Speaker 1: Welcome to tech Stuff, a production from iHeartRadio. Heydarren, Welcome
Speaker 1: to tech Stuff. I'm your host, Jonathan Strickland. I'm an
Speaker 1: executive producer with iHeartRadio. And how the tech are you?
Speaker 1: So this morning I woke up to a text message
Speaker 1: from a radio station in Alabama. I have frequently been
Speaker 1: on that station talking about tech stuff in general, and
Speaker 1: they were asking if I would be willing to jump
Speaker 1: on the air this morning to talk about how some
Speaker 1: Google Chrome news was unfolding, specifically that Google discovered a
Speaker 1: zero day vulnerability within Chrome that could potentially compromise users,
Speaker 1: like upwards of three billion of them. So today I
Speaker 1: thought I would talk a little bit about what a
Speaker 1: zero day vulnerability is, touch on a little bit of
Speaker 1: terminology used in the information security sector to kind of
Speaker 1: demystify a bit of it and to help folks like
Speaker 1: me wrap our minds around the whole thing. Now, for
Speaker 1: those of y'all who are neck deep in computer security fields,
Speaker 1: you're going to know all of this already. This is
Speaker 1: sort of a one oh one of what zero day
Speaker 1: vulnerabilities are all about. So let's define that. Because zero
Speaker 1: day vulnerability, zero day exploit, zero day attack. These terms
Speaker 1: seem to mean something, but you don't necessarily understand it
Speaker 1: when you first see it. Essentially, it's describing a situation
Speaker 1: in which there is something exploitable within some sort of
Speaker 1: technical system. This system can be software, it can be hardware,
Speaker 1: and this vulnerability exists within the system, and the people
Speaker 1: who should be on the lookout for that kind of
Speaker 1: thing are unaware of it. So, in other words, the
Speaker 1: company behind the system doesn't know that the vulnerability the exists.
Speaker 1: The security community at large doesn't know that this vulnerability exists,
Speaker 1: but it's there. So if you think about it, think
Speaker 1: of it in physical terms. Let's think about like a
Speaker 1: giant security wall that goes around your home, and it
Speaker 1: turns out there's a gap in the wall, but it's
Speaker 1: behind some shrubs and stuff, and you just haven't gone
Speaker 1: back there, and you haven't noticed it. You don't even
Speaker 1: know there's a gap there. Well, that gap obviously shows
Speaker 1: that there's a hole in your security and you just
Speaker 1: aren't aware of it. But if someone else is aware
Speaker 1: of it, they could exploit that without your awareness and
Speaker 1: potentially cause a lot of damage. And if they're very clever,
Speaker 1: they can cause a lot of damage. Over an extended
Speaker 1: amount of time, as long as they don't make you
Speaker 1: aware that that hole is there. That's kind of the
Speaker 1: idea here. It's partly called a zero day vulnerability because
Speaker 1: the entity behind the product has had zero days to
Speaker 1: fix it before someone's figure out a way to exploit it.
Speaker 1: In other words, you can't really fix a problem if
Speaker 1: you don't know that there is a problem there. Right again,
Speaker 1: if you look out and you don't see the hole
Speaker 1: in the wall because it's being obscured by something else,
Speaker 1: then you don't know that there's a problem to fix.
Speaker 1: You just assume everything's fine, and it's not until some
Speaker 1: other signs pop up that suggests that it's not fine,
Speaker 1: that you start looking, and then maybe you uncover it.
Speaker 1: At that point you could argue, all right, well, now
Speaker 1: it's no longer zero day because we found it and
Speaker 1: we can do something about it. But the gap of
Speaker 1: time between when the problem first manifested and when you've
Speaker 1: found out about it that represents the target of opportunity
Speaker 1: for this in the case of computer security hackers. So
Speaker 1: let's give an example with Google Chrome. Google makes the
Speaker 1: Chrome web browser, engineers create an update for the browser,
Speaker 1: and in the process. There is a gap in the
Speaker 1: browser's security. It's unintentional. It was not put there on purpose.
Speaker 1: It just sort of happens because this is complicated stuff.
Speaker 1: So the engineers didn't detect the gap. They pushed it through,
Speaker 1: and the update goes through the entire development process, and
Speaker 1: then Google deploys the update. They roll it out, and
Speaker 1: people start to update their browsers or the browser gets
Speaker 1: updated upon a reboot or something, and thus the update
Speaker 1: gets installed, and now the security gap is affecting those
Speaker 1: machines because they actually have that version of Chrome in place.
Speaker 1: Now in the wild, hackers are also scouring Chrome, but
Speaker 1: they're looking for these vulnerabilities. They're probing the code, looking
Speaker 1: for weaknesses where they can exploit those weaknesses. It might
Speaker 1: mean creating some specific types of malware or some sort
Speaker 1: of process that will initiate a sequence that allows them
Speaker 1: to exploit the vulnerability. So it may you know, it
Speaker 1: takes more than just finding there's a vulnerability there. You
Speaker 1: have to figure out a way to exploit it. But
Speaker 1: these are all things that hackers do on the rag.
