WEBVTT 1 00:00:00.080 --> 00:00:02.160 So you wake up, right, you pour your coffee, you 2 00:00:02.160 --> 00:00:04.719 sit down on your couch, and you flip open your 3 00:00:04.799 --> 00:00:05.919 laptop to check your email. 4 00:00:06.360 --> 00:00:09.439 Sounds like a totally normal, peaceful morning, exactly. 5 00:00:09.480 --> 00:00:13.320 It feels peaceful, but the reality is actually quite a 6 00:00:13.359 --> 00:00:16.519 bit darker because the second you connect to the Internet, 7 00:00:16.600 --> 00:00:20.120 you're essentially walking at your front door and stepping straight 8 00:00:20.160 --> 00:00:22.559 onto an active, hostile battlefield. 9 00:00:22.679 --> 00:00:25.920 Yeah you just you know, you can't see the artillery. 10 00:00:25.600 --> 00:00:28.719 Right, And that is exactly the core premise we're exploring 11 00:00:28.760 --> 00:00:31.879 in today's deep dive. We are looking at this incredibly 12 00:00:31.920 --> 00:00:36.039 revealing book called Advance Persistent Threat Hacking, The Art and 13 00:00:36.159 --> 00:00:38.840 Science of Hacking Any Organization. 14 00:00:38.560 --> 00:00:40.000 Bye Tyler Wrightson, Yeah. 15 00:00:39.799 --> 00:00:42.799 By Tyler Wrightson. And our mission today is basically to 16 00:00:42.840 --> 00:00:45.719 completely dismantle this myth that any organization out there is 17 00:00:45.719 --> 00:00:47.119 one hundred percent secure. 18 00:00:46.880 --> 00:00:49.159 Right, because none of them are, exactly And. 19 00:00:49.119 --> 00:00:51.679 We want to redefine what a modern threat actually looks 20 00:00:51.759 --> 00:00:55.159 like and dig into the mechanics of some truly mind 21 00:00:55.159 --> 00:00:56.520 blowing historical breaches. 22 00:00:56.799 --> 00:00:58.840 I think what's so great about Rightson's book is that 23 00:00:58.880 --> 00:01:02.880 he brings this very analytical, almost clinical perspective to a 24 00:01:02.960 --> 00:01:06.239 subject that, well, you know, it usually just generates a 25 00:01:06.239 --> 00:01:07.120 ton of anxiety. 26 00:01:07.200 --> 00:01:09.319 For sure. It's terrifying stuff it is. 27 00:01:09.840 --> 00:01:12.840 But he makes this really compelling case that while our 28 00:01:12.920 --> 00:01:16.239 digital world relies on all this complex cryptography and like 29 00:01:16.560 --> 00:01:21.959 intricate firewalls, the true vulnerabilities, the actual reasons these networks 30 00:01:22.000 --> 00:01:24.760 get compromised, they're almost always rooted in human nature. 31 00:01:24.920 --> 00:01:28.480 Human nature and like basic economic imbalances. Icly, yeah, so 32 00:01:28.719 --> 00:01:30.959 before we get into the actual mechanics of how these 33 00:01:30.959 --> 00:01:33.599 networks fall apart, I think we really need to establish 34 00:01:33.599 --> 00:01:36.719 who is breaking them down. The text lays out this 35 00:01:36.840 --> 00:01:39.280 framework called the threat pyramid. 36 00:01:39.480 --> 00:01:41.920 Right, the threat pyramid, so the author uses a very 37 00:01:41.959 --> 00:01:46.280 specific equation to categorize these actors. It's motives plus capabilities 38 00:01:46.319 --> 00:01:47.439 equals threat class. 39 00:01:47.480 --> 00:01:48.200 Okay, got it. 40 00:01:48.200 --> 00:01:50.239 And then you take that threat class and add history 41 00:01:50.719 --> 00:01:53.159 and that gives you your threat. So at the very 42 00:01:53.159 --> 00:01:56.519 bottom foundation of this pyramid you have the unsophisticated threats, 43 00:01:56.640 --> 00:01:59.439 the ut exactly, these are just individuals with you know, 44 00:01:59.680 --> 00:02:02.959 minimum technical expertise. And then you move up through smart 45 00:02:02.959 --> 00:02:05.000 threats all the way to the very top, which is 46 00:02:05.000 --> 00:02:06.519 the advanced persistent threat or. 47 00:02:06.480 --> 00:02:09.800 APT, which for a long time the security industry basically 48 00:02:09.840 --> 00:02:15.680 reserve that APT term strictly for massive state sponsored intelligence agencies. 