How Cyberwarfare Actually Works | Wendover Productions

0:00This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online makes sense? There's no place like Chrome. Check responses set up require compatibility and availability varies 18 plus. Imagine if having your cake and eating it too was about banking, not baking. Silicon Valley Bank and First Citizens Bank have created a recipe that blends decades of innovation economy experience with more than a century of stability. Now, you don't have to choose between deep sector expertise and lasting financial security. Instead, you can enjoy them both. Silicon Valley Bank and First Citizens Bank. It's the best of bank worlds. Did you know that mosquitoes have killed almost half of all people who have ever lived? Today, people are fighting back.

1:01With support from the Gates Foundation, American scientists and partners around the world have developed a new generation of bed nets that can kill up to 90% of mosquitoes exposed to them, helping cut malaria rates in half. The result? A safer, healthier future for everyone. The Gates Foundation, partners of human potential. Search Gatesfoundation.org slash mosquito to learn more. The world's new era of warfare started here on the 8th floor of an innocuous office building in Minsk, Belarus. A small antivirus developer based within these walls, virus block a DAW, received an inbound help request. Their client and I ran was experiencing random, repeated reboots of their industrial control computers. It was probably a bug, they thought, a misconfiguration of windows or an issue of two programs not playing nice with each other. So they reinstalled windows for the issue remained. This up the stakes. This wasn't some mistake in Windows programming.

2:01This was something purposefully malicious. Soon, Sergei Ulasen, the company's researcher, found some suspicious files on the Arent machine. As he combed through their code, he made a discovery, a discovery that shook the world of information security to its core. This code, when placed on a USB drive and plugged into a computer, could silently launch an executor program simply by being viewed. This was a bring-in to new exploits, a catastrophically capable exploit. All it took was one drive, simply plugged in to infect one computer. This method of spread was more defyingly efficient. It was something out of a movie. When I was organizing that, the intuitive question was how far it had spread. The answer was chilling. 58 percent. 58 percent of devices in Iran were infected with this malicious code. 58 percent of the country's computers were within the grips of some mystery developers so capable that they had identified an exploit of existential proportions.

3:05And what made this ominous involvement all that much more intimidating was that nobody knew what this code was intended to do. Nobody knew why a high-skilled hacker had spread a groundbreaking worm to 58 percent of Iran's computers. What became clear far quicker is that virus blockade does discovery did not gain prominence for the virus itself. And gain prominence because this small Belarusian anti-virus company had discovered that the world had entered a new era. The world had entered the era of highly advanced, highly targeted, and highly capable cyber warfare. This new era was made possible and perhaps more importantly made profitable by one single concept, the zero day. You see, in decades past, national intelligence agencies and nefarious independent operatives focused on gathering information in transit. Rather than sneaking into the embassy, you intercepted the courier. Rather than placing a bug in the phone, you tapped the transmission line.

4:05It was simply easier to capture information on the move than at its origin or destination. As the digital Asia woke, this MO continued, but then the manufacturers caught up. Apple, Microsoft, Google and others all started encrypting data as soon as it left devices. Shielding information behind complex mathematical systems, encryption by this time was, for all practical purposes, perfect. Therefore, the strategies behind digital espionage had to change. The snoops needed a new way to get in. While the math behind encryption may be infallible, people are not. The devices on which data is created and stored, phones, computers, servers and more are created by people. Therefore, the devices have holes. These holes are referred to as zero days. Any software has vulnerabilities. Most will be caught before release, some will be caught shortly after and quickly addressed with a patch, but a tiny minority will go and notice for weeks, months or years. In the early 2000s, hobby attackers spent their evenings scrolling through code, looking

5:08for these bugs. Faced with hostility and legal threats when reporting vulnerabilities straight to its software's developers, many would post about their findings on online forums, earning little else than bragging rights. Early information security companies would repackage this information and include… This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online makes sense? There's no place like Chrome. Check responses set up require compatibility and availability varies 18 plus. Imagine of having your cake and eating it too was about… Banking. Not baking. Silicon Valley Bank and First Citizens Bank have created a recipe that blends decades of innovation economy experience with more than a century of stability. Now, you don't have to choose between deep sector expertise and lasting financial security.

