All language subtitles for Cyberwar.S01E09.The.Zero.Day.Market.1080p.AMZN.WEBRip.DD+2.0.x264-Cinefeel

BEN: They're security holes
in a piece of software.

I could have made all the
transmissions go to neutral

for a million cars.

They're unknown
to their creators.

You can find it yourself,

you can hire somebody to find
it, or you can be attacked.

It can be exploited
for covert attacks.

Our ultimate goal is not
to attack, but to defend.

They're coveted by
hackers and spies alike.

We are going to bring the
full array of US national power

to bear to protect US interests
and those of our allies.

But what do they want them for?

♪

They call them zero-days.

Hackers hunt for them,

but most people have
no idea what they are.

Put simply, a zero-day is a flaw
in a specific piece of software,

a vulnerability that
the software company

doesn't even know about.

That code could be running on
everything from your iPhone

to the webcam on your computer

to the network
protecting the Pentagon.

And if these holes
aren't fixed with new code,

hackers can design exploits,
or figurative torpedoes,

to attack the software.

Charlie Miller discovered one of
the most mind-blowing zero-days

in recent history.

He's a former NSA hacker

and world-renowned security
researcher based in St. Louis.

Back in 2015, he and a partner
actually found a way to remotely

hack into Chrysler models
with a specific computer system,

and they could do it from
thousands of miles away.

And it wasn't just turning
the music up or jacking the AC;

they could seriously
mess up a car on the road.

I got in touch with
Charlie and asked him

if he'd hack one of these cars
while I was behind the wheel.

- I'm Ben.
- Charlie. How's it going?

So this is the car?
This is it?

Yeah, you ready to get hacked?

(Laughing)
Yeah!

So what part of this car
exactly did you target

that was hackable?

So this part right here,
it's called the head unit,

and that's the part
that we actually hack.

The fact it's on the internet,
and that we could talk to it,

and there was a vulnerability

that allowed us to actually
get code running on it.

We could do it remotely,
but we told Chrysler about it

and they fixed it, so now you
can't do it remotely anymore.

How long did it take
for them to patch it?

Well, first I
told them about it,

and for nine months
they were working on it.

And then once we
sort of publicized it,

then they fixed it
within a week.

So it was... once everyone
was really upset,

they could fix it
very quickly.

So now I'm physically
plugged into the head unit.

Okay, so I can start
showing you some stuff here.

What was the... What was the,
I guess, more dangerous thing

you could do to the car
with this particular hack?

Probably the most scary thing
we can do is when you come to

a stop, we can make it to where
then the brakes stop working,

and then you'll
start going again.

- So we're stopped...
- Yeah.

...but now we're not stopped.

(Engine revving)

Oh man, I don't like
that sound at all!

Yeah, no.

So the brake pedal
just doesn't go down.

(Laughing)
Jeez!

Alright, so you want to
see some steering and stuff?

Yeah, let's see some steering.

Okay, so get somewhere
where we can go backwards.

So in reverse, you can...

Oh, yeah.

I can crank the steering
wheel as much as I want.

- No hands.
- Yep.

(Laughing)

That's safe.

Not really.
(Laughing)

Is there ever a scenario where
you think a hacker can get

access to a vulnerability
in a car that's connected to

the internet that a million cars
could just be turned off?

I could have done that.

- Just like that?
- Yeah.

Even if they were
driving on the highway?

I could've made them all...
all the transmissions

go to neutral for
a million cars.

So including cars that
are going, you know,

100 miles an hour?

Yes.

You know, obviously
that wasn't my intent.

(Laughing)
Right.

My intent was to just
demonstrate that...

- It could happen.
- Right.

Car companies
are so new to this,

and most car companies you don't
even know who you would contact

to tell them you
found a vulnerability.

But the crazy thing is that
even when researchers do tell

a car company about a security
hole in their software, they're

often scorned for discovering
it in the first place.

When people complain
about people like me who find

vulnerabilities, they don't
realize that we're not putting

the vulnerabilities in the
product, they're already there.

Reporting the bugs is
what gets them fixed,

and that's the good thing.

Do you find it ridiculous that
companies won't pay for them?

Like Chrysler didn't
give you anything, right?

No, I didn't really expect them.

I think it's more ridiculous
when huge companies that have

been doing this for a long
time and they've got

a billion dollars in the bank
and they tout their security,

that doesn't make
as much sense to me.

Like I was a consultant for many
years, and companies would

pay me to come in and find
vulnerabilities for them,

and it's hard, right?

If it wasn't hard,
they would find

all the vulnerabilities
themselves right?

I feel like I
worked really hard.

I should maybe get
something for that.