Speaker 1: So they find this gap, then they scramble to develop
Speaker 1: the tools that can take advantage of this gap. Then
Speaker 1: they deploy those tools, perhaps doing so very quietly in
Speaker 1: an effort to extend the amount of time that they
Speaker 1: have to exploit this vulnerability before Google or some computer
Speaker 1: security expert from somewhere else finds this gap and then
Speaker 1: alerts everybody to it. The hackers do their best to
Speaker 1: use the gap to do whatever it is they want
Speaker 1: to do, depending upon the nature of the gap, that
Speaker 1: could include anything from spying on computer activity on a
Speaker 1: compropised machine to forcing a computer to execute malicious code
Speaker 1: remote code execution in other words, And really it just
Speaker 1: depends upon the nature of the vulnerability and the nature
Speaker 1: of the malware being developed, so there are lots of
Speaker 1: different possibilities there. So when we the general public hear
Speaker 1: about a zero day vulnerability, it's kind of like hearing
Speaker 1: about something that was a zero day vulnerability but now
Speaker 1: kind of isn't because it's now not just the hackers
Speaker 1: who know about it. Now, there might not be much
Speaker 1: we can do about it at the time. But often
Speaker 1: when we hear about zero day vulnerabilities for the first time,
Speaker 1: it comes along with a solution that's being rolled out
Speaker 1: at the same time. Because companies that are hit by
Speaker 1: this sort of stuff. If they can hold on to
Speaker 1: that information until they have a solution, they typically will
Speaker 1: because otherwise you're panicking people and you have no way
Speaker 1: to fix things. Right. So it may be that when
Speaker 1: you hear about this vulnerability, it's the same time when
Speaker 1: you hear about a patch, a security patch that's been
Speaker 1: rolled out that you can update your device to. Typically
Speaker 1: we see a very fast response to the discovery. Sometimes
Speaker 1: the response we see is in other areas of cybersecurity,
Speaker 1: for example, antivirus software creators. They might come up with
Speaker 1: tools to help detect and prevent applications that have been
Speaker 1: hit by zero day vulnerabilities to do malicious activity on
Speaker 1: your machine, and in the meantime, you're still waiting for
Speaker 1: the creator of the root problem to roll out a patch.
Speaker 1: That often can be the case too companies will patch
Speaker 1: their products. So Google, for example, pushed out a patch
Speaker 1: for this most recent vulnerability already, which, by the way,
Speaker 1: is where I need to point out to all of
Speaker 1: you that if you use Google Chrome, you should check
Speaker 1: to see if it's up to date, just to protect yourself.
Speaker 1: If you're wondering how to do that. In the upper
Speaker 1: right corner of Google Chrome, they're the little three dots.
Speaker 1: If you click on that, it brings up settings, like
Speaker 1: you can choose settings from a drop down menu, and
Speaker 1: then from the next menu that pops up, you look
Speaker 1: at about Chrome and it will have a little button
Speaker 1: there that lets you update your browser at that point,
Speaker 1: and you should click on that make sure your browser
Speaker 1: is up to date and patched so that you are
Speaker 1: not going to be victimized by this type of vulnerability. Now,
Speaker 1: sometimes hackers will even know about vulnerabilities and code before
Speaker 1: the code gets released. So imagine for a moment that
Speaker 1: you are a black hat hacker. Your job is to
Speaker 1: try and find vulnerabilities in various systems and platforms and
Speaker 1: then figure out ways to exploit them. So you are
Speaker 1: an expert in penetrating systems, and maybe you're on the
Speaker 1: payroll of a nation state. Maybe you know Russia or
Speaker 1: China is paying you to do this, or maybe you
Speaker 1: work in the United States for one of those organizations
Speaker 1: that goes by initials all the time, like the NSSA,
Speaker 1: because they do this too. So information is a precious
Speaker 1: resource and access to information is your specialty as this
Speaker 1: kind of hacker, So you dedicate your time to gaining
Speaker 1: access to developer platforms on the QT so that you
Speaker 1: can look at code while it's still in development. Maybe
Speaker 1: you start probing this code for vulnerabilities well before it
Speaker 1: gets rolled out to the public. Now, if you're lucky
Speaker 1: and you're very good, you find something that can be
Speaker 1: used immediately as soon as this gets rolled out. And
Speaker 1: this is the best case scenario for you, because you
Speaker 1: already know the vulnerability, you can already work on an exploit,
Speaker 1: and the tool hasn't even been pushed out yet, So
Speaker 1: at the moment that it goes public, you'll chances are
Speaker 1: you'll be able to exploit it right away. It really
Speaker 1: does become a zero day vulnerability. In that case, this
Speaker 1: gives you the maximum amount of time to work with
Speaker 1: that vulnerability and to compromise target devices before someone gets wise.
Speaker 1: And again there's no telling how long that might take.
