Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar | Lex Fridman Podcast #266

If one side is hacked, you can just unleash all hell.

We have stumbled into this new era of mutually assured digital destruction.

How far are people willing to go?

You can capture their location. You can capture their contacts that record their telephone calls, record their camera without them knowing about it. Basically, you can put an invisible ankle bracelet on someone without them knowing. You could sell that to a zero-day broker for $2 million.

The following is a conversation with Nicole Perlroth, cybersecurity journalist and author of This Is How They Tell Me The World Ends: The Cyber Weapons Arm Race. This is the Lex Fridman Podcast. To support it, please check out our sponsors in the description. And now, dear friends, here's Nicole Perlroth. You've interviewed hundreds of cybersecurity hackers, activists, dissidents, computer scientists, government officials, forensic investigators, and, uh, mercenaries. So let's talk about cybersecurity and cyberwar. Start with the basics. What is a zero-day vulnerability and then, um, a zero-day exploit or attack?

So (sighs) at the most basic level, let's say I'm a hacker and I find a bug in your iPhone iOS software that no one else knows about, especially Apple. That's called a zero-day because the minute it's discovered, engineers have had zero days to fix it. If I can study that zero-day, I could potentially write a program to exploit it, and that program would be called a zero-day exploit. And for iOS, the dream is that you craft a zero-day exploit that can remotely exploit someone else's iPhone without them ever knowing about it, and you can capture their location. You can capture their contacts that record their telephone calls, record their camera without them knowing about it. Basically, you can put an invisible ankle bracelet on someone without them knowing, and you can see why that capability, that zero-day exploit, would have immense value for a spy agency or a government that wants to monitor its critics or dissidents. And so there's a very lucrative market now for zero-day exploits.

So you said a few things there. One is iOS. Why iOS? Why- which operating system? Which one is the sexier thing to try to get to or the most impactful thing? And, uh, the other thing you mentioned is remote versus, like, having to actually come in physical contact with it, though. Is that the distinction?

So iPhone exploits have just been a government's number one priority. Recently, actually, the price of an Android remote zero-day exploit, something that can get you into Android phones, is actually higher. The value of that is now higher on this underground market for zero-day exploits than an iPhone iOS exploit. So things are changing.

So the- there's probably more Android devices, so that's why it's better, but then the iPhone side, if I- so I'm an Android person because I'm a man of the people, but it seems like all the elites use iPhone, all the people at nice dinner parties. So, uh, is that, is that the reason that, like, the more powerful people use iPhones? Is that why?