49 00:02:15.280 --> 00:02:18.560 Right, Yeah, the ones with bottomless budgets and huge teams. 50 00:02:18.680 --> 00:02:21.360 Right. But I really want to challenge our cultural perception 51 00:02:21.400 --> 00:02:25.159 of hacking here because the book fundamentally redefines what an 52 00:02:25.240 --> 00:02:26.879 APT is for the modern era. 53 00:02:27.000 --> 00:02:28.240 It totally does. 54 00:02:28.120 --> 00:02:31.400 Because I mean, we are all conditioned by Hollywood to 55 00:02:31.439 --> 00:02:34.400 picture a hacker as you know, some guy sitting in 56 00:02:34.439 --> 00:02:37.599 a dark room by hoodie, right, the hoodie is furiously 57 00:02:37.639 --> 00:02:41.240 typing custom green code to like smash through a firewall. 58 00:02:41.879 --> 00:02:44.719 But the text argues that an APT can actually just 59 00:02:44.759 --> 00:02:47.439 be a single, isolated individual. 60 00:02:47.520 --> 00:02:49.520 Yeah, they might have a microscopic budget, but what they 61 00:02:49.520 --> 00:02:53.800 have is a highly refined skill set and just relentless patients. 62 00:02:53.800 --> 00:02:55.280 Relentless, that is the word. 63 00:02:55.400 --> 00:03:00.319 It's the defining characteristic. A true APT will literally study 64 00:03:00.360 --> 00:03:03.960 a specific target for months. I mean they'll map out 65 00:03:03.960 --> 00:03:08.120 the organizational chart, observe the technology stack, and just wait. 66 00:03:08.360 --> 00:03:11.319 Just waiting for one employee to make a slight misstep. 67 00:03:11.520 --> 00:03:14.520 Exactly, And to your earlier point about the custom code 68 00:03:14.560 --> 00:03:17.159 from the movies, they increasingly rely on what the author 69 00:03:17.199 --> 00:03:19.319 calls exploitless. 70 00:03:18.439 --> 00:03:21.159 Exploits, Right, I was hoping we touch on that, because 71 00:03:21.199 --> 00:03:24.560 exploitless exploit sounds like a total contradiction. But the book 72 00:03:24.639 --> 00:03:27.520 uses this crowbar analogy that I think explains it perfectly. 73 00:03:27.599 --> 00:03:29.240 Oh, the crowbar is a great way to look at it. 74 00:03:29.319 --> 00:03:31.360 Yeah, because a crowbar is just a piece of metal, right. 75 00:03:31.680 --> 00:03:34.560 A carpenter uses it to remove nails, which is helpful, 76 00:03:34.879 --> 00:03:37.479 while a burglar uses it to force open a window. 77 00:03:37.680 --> 00:03:40.719 The tool itself is completely neutral. It's the intent that's 78 00:03:40.759 --> 00:03:41.919 malicious exactly. 79 00:03:42.319 --> 00:03:44.960 So in a network environment, an attacker doesn't need to 80 00:03:44.960 --> 00:03:48.439 write some super complex custom virus if they can just 81 00:03:48.599 --> 00:03:53.159 use the company's own perfectly legitimate file transfer software to 82 00:03:53.360 --> 00:03:55.520 quietly export sensitive data. 83 00:03:55.560 --> 00:03:59.080 Because to a firewall, that data exultration just looks like, 84 00:03:59.199 --> 00:04:02.080 you know, an author user backing up files over a 85 00:04:02.120 --> 00:04:03.520 completely standard protocol. 86 00:04:04.080 --> 00:04:06.639 Wow, So the security systems don't trigger it all. 87 00:04:06.639 --> 00:04:09.719 Nope, because the software is behaving exactly as it was 88 00:04:09.759 --> 00:04:11.039 designed to see. 89 00:04:11.039 --> 00:04:14.960 That exposes a massive structural flaw in how we defend networks. 90 00:04:15.520 --> 00:04:19.519 I mean, if a single individual using built in administrative 91 00:04:19.519 --> 00:04:22.879 tools is that potent, it raises a really frustrating question. 92 00:04:23.079 --> 00:04:26.040 Why do massive corporations fail to keep them out? 93 00:04:26.240 --> 00:04:29.399 Yes, they spend millions of dollars every year on dedicated 94 00:04:29.439 --> 00:04:32.600 to IT security teams. Why does they consistently fail? 95 00:04:33.000 --> 00:04:36.839 Well, right away, the text points to this brutal economic reality. 