Speaker 1: Sometimes it can be years before someone realizes, Hey, something
Speaker 1: hanky's going on. Let's look into this now. Of course,
Speaker 1: chances are you're not necessarily the person who's making use
Speaker 1: of these vulnerabilities. You're finding them, but you aren't necessarily
Speaker 1: the same person who's exploiting them. Instead, you find these
Speaker 1: vulnerabilities and then you pedal your knowledge on the black market,
Speaker 1: where you're selling information to criminals and the like, and
Speaker 1: they in turn will actually use the exploits to leverage
Speaker 1: that vulnerability. You might instead go to the gray market.
Speaker 1: This is where you could be selling the information to say,
Speaker 1: researchers in the cybersecurity field, or maybe to a defense
Speaker 1: contractor who in turn is working alongside military organizations. I mean,
Speaker 1: we've seen this too, right. We've seen companies that are
Speaker 1: essentially defense contractors develop malware that are it's zero day vulnerabilities.
Speaker 1: A great example that's the NSO Group, the Israeli company
Speaker 1: that created the Pegasus malware that targeted iOS devices. So
Speaker 1: you might be working with intelligence agencies to do this
Speaker 1: sort of thing, or maybe you are one of the
Speaker 1: good guys out there. You're a white hat, so what
Speaker 1: you're doing is not trying to sell off this information
Speaker 1: to criminal bidders on the black market. Instead, what you
Speaker 1: are doing is you're taking part in bug bounties where
Speaker 1: a company will offer a reward if you find security
Speaker 1: vulnerabilities in their products. And so you discover the vulnerability,
Speaker 1: you send it a bug report to a company, they
Speaker 1: verify that it is in fact a vulnerability, and then
Speaker 1: they pay you while they get to work patching that
Speaker 1: vulnerability out before any bad guy out there figures out
Speaker 1: that this thing's there, or if they have figured it
Speaker 1: out before, they can do too much damage with it.
Speaker 1: So hopefully the white hats get the information to the
Speaker 1: right people in time, and the right people take the
Speaker 1: right actions to prevent any exploitation of that vulnerability, though
Speaker 1: that you know, is never a guarantee, so these zero
Speaker 1: day attacks typically they are devastating because there's no defense
Speaker 1: right like, there's no way as a user, there's nothing
Speaker 1: you can do because you don't you're not doing anything
Speaker 1: with the code on the back end of the various
Speaker 1: devices and programs you're using. But beyond that, if no
Speaker 1: one is aware of them, apart from the attackers, then
Speaker 1: there's going to be a lot of damage done up
Speaker 1: until that discovery has been made. They can also happen
Speaker 1: at a very high level. These can be attacks that
Speaker 1: are not going after the general citizen. They might cast
Speaker 1: a very wide net in order to get as many
Speaker 1: people lump as possible, but the hope typically is to
Speaker 1: land a few important targets, like you're aiming to get
Speaker 1: some high profile or important people, whether those are politicians
Speaker 1: or activists or journalists. You know, it depends on case
Speaker 1: to case, but that's often the goal. Now. Granted, even
Speaker 1: if that's the goal, people might still make use of
Speaker 1: all that other information by selling it off on the
Speaker 1: black market or whatever, so you know, maximize your gains.
Speaker 1: But typically these kinds of attacks are not necessarily meant
Speaker 1: to grab John Smith's information or whatever. They're going after
Speaker 1: bigger fish, So the vast majority of machines affected by
Speaker 1: a vulnerability exploit might not be of much interest to
Speaker 1: the hacker, at least not directly. That's very small comfort
Speaker 1: when you figure out that your machine has been hit,
Speaker 1: But at the very least you might luck out in
Speaker 1: that you're not the type of person the hackers we're targeting,
Speaker 1: and they aren't exploiting the information right away, unless, of course,
Speaker 1: you are an important person, in which case, Hey, thanks
Speaker 1: for listening to tech stuff. Thanks everybody for listening to
Speaker 1: tack stuff. You're all important to me, And honestly, the
Speaker 1: list of important people can get pretty big depending upon
Speaker 1: the aim of the attack. Okay, we're going to take
Speaker 1: a quick break. When we come back, we'll talk more
Speaker 1: about zero Day vulnerabilities and attacks. Okay, we're back, and
Speaker 1: up to this point, I've kind of been using Google
Speaker 1: Chrome as an example because, well, we just had that
Speaker 1: news break that up to around three billion users could
Speaker 1: have been affected by this particular exploit or this vulnerability,
Speaker 1: and web browsers have frequently been the focus of zero
Speaker 1: day attacks, so even without this most recent example, we
Speaker 1: could still talk about Google Chrome. This is not the
Speaker 1: first time there's been a zero day attack or zero
Speaker 1: day vulnerability with Google Chrome. It's happened multiple times in
Speaker 1: the past. The evolving nature of the web means that
Speaker 1: companies that make web browsers are constantly updating their products,
Speaker 1: whether to make them run more efficiently or add new features,
Speaker 1: or to accommodate new types of web technology. They need
Speaker 1: to update the browser to make it work. This, however,
Speaker 1: can introduce the chance for vulnerabilities to emerge. As software
Speaker 1: gets more complicated, changes to that software can have unexpected consequences.
