YouSaid · the spoken record

Nicole Perlroth

lines on the record
109
first
2022-02-20
most recent
2022-02-20
sittings or episodes
1
sources
podcast

Every line below is reproduced as it was said and linked to the record it came from. Nothing here is summarised or generated. Directory · Search · Corrections

  1. “And what I found was there's kind of this long sorted history to this question. It started out in the 80s and 90s when hackers were just finding holes and bugs and software for curiosity's sake, really as a hobby. And some of them would go to the tech companies like Microsoft or Sun Microsystems at the time or Oracle. And they'd say, hey, I just found this zero day in your software and I can use it to break into NASA. And the general response at the time wasn't thank you so much for pointing out this flaw and our software will get it fixed as soon as possible. It was don't ever poke around our software ever again or we'll stick our general counsel on you. And that was really sort of the common thread for years. And so hackers who set out to do the right”

    2022-02-20 · Lex Fridman Podcast · #266 – Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar · IDENTIFIED FROM THE TRANSCRIPT · source

  2. “So these are the questions I set out to answer for my book. I wanted to know. Are these people that are just after money? If they're just after money, how do they sleep at night not knowing whether that zero-day exploit they just sold to a broker is being used to basically make someone's life a living hell?”

    2022-02-20 · Lex Fridman Podcast · #266 – Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar · IDENTIFIED FROM THE TRANSCRIPT · source

  3. “It would drop an iOS zero day exploit onto your phone. And so anyone that visited this website that was about Uyghurs, anywhere, I mean, Uyghurs, Uyghurs living abroad, basically the Uyghur diaspora, would have gotten infected with this zero-day exploit. So in that case, they were targeting huge swaths of this one population or people interested in this one population basically in real time.”

    2022-02-20 · Lex Fridman Podcast · #266 – Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar · IDENTIFIED FROM THE TRANSCRIPT · source

  4. “I think it's both some of the zero day exploits that have fetched top dollar that I've heard of in my reporting in the United States were highly targeted. You know, there was a potential terrorist attack. They wanted to get into this person's phone. It had to be done in the next 24 hours. They approached hackers and say, we'll pay you X millions of dollars if you can do this. But then you look at when we've discovered iOS zero day exploits in the wild, Some of them have been targeting large populations like Uyghurs. So a couple years ago there was a watering hole attack. Okay, it's a watering hole attack. There's a website. It was actually had information aimed at Uyghurs and you could access it all over the world. And if you visited this website.”

    2022-02-20 · Lex Fridman Podcast · #266 – Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar · IDENTIFIED FROM THE TRANSCRIPT · source

  5. “Exploit, then find an Android zero day exploit. The other thing is market share. There are just more people around the world that use Android. And a lot of governments that are paying top dollar for zero day exploits these days are deep pocketed governments in the Gulf that want to use these exploits to monitor their own citizens, monitor their critics. And so it's not necessarily that they're trying to find elites. It's that they want to find out who these people are that are criticizing them or perhaps planning the next Arab Spring.”

    2022-02-20 · Lex Fridman Podcast · #266 – Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar · IDENTIFIED FROM THE TRANSCRIPT · source

  6. “Don't think so. I actually so it was about two years ago that the prices flipped. It used to be that if you could craft a remote Zero click Exploit for iOS, then that was about as good as it gets. You could sell that to a zero day broker for two million dollars. The caveat is you can never tell anyone about it because the minute you tell someone about it, Apple learns about it, they patch it in that 2.5 million dollar investment that that zero-day broker just made goes to dust. So a couple years ago, and don't quote me on the prices, but an Android zero click remote exploit for the first time topped the iOS. And actually a lot of people's read on that was that it might be a sign that Apple security was falling and that it might actually be easier to find an iOS zero.”

    2022-02-20 · Lex Fridman Podcast · #266 – Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar · IDENTIFIED FROM THE TRANSCRIPT · source

  7. “So iPhone exploits have just been a government's number one priority. Recently, actually, the price of an Android remote zero day exploit, something that can get you into Android phones, is actually higher. The value of that is now higher on this underground market for zero-day exploits than an iPhone iOS exploit. So things are changing.”

    2022-02-20 · Lex Fridman Podcast · #266 – Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar · IDENTIFIED FROM THE TRANSCRIPT · source

  8. “Their contacts, their record their telephone calls, record their camera without them knowing about it. Basically, you can put an invisible ankle bracelet on someone without them knowing. And you can see why that capability, that zero-day exploit would have immense value for a spy agency or a government that wants to monitor its critics or dissidents. And so there's a very lucrative market now for zero day exploits.”

    2022-02-20 · Lex Fridman Podcast · #266 – Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar · IDENTIFIED FROM THE TRANSCRIPT · source

  9. “So, at the most basic level, let's say I'm a hacker and I find a bug in your iPhone iOS software that no one else knows about, especially Apple. That's called a zero day because the minute it's discovered, engineers have had zero days to fix it. If I can study that zero day, I could potentially write a program to exploit it. And that program would be called a zero-day exploit. And for iOS, the dream is that you craft a zero-day exploit that can remotely exploit someone else's iPhone without them ever knowing about it. And you can capture their”

    2022-02-20 · Lex Fridman Podcast · #266 – Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar · IDENTIFIED FROM THE TRANSCRIPT · source