6:09Instead, you can enjoy them both. Silicon Valley Bank and First Citizens Bank. It's the best of bank worlds. Did you know that mosquitoes have killed almost half of all people who have ever lived? Today, people are fighting back. With support from the Gates Foundation, American scientists and partners around the world have developed a new generation of bed nets that can kill up to 90% of mosquitoes exposed to them, helping cut malaria rates in half. The result? A safer, healthier future for everyone. The Gates Foundation, Partners of Human Potential, search gatesfoundation.org slash mosquito to learn more. It's in a digital threat alert system for companies and agencies. Notifying them when their software might have holes not yet fixed by the developer. One such company, Idefense, found itself faltering in 2002 as they were selling the same information at the same time to the same customer base. They simply had zero competitive advantage. So they created one.

7:09They decided to start paying for exploits. Hankers would come to them with a bug and in exchange for their silence, Idefense would pay anywhere between a couple hundred and a couple thousand dollars. Idefense would then alert their software's developer and its own customers before the competing information security companies could. With the information staying among more trusted hands, this also lowered the likelihood of a vulnerability being used for nefarious reasons. Idefense had created an ethical, profitable system that gave Hankers a first opportunity to monetize their hobby, and so it was no surprise that it grew into a massive success. In mere months, the company went from weeks behind on payroll to a pioneer in the industry. But then the calls started coming, and the area codes were local. The Shantilly Virginia-based company was fielding inquiries from around the DC Beltway. Government contractors wanted to buy their exploits. For the zero days that Idefense had paid three or four figures for, the callers were willing to pay six.

8:11As long as the company stayed quiet, as long as the buyers stayed the only one with knowledge of the zero day, Idefense said now, but they soon found themselves priced out of the very market they had created. Whereas their payouts might fund a vacation, the black market bounties paid for sports cars. They simply couldn't compete. On the other side of the equation, the American military machine had recognized the astonishing potential rising out of a single software susceptibility. Even perturbed by borders, rules of engagement or mortality, cyber warfare had the potential to silently achieve America's strategic goals, so long as they and only they knew about these zero days. In the years since, the market has propagated into a staggering degree of scale and legitimacy. While a thriving black and gray market still exists, especially for sales to countries with concerning human rights records, Western players like the US source the zero day exploits upon which they build their cyber weapons from companies that hardly hide what they're

9:12doing. In the most extreme example, zero day brokers erodeum publishes their priceless. For an exploit capable of running a piece of code on a device or network without user interaction, remote code execution as it's known, the company is willing to pay up to $10,000 on router software. For the same capability, they'll pay up to $100,000 on WordPress and up to a million dollars for Windows. As erodeum is even offering a temporarily higher $400,000 bounty for a remote code execution zero day on Microsoft Outlook, possibly indicating that someone somewhere desperately needs that very exploit for a cyber weapon under development. Remote code execution exploits are the holy grail of zero days. Properly used, they can allow virtually unfettered access to another's machine. Of course, zero days become worthless, essentially the instant they are discovered. Nowadays software developers will quickly pass the exploits upon notification. Therefore, the fact that this malicious code quickly dubs Stuxnet included a remote code

10:14execution exploit that could have sold for hundreds of thousands of dollars indicated that it was designed to do something equally valuable. However, it soon became clear that the .LNK exploit did not stand alone. Laird on top of it was another remote code execution exploit. Stuxnet was designed to embed itself into the file that communicates metadata to printers on a local network. However, with this zero day, that file would end up on all the other computers on that local network. Sionally and quickly. This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50 page restoration block, or finally break down that long article you've had open for weeks. When I and Chrome is here for it, ready to make anything online makes sense? There's no place like Chrome. Check responses set up require compatibility and availability varies 18 plus.