Speaker 1: I'm sure anyone out there who has worked on a
Speaker 1: complicated system, whether it's software or otherwise, they know that
Speaker 1: when you fix one problem, sometimes the fix can end
Speaker 1: up causing three more problems somewhere else because the interconnections
Speaker 1: between all these different components gets really really complex. By
Speaker 1: the way, this is where all of us should take
Speaker 1: time to thank people who work in QA, because it's
Speaker 1: their job to test products and look for problems so
Speaker 1: that hopefully issues can be fixed before the product has
Speaker 1: headed out to the real world. And even when you
Speaker 1: sit there and think, wow, I have this thing and
Speaker 1: it doesn't work nearly as well as I hoped it,
Speaker 1: would just know that there's a really good chance there
Speaker 1: were QA people working on that where if they had
Speaker 1: not been there, you wouldn't even get the level of
Speaker 1: performance that you got out of that thing. So, yeah,
Speaker 1: QA people are really super important. I don't just say
Speaker 1: that because I happen to be married to one. Now,
Speaker 1: beyond web browsers, there are other types of products that
Speaker 1: are rich targets for zero day attacks. Now, again, for
Speaker 1: a zero day attack to even work, there has to
Speaker 1: be a vulnerability, right, there's not a guarantee of vulnerability
Speaker 1: will be there. But there are certain types of technologies
Speaker 1: that hackers focus on more because the potential of finding
Speaker 1: a vulnerability and then exploiting it also means the potential
Speaker 1: we're hitting a huge number of targets so browsers are
Speaker 1: way up there because that's how a lot of people
Speaker 1: access the Internet right they're using the web based Internet.
Speaker 1: Operating systems are also way up there, so our email systems.
Speaker 1: The Internet of Things era introduced tons of new components
Speaker 1: that connect to information networks, and in the rush to
Speaker 1: build new and sometimes useful tools, not always, the Internet
Speaker 1: of Things has got a lot of stuff that you
Speaker 1: could argue has limited, if any use. There's a ton
Speaker 1: of stuff that is really useful. Well, whenever you're tapping
Speaker 1: into a networked communication infrastructure, you're potentially introducing a vulnerability
Speaker 1: to the overall system, especially if you have not taken
Speaker 1: the time to build real security into your product. And
Speaker 1: time and again there have been stories about Internet of
Speaker 1: things devices that limited or no security to them, which
Speaker 1: created a great intrusion point for hackers. So really, any
Speaker 1: networked component can potentially be ground zero for a zero
Speaker 1: day attack, whether it's hardware, firmware, or software. It's just
Speaker 1: that stuff like browsers and operating systems are so widely deployed,
Speaker 1: they're so prominent that these targets are often the most
Speaker 1: desirable because everybody's got an operating system just about everybody's
Speaker 1: got a browser, but not everyone has I don't know,
Speaker 1: like a smart seismometer attached to their network. And so
Speaker 1: you focus on these big, big targets hoping to find
Speaker 1: vulnerabilities as a hacker because of the potential of how
Speaker 1: many hits you're going to get on an attack. It
Speaker 1: may be that you find an incredible attack for some
Speaker 1: Internet of Things connected device, but if there aren't a
Speaker 1: ton of those out in the world, then it still
Speaker 1: limits the effectiveness of your attack. Right, So you're balancing
Speaker 1: this out how bad is the vulnerability, how well can
Speaker 1: I exploit it, how widely is it distributed, and how
Speaker 1: long do I think it can get away with it? Well,
Speaker 1: that being said, if we look back on the history
Speaker 1: of zero day attacks, one of the standouts that comes
Speaker 1: up an early example of zero day attacks, although the
Speaker 1: term zero day predates the discovery of this particular attack,
Speaker 1: because I say that because a lot of the resources
Speaker 1: I looked at called this the first zero day attack,
Speaker 1: which is kind of funny because we had the term
Speaker 1: before we even knew it existed. But it's Stuck's net,
Speaker 1: stuxn et. You may have heard of that. This was
Speaker 1: in the news more than a decade ago at this point,
Speaker 1: but it was intended to infect a specific kind of system.
Speaker 1: I've actually done an episode about Stuck's Net, so I'm
Speaker 1: not going to go into a full history of it,
Speaker 1: but i will talk a bit about what it was
Speaker 1: and what was going on. Okay, So around two thousand
Speaker 1: and five or two thousand and six, some programmers or
Speaker 1: hackers if you prefer, were hard at work developing a
Speaker 1: sneaky kind of malware. And based upon the scope of
Speaker 1: this malware, the target of the malware, and the sophistication
Speaker 1: of the attack, it's pretty clear that this had to
Speaker 1: be a state sponsored effort, that this was a group
Speaker 1: of hackers who had access to a lot of resources,
Speaker 1: like in the form of money and stuff, and subsequently
Speaker 1: people have sussed out that was probably the United States
Speaker 1: and Israel working together to do this. So the malware
Speaker 1: it had to do several things. First, it needed to
Speaker 1: be able to infect a target machine and spread very easily. Second,
Speaker 1: it needed to remain undetectable, so it needed to not
Speaker 1: cause too much trouble or else someone might catch on
Speaker 1: that something he ky's happening. Third, it needed to be
Speaker 1: able to transfer itself onto a device like a flash drive.
