Kingdom

In August 2016, chaos reigned in the US.

It was an election year and, by then, Russian hackers had already broken into the servers of the Democratic National Committee, as well as the email account of Hillary Clinton’s campaign manager.

They were releasing their stolen goods through Wikileaks.

Then, more bad news arrived.

On Twitter, a group calling themselves the Shadow Brokers claimed to have found a collection of NSA cyberweapons, which it was now dumping onto the internet as a free-for-all.

As one former NSA employee said, “These are the keys to the kingdom.

” Things were getting bad, and they were going to get worse.

While Snowden’s earlier leaks were an eye-opener, the tools he was aware of were just the tip of the iceberg.

He was only a low-level contractor; he didn’t know what was at the disposal of the elite NSA group formerly known as TAO, or Tailored Access Operations.

These tools included a string of zero-days that targeted Microsoft software protocol.

It was called EternalBlue, and it could jump from server to server, barely leaving a trace.

Though used for gathering intel, EternalBlue could, if it fell into the wrong hands, be turned into a deadly weapon.

So, imagine the NSA’s dismay when, in April 2017, the Shadow Brokers decided to release EternalBlue, as part of a collection of 20 of the NSA’s best zero-day exploits.

Of course, now that it was in the open, Microsoft could theoretically patch the vulnerabilities.

But that would mean that every computer running on an old or bootlegged version of a Windows operating system would have to install the right upgrades.

It was essentially an impossibility.

Within weeks, the number of computers infected by versions of EternalBlue was quadrupling.

But it soon became apparent that one variation of the weapon was proving most popular: ransomware.

This is the practice of taking over a system, such as a hospital’s patient files or a city’s power grid, and holding it ransom for a cash payout.

In particular, North Korea was discovering that ransomware was an effective way of generating much-needed revenue.

One of the most effective ransomware attacks was an exploit known as WannaCry, released in 2017 and eventually traced back to North Korea.

Within 24 hours it’d spread to 150 countries.

Why was it so effective?

Its code can be traced back to EternalBlue.

Likewise, new Russian cyberattacks, like the malware known as NotPetya, also have roots in EternalBlue.

Ultimately, ransom attacks have generated billions of dollars and they’re only becoming more common.

Between 2019 and 2020, over 600 American towns and cities have been held hostage by ransomware.

All evidence seems to point to things getting worse before they get better.

The author keeps flashing back to a photo she came across of a hacker from New Zealand.

In it, he’s wearing a T-shirt with an important message plastered across the chest: SOMEONE SHOULD DO SOMETHING.

Final summary

The key message in these blinks: Most experts admit that it’s an impossibility for a computer network to be made completely impervious and secure.

However, that doesn’t mean improvements can’t be made.

For the past few decades, the emphasis has always been on offense, not defense.

The US has been busy finding and weaponizing exploits while leaving its critical infrastructures and products vulnerable to attacks.

US hardware and software companies have been operating under the philosophy of getting their products out as fast as possible while worrying about the details later and fixing problems with updates and newer models.

Instead, they should be focusing on testing and retesting security before any products are released or any systems and networks are put online.

In Norway and Japan, government regulations strictly control and test the security for systems being used for communications, finance, transportation, and electricity.

After Japan implemented these measures in 2005, cyberattacks dropped by 50 percent.

Rather than following suit, Trump eliminated the role of national cybersecurity coordinator in 2018.

This role must be reestablished and strengthened.

It would also help if new rules were put in place regarding vulnerabilities.

The NSA held on to EternalBlue’s Microsoft vulnerabilities for three years.

This is far too long, especially for such widely used software.

At the very least, the US should put a time limit on how long an intelligence agency can keep a zero-day under wraps, and when those zero-days are turned over, advisory notices should be made available to the public so that users are made aware.

These are just a few of the author’s ideas, and they aren’t full-proof solutions, but they’d at least be a step in the right direction.

Got feedback?

We’d love to hear what you think about our content!

Just drop an email to remember@blinkist.

com with This Is How They Tell Me the World Ends as the subject line and share your thoughts!