11:14Imagine if this stability piece and the innovation piece were each other's missing piece. First citizens bank and Silicon Valley bank are combining financial security and innovation expertise to create a full suite of solutions for all your business needs. At the scale to back every state of growth from pre-C to IPO and beyond, you have everything you need to make your big ideas click into place. First citizens bank and Silicon Valley bank. It's the best of bank worlds. Did you know that mosquitoes have killed almost half of all people who have ever lived? Today people are fighting back. With support from the Gates Foundation, American scientists and partners around the world have developed a new generation of bed nets that can kill up to 90% of mosquitoes exposed to them, helping cut malaria rates in half. The result? A safer, healthier future for everyone. The Gates Foundation, partners of human potential, search gatesfoundation.org slash mosquito to learn more. Then to complete this bread, the code used to escalation of privilege zero days, each

12:26for different versions of the operating system, allowing it when installed on a single user account to gain access to an entire machine. Four zero days. Four exploits each worth life changing amount of money. This was, in the most literal sense, an unprecedented scale of hacking device. Never before had a piece of code so expertly intertwined for unknown exploits. Whoever was behind this had exhausted enormous resources onto this single one megabyte piece of code, but even as it was being combed through by virus blockata, even as it set the information security industry ablaze, even as it propagated from machine to machine in Iran and beyond, the single most important question remained unanswered. What was Stuxnet designed to do? This is the Naton's nuclear facility, and will neither Iranian officials nor anyone in global information security knew it, by the middle of 2010, the complex had become ground zero for the implementation of the most advanced cyber weapon the world had ever

13:30seen. Hours away from Tehran by car, sitting on the border of the nation's central desert in the shadow of the Carcass Mountains, this uranium enrichment facility is purposefully geographically isolated. Its geographic isolation, however, pales in comparison to its digital isolation. Natons, in response to an earlier, more rudimentary cyber attack, wasn't even connected to the internet as Iran had air gap the facility to protect important and notoriously fickle center futures from outside meddling. For the outside to meddle then, a worm had to be planted manually. At some point in 2009, an unknowing employee at the plant, a spy, or a mole, plugged a contaminated USB stick into a PC running Microsoft Windows. Getting the malware past the air gap however, only marked the beginning. First, using the .lnk zero day, the worm jumped from USB to computer without detection. Then, using the printer's zero day vulnerability, the worm gained access to the facility's local network and spread across the entire enrichment plant.

14:33When detected and inside the Natons network, the malicious code sealed held on to its payload, continuing at search for a very particular target as it went. Conceptually, cyber weapons are rather straightforward. Like most of their physical counterparts, these weapons consist of two primary components, the carrier and the payload. In other words, no matter the level of complexity, every cyber weapon is comprised of code that gains it access into a computer or network and code that informs what the weapon does once it's inside. At this stage, the carrier had so far succeeded. Stuxnet had access to any and all things going on here throughout the administrative and monitoring areas of the facility. Effectively, the enrichment processes surrounding infrastructure. The code's payload and, by extension, the malware's authors, however, weren't interested in crashing the plant's communications network or delivering a one-off denial of service. Instead, they worked toward something more tangible and long-lasting. But the code-wanted access to was buried underground here, where actual physical center

15:36features were using centrifugal force to tear away unwanted isotopes and create uranium 235. Running these center features though weren't PCs, but programmable logic controllers. Industrial control equipment that provided yet another hurdle for the malware. Finally, using stolen security certificates, then zero-day vulnerabilities identified in Seaman Software, a German manufacturer whose PLC's controlled 164 of the Iranian Center Fugus each, the carrier had reached its target, completed its mission, and released its payload. Among the many genius and frightening potentials highlighted by this nefarious code, this episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online makes sense? There's no place like Chrome. Check responses set up require compatibility and availability varies 18 plus.

16:40Imagine if this stability piece and the innovation piece were each other's missing piece. For Citizens Bank and Silicon Valley Bank are combining financial security and innovation expertise to create a full suite of solutions for all your business needs. With the scale to back every stage of growth, from pre-C to IPO and beyond, you have everything you need to make your big ideas click into place. First Citizens Bank and Silicon Valley Bank. It's the best of bank worlds. Did you know that mosquitoes have killed almost half of all people who have ever lived? Today, people are fighting back. With support from the Gates Foundation, American scientists and partners around the world have developed a new generation of bed nets that can kill up to 90% of mosquitoes exposed to them, helping cut malaria rates in half. The result? A safer, healthier future for everyone. The Gates Foundation, partners of human potential, search gatesfoundation.org slash mosquito to learn more. One troubling aspect lies not in what it did, but what it intended not to do.