Speaker 1: So if you were to plug a flash drive into
Speaker 1: an infected computer, it needed to be able to copy
Speaker 1: itself onto that flash drive, along with whatever else it
Speaker 1: was you were planning to put on that flash drive. Fourth,
Speaker 1: it had to carry programming that would allow it to
Speaker 1: manipulate systems with programmable logic controllers. So these components also
Speaker 1: known as plc's connect to industrial machinery. So essentially, PLCs
Speaker 1: let a computer system send commands to industrial equipment that
Speaker 1: does something whatever industrial process it needs to do, but
Speaker 1: the computer can control it, and the PLC is kind
Speaker 1: of the interface that allows it to communicate with this
Speaker 1: industrial equipment. And in the case of stucks net, it
Speaker 1: was a specific kind of industrial equipment. It was a
Speaker 1: centrifuge that was used to process uranium, specifically to refine uranium.
Speaker 1: Because the target for stuckx net was Iran's nuclear program,
Speaker 1: So the computer systems responsible for controlling centrifuges was the
Speaker 1: goal here. And the centrifuges spin at very very high speed,
Speaker 1: and in the process when they're spinning, they're spinning samples
Speaker 1: of uranium, and this is what helps separate the uranium
Speaker 1: so that you can refine it, and it's an important
Speaker 1: step in that process. So the malware would interrupt this
Speaker 1: chain of command between the computer system responsible for governing
Speaker 1: the centrifuge and the centrifuge itself, and then the malware
Speaker 1: could send instructions for the centrifuges to spin faster than
Speaker 1: they were supposed to. This had a dual effect. For
Speaker 1: one thing, it would cause the centrifuges to wear out
Speaker 1: faster and to fail more frequently. Essentially, it could break
Speaker 1: the centrifuges. For another, it could ruin uranium samples and
Speaker 1: slow down Iran's nuclear program in the process. But there
Speaker 1: was a major obstacle in the way of carrying through
Speaker 1: with this attack because the target systems, those computers that
Speaker 1: actually sent the messages to centrifuges, they were an air
Speaker 1: gap system. So an air gap system is one that
Speaker 1: does not connect to an external network, so it doesn't
Speaker 1: connect to the Internet. It's air gaped. There is a
Speaker 1: gap between the system and the outside world. This is
Speaker 1: a strategy that a lot of companies and militaries use
Speaker 1: for systems that hold critically important and sensitive information. You
Speaker 1: cannot trust for it to be connected to the Internet,
Speaker 1: because then that information might leak out to the world.
Speaker 1: We've seen it happen lots of times. So you create
Speaker 1: an air gap system and ideally there's no way for
Speaker 1: the outside world to get into the computer system. So
Speaker 1: how do you compromise an air gapped computer system. You
Speaker 1: couldn't just create a neatly wrapped package in code and
Speaker 1: send it via email or something, because again, those targeted
Speaker 1: computers didn't have that external connection. So what they did
Speaker 1: was the hackers targeted companies that were known to be
Speaker 1: working with Iran on its nuclear program. So the goal
Speaker 1: was to infect the machines on the collaborators, to target
Speaker 1: these collaborators and try and get those machines infected, and
Speaker 1: the hope that as part of their work with Iran,
Speaker 1: they would unknowingly transfer malware from their own machines to
Speaker 1: something like a flash drive, and then they would use
Speaker 1: that flash drive to update Iran's computers that were in
Speaker 1: control of the centrifuges, and thus the malware could be
Speaker 1: transferred from the flash drive to the target machines. So
Speaker 1: you had this extra step you had to take. But
Speaker 1: here's the thing. It totally worked for at least a year,
Speaker 1: the attackers were able to disrupt operations in Iran's nuclear program,
Speaker 1: even updating the malware so that subsequent visits from these
Speaker 1: partner companies would help keep things going. Now, eventually, like
Speaker 1: in twenty ten, which was at least two years after
Speaker 1: the machines had been compromised, Iran uncovered the reason that
Speaker 1: they were seeing centrifuges fail more frequently than they we're
Speaker 1: supposed to. Like you know, of course stuff wears out,
Speaker 1: particularly stuff that moves a lot, but the centrifuges were
Speaker 1: wearing out way too quickly. They also noticed that their
Speaker 1: computer systems were crashing a lot. They figured it out
Speaker 1: finally that there was this malware to blame Stuck'snut itself,
Speaker 1: because it was designed to spread from system to system
Speaker 1: really effectively actually infected a ton of machines that had
Speaker 1: nothing to do with Iron's nuclear program. That was kind
Speaker 1: of collateral damage, because again, the goal was to try
Speaker 1: and get these systems that otherwise were very well protected.