Charlie Miller didn't get
a dime for his exploit,

but a year later
Chrysler changed its policy.

It became the first major
car company to introduce

a bounty program for hackers
who find flaws in its software.

And it's not just the
Chryslers of the world

who are willing to pay for them.

Zero-days can be worth a lot
of money to a software vendor

and the security companies
who want to patch the holes.

At the same time, they can be
sold through private brokers

for upwards of half a million
dollars to spy agencies or other

covert operators who use them
for surveillance or sabotage.

- How you doing?
- Good.

My career as a
professional penetration tester,

with those skills, obviously
I could have been robbing banks

and taking the money, as opposed
to being hired by the banks

to see how they could
be robbed, right?

Katie Moussouris is a
security researcher who created

Microsoft's first bug
bounty program in 2013.

She's based in Seattle,
but I met her in Vancouver

where she was attending
a security conference.

People usually like to define
them in terms of white market

and black market, but black
market actually implies

that the trading is illegal.

And right now, it's not illegal
to trade zero-days or exploits.

So I usually talk
about them in terms of

defense market
and offense market.

And do you think then that
bug bounties are the answer?

Do you think hackers,
when they find this stuff,

they should be
disclosing to the company?

Well, my goal with creating
bug bounty programs

is really about giving
hackers more opportunities

to not just turn it
over to defense,

but also make money
at the same time.

So they don't have
to make a choice,

"Do I do the right thing
or do I make money?"

They can do the right
thing and make money.

All software contains
vulnerabilities.

It's just a fact.

There are three ways
you can learn about it.

You can find it yourself, you
can hire somebody to find it -

or pay a bug bounty
if someone finds it -

or you can be attacked, period.

BEN: At the Can Sec West
conference in Vancouver,

hackers are invited to
find new ways to break into

widely used software,
like Safari and Adobe Flash.

Here at a competition known as
Pwn2Own, the teams face off

for nearly half a million
dollars in prize money.

Some teams have been working
for months in advance,

developing and testing
their exploits.

The flaws they find will be
disclosed to the vendors

so they can be patched.

Whitey, I'm Ben.

I met up with a
volunteer named Whitey

who agreed to show me around.

Pwn2Own.
(Laughing)

(Chattering)

So is one of them going down
right now, right here?

Yeah, yeah, so this is...
it's actually starting out now.

I gotta watch this.

(Chattering)

ANNOUNCER: We have
Tencent Security Team Sniper.

This is KeenLab and PC Manager.

The target is Adobe
Flash with system.

♪

These guys are trying to
break into a computer

using their zero-day
exploit for Adobe Flash.

(Applause)

(Chuckling)

That was really...
That was really weird!

(Laughing)

WHITEY: You know, it's kind of
like architecting a program,

and then getting that
one shot to run it

and make it run perfectly,
and they just did that.

And you know, it might
seem anticlimactic.

It's definitely not hacking
that you'd see in a movie,

stuff like that.
- Oh no.

But this is... this
is the real thing.

And yet what they just did
could, like you said,

end a company?

Oh, it could end a company,

it could wreak havoc, you know,
across the internet.

Tencent Security Team Sniper
was eventually declared

the Masters of Pwn.

The Shanghai-based researchers
who work for China's biggest

internet company won this
ridiculous smoking jacket.

They also collected more than
$142,000 in prize money.

I met up with them after a
super tame hacker wrap party.

(Music playing)

So you won Pwn2Own.

How does that feel?

- Pretty good.
- Yeah.

- Relaxed now.
- You're relaxed now?

Were you not relaxed
before this?

The day before,
no, very nervous.

Could you have sold those
zero-days to somebody else

and gotten more money?

And if so, why didn't you?

So somebody actually approached
you guys during Can Sec West

to pay for some of
the exploits you had?

Who were they?

(Laughing)

And you didn't do it?
You didn't want to do it?

Now, the ones you found,

the zero-days you found,
what do they affect?

For the rest of the year,
if you find zero-days,

what do you do with them?

(Laughing)

And you report it?

BEN: I'm in Vancouver for
a computer security conference,

but what I'm really
after is more intel

on shady zero-day markets.

People here tell me I
should speak with Emerson Tan.

He's worked for a major
government contractor,

but he's also been a part of the
hacking community for years.

Tan is a self-described
recovering dark lord,

at least according to
his LinkedIn profile.

TAN: I hear you
have some questions.

I want him to show me
what the market place

for these exploits
really looks like.

So can you buy exploits
on the black market?

Online, dark web?

Well, it depends what you mean.

So exploits, as you know,

come in a couple of
different flavours.

There are the ones that
have already been patched,

and then there are the O-days.

You wouldn't buy-- bother...