17:45More days after gaining access to the PLC's controlling the Iranian Center Fugies, the very core of the nation's nuclear program, the payload did nothing but monitor the machines or pianes. Then, after nearly two weeks, the code would briefly speed the center fugies up to 1400 hertz, well beyond their normal operating range of between 800 and 1100. Weeks after that, the code would momentarily slow them down to two hertz, leading to increased wear and tear and thus failure. All the while, as the machine self-destructed at a slightly above average rate, the worm reported to monitors that the center fugies were running at average RPMs, that there was nothing here to see. Essentially, had it not managed to unintentionally escape from the facility, Stuxnet could have potentially continued to cripple Iran's nuclear ambitions from within for years, perhaps even decades before detection. Therefore, prior to June of 2010, the piece of code was simultaneously invisible and physically destructive. A cyber weapon experts couldn't identify, but one that was destroying hundreds upon hundreds

18:49of strategically invaluable Iranian Center Fugies. It's been more than a decade since Stuxnet was first identified. Still, no one has officially claimed responsibility for this first of a kind weapon. The code's scale though, its sheer size and complexity, has created a consensus that this couldn't be the work of one person. While the world's most powerful hackers are likely to get their hands on a single zero day, Stuxnet employed a staggering 4. Nor could this be the work of a group of activists or even a minor nation state either. At a megabyte, Stuxnet was orders of magnitude larger than any malware discovered before it. And it wasn't just massive either. It was incredibly precise. Laying dormant in computers across the globe and only weaponizing its devious payload when connecting to Siemens Step 7 software linked to a PLC running exactly 164 Center Fugies. Such size signal that this was a weapon designed across years while such clinical precision signal the code was crafted with potential future lawsuits in mind.

19:53In short, just in the worm's design, experts the world over concluded it had to be crafted by a major world power or multiple with the time and resources to approach such an unprecedented undertaking and it had to be a world power or multiple that wasn't so friendly with Iran. Information in the actual code and geopolitical context aren't our only clues as to who is behind this though. Cybersecurity experts have conducted countless interviews on background and poured over troves of leaked documents since the worm appears. What they found was that the development of Stuxnet was described as a third option that existed somewhere between doing nothing to slow Iran's nuclear advance and launching air strikes to destroy the enrichment facilities. As an alternative was how the weapon was first presented to President Bush, then to Israeli officials, then eventually to President Obama, all of whom supported its implementation. What the journalists revealed was that the US and Israel had ushered the world into a new era of state-led cyber offensive that wreaked physical destruction.

20:57Before this point, nation states, the US for the NSA and Israel through its unit 8200, reduced cyber divisions to defend and surveil. Now they were going on the offensive. By crossing the Rubicon though and getting caught, the actions of the US and Israel have opened Pandora's box. Though Iran denied involvement, in 2013 major American banks were hit with a concerted attack. American intelligence identified it as retaliation by Irene in a worrying lesson as to how quickly the rival's cyber capabilities were expanding. Bringing up American banks in 2013, however, only marked the beginning. Since the US unleash Stuxnet, other nation states have worked to close the side. This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome, that's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had opened for weeks. Gemini and Chrome is here for it.

21:57Ready to make anything online makes sense? There's no place like Chrome. Check responses set up require compatibility and availability varies 18 plus. Imagine if this stability piece and the innovation piece were each other's missing piece. First citizens' bank and Silicon Valley Bank are combining financial security and innovation expertise to create a full suite of solutions for all your business needs. With the scale to back every stage of growth, from pre-C to IPO and beyond, you have everything you need to make your big ideas click into place. First citizens' bank and Silicon Valley Bank, it's the best of bank worlds. Did you know that mosquitoes have killed almost half of all people who have ever lived? Today, people are fighting back. With support from the Gates Foundation, American scientists and partners around the world have developed a new generation of bed nets that can kill up to 90% of mosquitoes exposed to them, helping cut malaria rates in half. To result, a safer, healthier future for everyone.