Speaker 1: And if you just happened to infect millions of other
Speaker 1: computers around the world, well that's a price you have
Speaker 1: to be willing to pay. Anyway. Stucksnet initially targeted five
Speaker 1: zero day vulnerabilities as part of its strategy. Now, through
Speaker 1: a security patch, one of those vulnerabilities was eliminated before
Speaker 1: Stuck's net could be deployed, so when the malware was
Speaker 1: ready to go, it was depending upon four zero day
Speaker 1: vulnerabilities because the other four had not yet been uncovered,
Speaker 1: so they still had different vectors to use in order
Speaker 1: to try and inject malware into the targets. The vulnerabilities
Speaker 1: targeted stuff like Microsoft Windows operating system and Microsoft Networks
Speaker 1: and specifically was designed to seek out computers that had
Speaker 1: the Step seven software suite from the company Siemens. Those
Speaker 1: were you know, That's essentially what stuck set would do.
Speaker 1: It'd be like, all right, I've infected this machine. Does
Speaker 1: this machine have Step seven installed on it? No? Cool,
Speaker 1: I'm not doing anything else other than infecting other machines
Speaker 1: if I have the chance. If it did detect Step seven,
Speaker 1: that was software that was meant to interoperate with these
Speaker 1: PLCs so that you could work with industrial equipment, it
Speaker 1: would then continue on its mode of attack. Now, as
Speaker 1: you might imagine, like I said, zero day attacks can
Speaker 1: cause a huge amount of trouble. The vulnerabilities there the
Speaker 1: exploit's been developed and no one, not even cybersecurity companies,
Speaker 1: it's prepared to respond to it. If it's carried out well,
Speaker 1: the attackers can achieve goals, and like Stuck's net, they
Speaker 1: can continue to operate for years without being spotted, assuming
Speaker 1: the attacks are not causing noticeable issues in the infected systems.
Speaker 1: If it's causing stuff that most people would just chalk
Speaker 1: up to regular technical errors or glitches or whatever, you
Speaker 1: can get away with it for a while. But if
Speaker 1: you're like causing lots of problems, then eventually someone's going
Speaker 1: to say something's wrong with this machine, and that brings
Speaker 1: out the possibility that someone figures out it's been exploited. Now,
Speaker 1: the recent Google Chrome zero day attack potentially affected up
Speaker 1: to three billion people, like I mentioned, according to initial estimates,
Speaker 1: which puts it neck and neck with one of the
Speaker 1: worst zero day attacks we know about. I was about
Speaker 1: to say one of the worst zero day attacks in history.
Speaker 1: But of course, the scary thing is there are probably
Speaker 1: huge zero day attacks going on right now and no
Speaker 1: one has detected them yet, and who knows the scope
Speaker 1: or nature of those attacks. That's the scary thing about that, right,
Speaker 1: Like you just there's no way to know because no
Speaker 1: one's discovered there was a vulnerability or noticed anything unusual
Speaker 1: going on with their systems. But anyway, the other really
Speaker 1: really big one that happened at the same scale as
Speaker 1: Google Chrome happened to a little company called Yahoo back
Speaker 1: in twenty thirteen. Now we're going to take another quick break.
Speaker 1: When we come back, I'll talk about this attack on
Speaker 1: Yahoo because it was another enormous deal. Okay, let's talk
Speaker 1: about this data breach attack on Yahoo that happened in
Speaker 1: twenty thirteen. We didn't even know about it until twenty sixteen. Again,
Speaker 1: the sinister nature of these attacks is that they can
Speaker 1: have happened and even continue to happen without us being
Speaker 1: aware of it for ages, and only in retrospector were
Speaker 1: able to look back and say, wow, that was an
Speaker 1: enormous attack. So, first off, Yahoo had already been the
Speaker 1: target of zero day attacks before twenty thirteen. In fact,
Speaker 1: back in two thousand and seven, which was before the
Speaker 1: world knew that stucks net was a thing. I mean,
Speaker 1: you know, hackers had developed it and everything, but the
Speaker 1: world was not aware of Stuck's net. There was a
Speaker 1: zero day attack. There were zero attacks aimed at Yahoo,
Speaker 1: specifically Yahoo Messenger that was the company's instant messaging service.
Speaker 1: So reportedly, this malicious attack could initiate a remote code
Speaker 1: execution on a target without them even doing anything, assuming
Speaker 1: that they had their browser security setting set fairly low, right,
Speaker 1: specifically an Internet Explorer RIP. But yeah, Internet Explorer, you
Speaker 1: might remember, had different kind of levels of security you
Speaker 1: could set, So at the highest it would really limit
Speaker 1: the types of websites you could go to. It really
Speaker 1: restricted your freedom quite a bit, but it also protected
Speaker 1: you against the vast majority of potential attacks, or at
Speaker 1: least that was the intent. For people who felt like
Speaker 1: they were more capable of determining their own safety, you
Speaker 1: could set that much lower and you would be able
Speaker 1: to go to more websites and use more services, but
Speaker 1: you also would incur greater risk. So depending upon what
Speaker 1: level you had your Internet security set at for Internet Explorer,
Speaker 1: you could potentially be a target of this zero day
Speaker 1: vulnerability that was leveraging Yahoo Messenger. But that was just
Speaker 1: one The twenty thirteen one would be much much worse.