96 00:04:36.920 --> 00:04:40.079 The ROI, the return on investment for cybercrime is just 97 00:04:40.560 --> 00:04:41.639 completely skewed. 98 00:04:41.639 --> 00:04:44.040 Oh the bank robbery stat Yeah, there's a statistic in 99 00:04:44.079 --> 00:04:47.040 the book from twenty eleven that says the average physical 100 00:04:47.079 --> 00:04:50.040 bank robbery netted the criminal about eight thousand dollars. 101 00:04:50.199 --> 00:04:52.319 Just think about the logistics of that. For eight grand, 102 00:04:52.399 --> 00:04:55.240 you need a weapon, a disguise, maybe a getaway vehicle. 103 00:04:55.319 --> 00:04:57.279 You're risking a shootout right, an. 104 00:04:57.279 --> 00:05:01.279 Armed confrontation, high speed evasion, and and potentially decades in 105 00:05:01.319 --> 00:05:04.759 a federal penitentiary, all for a payout that barely covers 106 00:05:04.759 --> 00:05:05.680 a couple months of rent. 107 00:05:05.759 --> 00:05:06.839 It's insane, but. 108 00:05:06.800 --> 00:05:10.600 Cybercrime flips that entire risk reward ratio on its head 109 00:05:11.040 --> 00:05:15.319 and attacker faces practically zero physical risk, none at all. 110 00:05:15.399 --> 00:05:18.000 They can operate from a country with no extradition treaties, 111 00:05:18.120 --> 00:05:21.759 stay completely anonymous, and siphon six or seven figures from 112 00:05:21.759 --> 00:05:23.199 a database from their couch. 113 00:05:23.040 --> 00:05:25.959 In a matter of hours. So the financial incentive is 114 00:05:26.000 --> 00:05:29.879 just overwhelmingly in their favor, but the defenders are also 115 00:05:30.000 --> 00:05:34.000 fighting this mathematically unwinnable battle right The book calls it 116 00:05:34.040 --> 00:05:35.120 the numbers game. 117 00:05:35.399 --> 00:05:38.000 The numbers game is brutal for defenders. 118 00:05:37.519 --> 00:05:41.120 Because a corporate security engineer has to flawlessly manage the 119 00:05:41.199 --> 00:05:45.639 staggering amount of variables they're configuring, hundreds of servers, patching apps, 120 00:05:45.879 --> 00:05:47.959 managing user permissions, training. 121 00:05:47.639 --> 00:05:50.639 Staff, and the attacker only needs that engineer to overlook 122 00:05:50.720 --> 00:05:54.040 one single detail, one tiny mistake. 123 00:05:53.759 --> 00:05:56.439 And that asymmetry is compounded by just how complex our 124 00:05:56.439 --> 00:05:59.560 software is. Now. The text uses Windows seven as an example, 125 00:06:00.000 --> 00:06:02.279 as it contains roughly fifty million lines of code. 126 00:06:02.439 --> 00:06:07.240 Fifty million. No human or even a massive team of humans, 127 00:06:07.279 --> 00:06:10.000 can hold the entirety of that architecture in their heads. 128 00:06:10.279 --> 00:06:13.319 It's impossible even if the developers achieved a near miraculous 129 00:06:13.519 --> 00:06:16.920 error rate, say just one percent of one percent of 130 00:06:16.920 --> 00:06:20.199 that code contained an exploitable logical flaw. 131 00:06:20.240 --> 00:06:22.279 Which is an incredibly generous. 132 00:06:22.000 --> 00:06:25.680 Error, very generous, But even then, that still leaves five 133 00:06:25.759 --> 00:06:30.000 hundred latent vulnerabilities baked right into the system, just waiting 134 00:06:30.040 --> 00:06:30.839 to be discovered. 135 00:06:31.040 --> 00:06:34.600 And when a researcher or a malicious actor actually finds 136 00:06:34.600 --> 00:06:37.480 one of those flaws, we enter what the industry calls 137 00:06:37.519 --> 00:06:38.399 the patch gap. 138 00:06:38.680 --> 00:06:40.160 Ah, the patch gap. 139 00:06:40.319 --> 00:06:43.759 Yes, from my understanding, it's basically this perilous window of 140 00:06:43.800 --> 00:06:47.439 time between a software vendor publicly acknowledging a vulnerability and 141 00:06:47.480 --> 00:06:50.000 the end user actually installing the security update. 