22:59The Gates Foundation, partners of human potential, search gatesfoundation.org slash mosquito to learn more. CyberWeapon Gap, many of which the US has a best, a tenuous relationship with. North Korea, largely through its state-backed hacker organization, the Lazarus Group, was able to infiltrate Sony Pictures in 2014, then in 2017, the countries want to try ransomware force the UK's National Health Service to work off pen and paper. Every year, China's cyber warfare division grows stronger from the talent scouted and zero days identified at the Chan Fu Cup, where competitive hackers tear into Google, Microsoft, and Apple software. In 2017, Russian cyber attacks brought Ukrainian banks, utilities, and government agencies to their knees. In 2021, ransomware software locked up the US's colonial pipeline. During the speed at which the rest of the world catches up to the US, is the fact that American weapons are spreading. The United States has long been considered a leader, if not the leader in cyber warfare,

24:01but a 2017 leak by a hacker group known as the Shadow Brokers unleashed the American NSA's hacking tools for the entire world to use. Today, experts have reached a concerning consensus. The capability for catastrophic cyber warfare exists more acutely now than at any point before, changing the very landscape for current and future conflicts. Traditional weapons have consequences for the aggressors. If Russia were to deploy a nuclear weapon, mutually assured destruction would dictate a swift response by the target nation. Cyberweapons are different. It took years for major media organizations to start pointing towards the US and Israel as the forces behind Stuxnet, and much of the proof came from tacit acknowledgement by the American and Israeli government officials themselves. When the stakes get raised, so will the secrecy. Cyberwarfare has a potential for destruction without consequences. In this new battlefield, there are no rules of engagement, there are no Geneva conventions,

25:04there are simply cutting-edge aggressors and vulnerable targets who have not yet realized the doors they've left open. Experts believe that today represents a waiting period. The weapons exist, they've been developed, and they could even be out there already, embedded in the world's machines, laying dormant until the time comes for them to unleash the destructive potential. But by and large, that time has not yet come. Faced with reality that each individual weapon can only be used once until vulnerabilities are patched, the nation states and organizations behind these have yet to find the will to unleash a truly devastating attack on a major nation, an attack that will wake the world up to the truly existential nature of this new battlefield. But that time is coming. The big ones coming. Wars will no longer be fought in far off lands that can be ignored simply by turning off the TV. They will be fought in the technology that has come to envelop every moment of modern life.

26:05The US and Iran have had an incredibly tentrall relationship for the better part of the last century and the context of what led to Iran's nuclear program and therefore what led to the US's development and deployment of Stuxnet stretches back into the 1950s. If you want to learn about that other side of this topic, I'd highly recommend you watch Real Life Floor's Modern Conflicts episode about US Iranian relations on Nebula. That's exclusive to Nebula since YouTube content guidelines make it tricky to cover conflicts. This is just one of a huge number of exclusive videos on Nebula. If you're the type of person that endlessly scrolls through streaming platforms struggling to find something you want to watch, the Nebula is for you because it's more stuff by the creators you already watch and love. After the modern conflicts episode, you can watch our feature length dock on the crisis and conflict brewing in the American West with the drying up of the Colorado River. Then watch Half as Interesting's Travel Base King show where I'm chased across the country trying to break weird laws along the way. Then watch real engineering spectacularly produce series on the Battle of Britain. Then watch Tom Scott's ingeniously designed game show, money featuring a much younger

27:07me and I could keep going, but that's probably already a week's worth of content so you get the point. Amazingly, the cheapest way to get access to Nebula gets you access to a whole other streaming site too. CuriosityStream. There you can watch a huge catalog of non-fiction shows and documentaries including the King of the Cruise, a captivating quirky documentary about a Scottish Baron who essentially lives on cruise ships seeking attention while telling fantastical stories to other cruisers. CuriosityStream and Nebula have a bundle deal so when you sign up for any subscription at curiositystream.com slash when dover, you'll get access to both. And the price is unbelievably low, just 1479 for the year for both. That's less than the monthly price of other sites that you probably use less and you'll be supporting loads of independent creators while you're at it. So click the button on screen or head to curiositystream.com slash when dover to sign up today. In the US there's a break in every 26 seconds, but when intruder step near, simply safe home security steps up. Stop, this is simply safe.

28:07Police are on the way. Using AI alerts, US-based live agents help deter break ins, simply safe no long-term contracts. Safe 60% on a new system with professional monitoring during our 20th anniversary sale at simplysafe.com slash Spotify. Outdoor deterrence requires a simply safe active guard outdoor protection plan starting at 4999 a month. Visit simplysafe.com slash licenses for alarm license information, Tennessee 2012.