Speaker 1: So again, it wasn't until twenty sixteen that we really
Speaker 1: heard about this. Yahoo revealed that hackers had managed to
Speaker 1: access and steal Yahoo user information, lots of private information.
Speaker 1: The initial guess was that it affected around a billion
Speaker 1: Yahoo users, but subsequently Yahoo, now under the ownership of Verizon,
Speaker 1: revealed that potentially all three billion users had been hit
Speaker 1: by this attack. This was in addition to a separate
Speaker 1: attack that had happened in twenty fourteen, and Yahoo had
Speaker 1: detected that one and already talked about it. So there
Speaker 1: was a big attack in twenty thirteen, then a second
Speaker 1: attack in twenty fourteen, probably not connected to the first attack.
Speaker 1: Yahoo saw evidence of the second attack, the twenty fourteen attack,
Speaker 1: but still didn't know about the twenty thirteen one. The
Speaker 1: twenty fourteen one, though, had already hit half a billion accounts,
Speaker 1: right like five hundred million people hit by that one.
Speaker 1: And it really just points out how vulnerable Yahoo was
Speaker 1: to have these two massive attacks both succeed against it,
Speaker 1: one of which remained undetected even after Yahoo had found
Speaker 1: evidence of a second attack. Subsequent investigations pointed to a
Speaker 1: possible connection to Rush hackers, so it was likely a
Speaker 1: state sponsored attack, which could mean that the primary purpose
Speaker 1: of the attack was to gather information about specific targets
Speaker 1: that being said, even if you're not a person of
Speaker 1: note in the eyes of Russian intelligence. The hackers also
Speaker 1: started to sell user data on the dark web, because
Speaker 1: I mean, why not. You've already got it, why not
Speaker 1: make some money off of it. Sure, your main reason
Speaker 1: for your attacks was to get information about you know,
Speaker 1: person A, person B in person C. But you have
Speaker 1: you know a billion other people or in the case
Speaker 1: of Yahoo, three billion other people. Why not sell their
Speaker 1: information too and make some extra money. So, yeah, anyone
Speaker 1: who had a Yahoo account by say mid twenty thirteen
Speaker 1: was pretty much hit by this attack because it got everything,
Speaker 1: which is a big ol' yauza. Now, sometimes it can
Speaker 1: actually be difficult to tell the difference between an attack
Speaker 1: that uses a zero day vulnerability versus something that is
Speaker 1: able to achieve really big results but through entirely different means. So,
Speaker 1: for example, in twenty twenty one, hackers began to offer
Speaker 1: LinkedIn data on the black market, so data about LinkedIn users.
Speaker 1: The word was that anywhere from five hundred million to
Speaker 1: seven hundred million accounts had been part of this attack,
Speaker 1: like anywhere between ninety to ninety five percent of LinkedIn's
Speaker 1: user base, and there were differing explanations for how this
Speaker 1: all went down. So one of the possible explanations was
Speaker 1: that LinkedIn had an API that's an application programming interface,
Speaker 1: and that this API had a vulnerability in it, and
Speaker 1: that this vulnerability would allow a hacker to create a
Speaker 1: tool to access information on the back end of LinkedIn systems.
Speaker 1: So there was at least some guesses that that was
Speaker 1: to blame, but LinkedIn said no, no, no, there was
Speaker 1: a vulnerability in our API, but we subsequently patched that out.
Speaker 1: And while there had been an early attack using that vulnerability,
Speaker 1: it was very small in nature. This larger one was
Speaker 1: not an attack on LinkedIn's back systems, according to LinkedIn,
Speaker 1: but instead made use of data scrapers. So a data
Speaker 1: scraper is just what sounds like, it's a program that
Speaker 1: scrapes information off of a platform. So you could achieve
Speaker 1: the same thing by having people go to LinkedIn and
Speaker 1: write down the personal information they can find about each user,
Speaker 1: and then go to the next user and then write
Speaker 1: it all down. It would be the same thing. So
Speaker 1: you're not getting anything secret because you're literally just going
Speaker 1: entry to entry and writing down all the information you have.
Speaker 1: Maybe you corroborate this with data from other websites too,
Speaker 1: in order to build out a bigger dossier on each person.
Speaker 1: But it's not like you penetrated the back end system, right.
Speaker 1: You didn't get to see the actual database that LinkedIn
Speaker 1: has where it has all the information about each user.
Speaker 1: You're just grabbing stuff that's already publicly viewable on the website.