142 00:06:50.160 --> 00:06:52.439 Yeah, and that gap is structural. It's built into the 143 00:06:52.480 --> 00:06:55.199 system because a software company has to write the patch, 144 00:06:55.560 --> 00:06:57.839 then test it rigorously because you don't want the patch 145 00:06:57.879 --> 00:07:02.120 to accidentally crash other business apps, then distribute it. 146 00:07:02.240 --> 00:07:04.879 And then you have to rely on network administrators to 147 00:07:04.959 --> 00:07:07.720 actually schedule the downtime to apply it exactly. 148 00:07:07.839 --> 00:07:12.000 And that whole process can take weeks, sometimes months. Meanwhile, 149 00:07:12.040 --> 00:07:15.639 attackers are actively monitoring those vulnerability announcements. 150 00:07:15.720 --> 00:07:18.120 They see the announcement and just pounce immediately. 151 00:07:18.480 --> 00:07:21.920 They deploy attacks targeting all those unpatched systems. They basically 152 00:07:21.959 --> 00:07:22.839 live in that gap. 153 00:07:23.079 --> 00:07:25.399 But I'd argue the problem is even deeper than just 154 00:07:25.439 --> 00:07:29.160 the logistics of software updates, because the text delves into 155 00:07:29.240 --> 00:07:30.879 the psychology of insecurity. 156 00:07:31.279 --> 00:07:33.319 Right. The psychological aspect is huge. 157 00:07:33.360 --> 00:07:39.720 It introduces this concept of ambiguous causality. Basically, human evolution 158 00:07:39.920 --> 00:07:44.079 wired us to learn from immediate physical feedback. The book 159 00:07:44.120 --> 00:07:46.160 has this brilliant analogy about a car radio. 160 00:07:46.319 --> 00:07:47.759 I love the car radio analogy. 161 00:07:47.879 --> 00:07:50.040 Right. If you park in a dangerous neighborhood and leave 162 00:07:50.040 --> 00:07:53.199 your doors unlocked and someone steals your radio, you come 163 00:07:53.240 --> 00:07:56.399 back and see the shattered glass, the emotional sting is immediate. 164 00:07:56.519 --> 00:07:58.720 You feel the loss right then and there, exactly. 165 00:07:58.959 --> 00:08:02.519 Your brain instantly hardwire as a lesson, lock the doors. 166 00:08:02.279 --> 00:08:05.439 Next time, because our brains are fantastic at processing immediate 167 00:08:05.439 --> 00:08:09.160 physical consequences. But the digital realm totally strips. 168 00:08:08.800 --> 00:08:11.079 That away, totally. I mean, if you click remind me 169 00:08:11.160 --> 00:08:14.160 later on a critical security update for your laptop, nothing 170 00:08:14.199 --> 00:08:15.399 physical happens. 171 00:08:15.079 --> 00:08:17.000 Your computer keeps running perfectly fine. 172 00:08:17.199 --> 00:08:20.839 Yeah, But then three months later, your credit card data 173 00:08:20.879 --> 00:08:24.480 is sold on some dark web forum, and maybe another 174 00:08:24.519 --> 00:08:27.920 two months pass before you even notice the fraudulent charges 175 00:08:27.920 --> 00:08:28.720 on your bank statement. 176 00:08:28.800 --> 00:08:30.800 The causality is entirely severed at that. 177 00:08:30.800 --> 00:08:34.279 Point, completely. Your brain fails to connect the pain of 178 00:08:34.320 --> 00:08:38.039 the stolen money with the decision to ignore that one 179 00:08:38.120 --> 00:08:40.879 specific software update five months prior. 180 00:08:41.240 --> 00:08:45.080 And because that feedback loop is broken, users continually engage 181 00:08:45.120 --> 00:08:48.320 in high risk digital behaviors, which brings us to a 182 00:08:48.360 --> 00:08:49.840 pretty sobering realization. 183 00:08:50.080 --> 00:08:52.919 Yeah, that the defense is so inherently fragile and the 184 00:08:52.960 --> 00:08:55.639 attack surface is so vast that the actors at the 185 00:08:55.759 --> 00:08:58.559 very bottom of the threat payer maide. Those unsophisticated threats 186 00:08:58.919 --> 00:09:00.679 can inflict catastros damage. 187 00:09:00.759 --> 00:09:02.679 Yeah, let's talk about those load tier threats. The text 188 00:09:02.799 --> 00:09:06.000 highlights physical skimmers as a prime example of this evolution. 