If you were a criminal, you
wouldn't bother buying O-days.

No?

A: they're very, very expensive.

It costs a huge amount
of money to test them

to make them reliable.

If you're a criminal, you
just want the thing that works,

and for the lowest cost
for the maximum return.

Let's see it,
what's it look like?

Let's have a look at
like a real forum.

It's the world's
worst web design.

It's really cheap and
cheesy, and they don't care.

So you can go on there,
you buy an exploit.

Usually that's an exploit
that hasn't been patched?

No, it has been patched.

- Or has been?
- It has been patched.

What you have to remember is
is that huge numbers of people

around the world do not
patch their systems,

do not patch their software.

Especially given that a huge
amount of the software out there

is not legally bought.

It's all... It's all
stolen, it's all nicked.

That stuff never gets updated.

So in that way, you still
have a huge attack surface?

Yeah, thous-- millions,
millions and millions

and millions and millions
and millions of people.

I mean, like, the...
this is brilliant.

This is an Android phone,
it's my Android phone.

People put all their personal
details and stuff on there,

you know, everything you need
to go and steal their identity.

- Mm-hmm.
- It's brilliant.

But in terms of zero-days,

there is no site where
you can buy a zero-day?

I mean, I'm sure they exist, but
to be perfectly honest with you,

if you were... if you were a
researcher and you really wanted

top dollar, you wouldn't bother
with these open market places.

You'd go and talk to a broker.

I mean, the thing is every--
this community is tiny.

They all know each other.

So brokers know the spies, the
criminals, and the researchers.

Yeah, and the researchers.

And then depending on
where you are in the world,

you know, that's the
community that you sell to.

It would be very, very odd
for example for, you know,

like a Russian researcher
to try and sell to a broker

who is... I don't know,
working for the Americans.

You know, in somewhere
like China or Russia,

selling to the opposition
will get you a visit

from some men in very
ill-fitting leather jackets,

maybe with a hose
or a baseball bat.

Right.

Have you ever dealt with
an intelligence agency?

We'll shuffle that
question off to the side.

I can neither confirm or deny,

which is Beltway speak for
some answer other than no.

So here's the
weird thing though,

is that almost everybody
has done it at some point.

If you ever meet anyone who
says they're whiter than white,

they're lying.

One of the reasons
that researchers are

so easily tempted to sell
zero-days to spy agencies

is that governments are
willing to pay a high price

just so they can hack
specific targets.

Finding a zero-day can
also earn you a big payoff

from software companies
who buy them in order to

patch the holes
in their products.

Apple recently announced
it would pay bug bounties

that ranged from
$25,000 to $200,000,

depending on the vulnerability.

Some bug hunters do that work
as a side gig, but a select few

can actually earn a living
finding zero-days.

Mark Litchfield is a
professional bug hunter

who says he's earned
hundreds of thousands of dollars

in bug bounties over
the past few years.

I headed to the gated community

outside of Las Vegas
where he lives and works.

Oh my.

Wow.

He's got that baller,
gated community life.

Hello.

GUARD: How you doing?
Hold on a minute.

No problem.

They say no, the association
say no, no cameras.

You can't go back there unless
you get it cleared with them,

and I don't think so.

We should've just
showed up in a golf cart.

What do they think we're doing?

Do you remember when
the White House and the FBI

was easier to shoot in?

We didn't manage to
penetrate the perimeter

of Mark Litchfield's gated
community, so we met Mark

and his wife, Carly-Lynn,
at a nearby restaurant.

Hey, Mark.

- Hey mate, how you doing?
- How's it going?

Nice to meet you.
Sorry for all that trouble.

Hey, no problem.
How was the trip?

- I'm Ben. It was good.
- I'm Carly, nice to meet you.

Nice to meet you.
Yeah, it was good.

I didn't realize it
would be that secure.

That's a gated
community, I guess.

(Laughing)

Yeah, it was... they
brought the whole, like,

golf cart brigade onto us.

Yeah, they actually
come up to the house.

I half expected
them to be armed,

but I don't think they were.

(Laughing)

So is it tough to make a
living off of finding zero-days?

You seem to have a
pretty good lifestyle here.

Yeah, I do okay.

(Laughing)

What's the most you've ever
gotten paid for one zero-day?

One of the bug bounty
programs is $15,000.

Just for one?

Just for one, yeah.

Okay, so let's say you're
doing your thing in your house,

and you find a zero-day

in a particularly large
user base software.

Okay.

What do you do with it?
Do you report it?

Interesting question.

The first reaction would be
yes, report it, absolutely.

But the second part of
this is with everything

that's going on right now,
my personal view on this is...

some states could make
better use of this bug

than just giving it
to the vendor.