Speaker 1: That's what LinkedIn was saying was happening. Whether or not
Speaker 1: that's exactly what happened, I don't know. I don't have
Speaker 1: any reason to doubt LinkedIn necessarily, because from what I
Speaker 1: can understand, the information that was being sold didn't contain
Speaker 1: a lot of stuff you would expect to find if,
Speaker 1: in fact, it were all the back end stuff. It
Speaker 1: was all things that you would expect to find if
Speaker 1: you were to just visit someone's profile page. So it's
Speaker 1: possible that that explanation is in fact the accurate one. Now,
Speaker 1: if you do a search about the most recent Google
Speaker 1: Chrome zero day vulnerability, you are likely going to see
Speaker 1: that it's listed as vulnerability cve DASH twenty twenty three,
Speaker 1: Dashed twenty thirty three. All right, so Google Chrome has
Speaker 1: had other zero day vulnerabilities. In fact, if you do
Speaker 1: a search and you see a different CVE. You know
Speaker 1: it's got different numbers following it. That's one of the
Speaker 1: other zero day vulnerabilities Google Chrome has had to deal
Speaker 1: with in the past, so this is not a new thing.
Speaker 1: The letters CVE stand for Common Vulnerabilities and Exploits. This
Speaker 1: is from the National Standards Institute, so it's like a
Speaker 1: standard just being used by the computer science community. So
Speaker 1: CVE has that designation and the numbers give you more
Speaker 1: information about the specific instance of this vulnerability. This particular
Speaker 1: vulnerability is taking advantage of something called type confusion. Now,
Speaker 1: to get into type confusion in detail would go beyond
Speaker 1: my meager knowledge and understanding of coding. So I'm not
Speaker 1: going to dive too deeply into this because more likely
Speaker 1: than not, I would just say something that was wrong,
Speaker 1: and rather than try to get it right and get
Speaker 1: it wrong, I'm going to give you a very high
Speaker 1: level look at what type confusion is. So the Miter
Speaker 1: Corporation says that type confusion happens when quote the program
Speaker 1: allocates or initializes a resource such as a pointer, object,
Speaker 1: or variable using one type, but it later accesses that
Speaker 1: resource using a type that is incompatible with the original type.
Speaker 1: End quote. That clears it up right. So type in
Speaker 1: this case references a set of values as well as
Speaker 1: a set of operations allowed to be performed on those values.
Speaker 1: That's about as deep as I can get into that
Speaker 1: without running into the danger of hopelessly confusing myself and
Speaker 1: probably saying the wrong thing. But certain coding languages lack
Speaker 1: memory protection capabilities, like C programming language doesn't have that
Speaker 1: memory protection capability built into it, and so a hacker
Speaker 1: can try to purposefully kind of confuse a program and
Speaker 1: gain out of bounds memory access, which can lead to
Speaker 1: all sorts of bad outcomes. Now, to manage this with
Speaker 1: Google Chrome, because that's the program we're looking at right here,
Speaker 1: right as a web browser. The way you would take
Speaker 1: advantage of this vulnerability is a hacker would typically create
Speaker 1: a website an HTML document, and within the document, the
Speaker 1: hacker would embed this attack so that when someone who
Speaker 1: is using an unpatched version of Google Chrome visits that page,
Speaker 1: the attack initiates. Now, what the attack does is dependent
Speaker 1: upon the nature of the malware itself, so it could
Speaker 1: be used to do all sorts of things like steel
Speaker 1: information or inject a different kind of malware into a
Speaker 1: target computer, all sorts of different stuff, so you can
Speaker 1: see why experts recommend users update Google Chrome to patch
Speaker 1: out that vululnerability. Apparently at least one such attack was
Speaker 1: found out in the wild, so this isn't just a
Speaker 1: zero day vulnerability. There was evidence found of zero day attacks,
Speaker 1: so this is something that's happening right now. So again,
Speaker 1: if you use Google Chrome, make sure you update it
Speaker 1: to the most recent version. It is not difficult to do.
Speaker 1: It might require you to reboot your computer, but that's
Speaker 1: the biggest hassle involved with it, and it could potentially
Speaker 1: prevent you from being part of a massive hacker attack.
Speaker 1: So go ahead and do that. Because the hackers have
Speaker 1: been aware of this for a while now, we were
Speaker 1: just made aware of it over this past weekend. All right,
Speaker 1: that's it for this episode. I hope you are all well.
Speaker 1: If you would like to reach out to me, you
Speaker 1: can do so on Twitter. The handle for the show
Speaker 1: is tech Stuff HSW where you could download the iHeartRadio app.
Speaker 1: It's free to download, free to use. You can just
Speaker 1: go into the little search field type in tech stuff.
Speaker 1: It'll take you to the podcast page results. Go into
Speaker 1: the podcast. You'll see a little microphone icon. If you
Speaker 1: click on that, you can leave a voice message up
Speaker 1: to thirty seconds in length. Let me know what you'd
Speaker 1: like to hear, and I'll talk to you again really soon.
Speaker 1: Tech Stuff is an iHeartRadio production. For more podcasts from iHeartRadio,
Speaker 1: visit the iHeartRadio app, Apple Podcasts, or wherever you listen
Speaker 1: to your favorite shows.