So what do you mean by
what's going on nowadays?

ISIS, you know, North Korea,
so much crap going on.

If an opportunity came
my way whereby I could give

a zero-day vulnerability to...

(Sighing)

an agency, whoever,
someone that could use this,

then I would absolutely give it
to them and not report it.

Have you ever done that before?

Have you ever sold a
zero-day to a government?

No.

If you did sell to a government
a zero-day, would you tell me?

No.

(Laughing)

A good poker face for a
guy who lives in Las Vegas?

I don't play poker.

(Laughing)

BEN: Unpatched flaws
in software can be used

to hack into almost
anything that runs on code,

from a smartphone to a car.

Those flaws, known as zero-days,

are bought and sold to
companies and governments.

The US sometimes uses zero-day
exploits for attack purposes,

but there are also official
guidelines about when they're

supposed to be disclosed
to the software vendor.

The rules are an attempt to
balance the public's interest

in protecting internet safety
and the government's interest

in acquiring intelligence.

So you can certainly imagine
that if we discovered that...

and learned about a
vulnerability in, say,

a piece of software that
was either widely used

within the US government,
our allies, or within

our critical infrastructure,
that it might be in our interest

to actually purchase it
so we can make sure that

there was a patch for it.

I went to Washington to
meet with Michael Daniel.

He's the Cybersecurity
Coordinator

in the Obama administration.

And when does, say, the NSA
sit on a vulnerability?

If you sort of look at
those criteria for disclosure

and imagine the inverse, right?

That you've got a situation
where we have a vulnerability

that's in a very limited
set of software or hardware

that's not used very
broadly, that might be

frequently employed by
our adversaries that would

provide us a unique access that
we can't get any other way,

those are the kinds of
things that we would retain.

Michael Daniel wouldn't get
more specific about the type of

zero-days the government
holds onto, or the number.

What I can say is that,
you know, we are going to

bring the full array of
US national power to bear

to protect US interests
and those of our allies.

But not everyone is
comfortable leaving it up

to the US government to judge
what to do with a zero-day.

Chris Soghoian is a privacy
activist who tracks the zero-day

market, and he's been
sounding the alarm for years.

Why are you so critical of
companies that are selling

zero-days to the US
government or any government?

You know, I really feel that
there should be a public debate

around the government's role
in the zero-day market.

I've been really bothered by the
fact that for five or 10 years

there's been a conversation
in Washington, D.C.

about cybersecurity, but
this was a missing piece.

And this is an essential piece.

Who are the US government
agencies targeting

when they're using
zero-day exploits?

You know, it really depends.

So for the NSA, that
could be foreign leaders.

It could be foreign corporations
who have information that

the US government believes is
of national security interest.

It could be terrorists.

On the law enforcement side, the
FBI has attempted to hack people

who have downloaded
or shared child porn,

people who have called in
bomb threats to schools.

It really runs the range of the
most horrific and serious crime

to things that are, you know,
sort of teenagers making

prank calls at home.

Because I guess
that's the thing though.

It's easy to be very
critical of it because

it sounds on the surface
pretty malevolent, but then

there may be instances
where a zero-day is used

to hack into a
terrorist's computer.

It's the classic
argument, right?

I'm less focused
and less interested on

who they use it against,
and more on what are

the side effects of the
government's acquisition

and stock piling and use of that
vulnerability or that exploit.

(Siren blaring)

A couple years ago,
protests in Ferguson happened,

and Americans wake up to
their morning newspapers

showing photographs of
armoured personnel carriers,

police wearing camouflage,
holding machine guns,

and realizing that suddenly
their law enforcement

has become militarized.

They got to see the
trickle-down effect,

where technologies that are
designed for the military

and the intelligence community
eventually trickle down first

to the Feds, then the state and
local law enforcement agencies.

And this has happened with
armoured personnel carriers,

it's happened with tear gas,
it's happened with SWAT teams

and drones and
license plate readers,

and it will almost certainly
happen with zero-days.

And when you give those tools
to people who are going to be

operating them without much
training and without much

oversight, you know,
we're going to see abuses.

We're gonna see police officers
spying on their ex-spouses,

or their next door neighbour
who's pissing them off.

I don't think that America
is ready for local cops to be

hacking into computers, but we
are definitely on our way there.

But it's not just
the local cops.

Spy agencies and hackers
everywhere want them,

and they're not
just for surveillance.

They can be weaponized
to take over

any physical object
running on code,

from a cellphone to
an SUV to a power plant.

And that means that
if zero-days fall into

the wrong hands, they can be
real threats to your privacy,

individual freedom, and
even personal safety.

But as it stands,
there's no real consensus

on whose hands
are the wrong hands.