189 00:09:06.240 --> 00:09:07.120 Oh the skimmers. 190 00:09:07.200 --> 00:09:11.559 Right. Initially, these started out as like crude, bulky machines 191 00:09:11.639 --> 00:09:14.679 that a corrupt cashier might secretly swipe your card through. 192 00:09:14.960 --> 00:09:17.039 But the hardware kept shrinking drastically. 193 00:09:17.519 --> 00:09:22.120 Criminals started cannibalizing cheap MP three players, using the tiny 194 00:09:22.200 --> 00:09:26.200 microscopic memory chips to build these razor thin overlays that 195 00:09:26.279 --> 00:09:29.360 sit perfectly flush inside an ATM card slot. 196 00:09:29.519 --> 00:09:31.320 That's terrifying. They just slide it right in. 197 00:09:31.519 --> 00:09:33.639 Yeah, and then they pair that with a tiny pinhole 198 00:09:33.679 --> 00:09:36.639 camera pointed at the keypad, and suddenly they are capturing 199 00:09:36.639 --> 00:09:39.759 both the magnetic strap data and your PN and they 200 00:09:39.799 --> 00:09:42.679 didn't have to alter a single line of banking code. 201 00:09:42.720 --> 00:09:46.960 Wow. And we see that same low tech approach successfully 202 00:09:46.960 --> 00:09:51.039 attacking major critical infrastructure too. The book outlines this massive 203 00:09:51.080 --> 00:09:53.840 fraud campaign that targeted the power grid in Puerto Rico. 204 00:09:53.960 --> 00:09:55.639 Oh that's a fascinating case. 205 00:09:55.759 --> 00:09:59.240 Yeah, people realized they could trick their residential smart electricity 206 00:09:59.279 --> 00:10:03.480 meters to drastically under reporting their power consumption. And they 207 00:10:03.480 --> 00:10:07.159 didn't do this by like hacking the utility central servers. 208 00:10:07.360 --> 00:10:08.519 No, nothing that complex. 209 00:10:08.600 --> 00:10:12.879 They simply place high powered neodymium magnets right on the exterior. 210 00:10:12.399 --> 00:10:14.840 Of the meters, which is brilliant in its simplicity. 211 00:10:15.080 --> 00:10:16.799 I was actually trying to wrap my head around the 212 00:10:16.799 --> 00:10:20.720 physics of that. From what I gather, those smart meters 213 00:10:20.840 --> 00:10:24.679 use internal current transformers to measure the flow of electricity. 214 00:10:25.360 --> 00:10:29.919 So a strong external magnetic field basically saturates the magnetic 215 00:10:29.960 --> 00:10:33.320 core inside the meter, totally blinding it so it can't 216 00:10:33.320 --> 00:10:34.799 register the power passing through. 217 00:10:34.960 --> 00:10:38.080 That is a perfect explanation of the physical mechanism. Yeah, 218 00:10:38.200 --> 00:10:41.559 exact or the book mentions they would use a cheap 219 00:10:41.759 --> 00:10:44.879 three hundred dollars optical probe purchased. 220 00:10:44.440 --> 00:10:46.320 Online, just off the internet. 221 00:10:45.960 --> 00:10:49.000 Right, they'd interface with the meter's diagnostic port and just 222 00:10:49.080 --> 00:10:53.879 alter the reporting software. That complete lack of sophistication costs 223 00:10:53.879 --> 00:10:56.960 the utility company and estimated four hundred million dollars in 224 00:10:57.000 --> 00:10:57.840 a single year. 225 00:10:58.039 --> 00:11:01.440 Four hundred million dollars yeah, just from magnets and cheap probes. Yea. 226 00:11:01.679 --> 00:11:03.879 Then there was the social engineering angle, which is perfectly 227 00:11:03.919 --> 00:11:06.039 illustrated by the Hollywood hacker Chris Cheney. 228 00:11:06.120 --> 00:11:08.559 Oh, Chris Cheney. This really highlights the human element. 229 00:11:08.879 --> 00:11:12.320 He gained access to the private email accounts of major celebrities, 230 00:11:12.559 --> 00:11:17.879 including Scarlett Johansson, which resulted in those highly publicized photo weeks. Now, 231 00:11:17.960 --> 00:11:20.799 you would assume a breach of that magnitude required, I 232 00:11:20.799 --> 00:11:24.320 don't know, an advanced decryption or a zero day exploit. 233 00:11:24.440 --> 00:11:25.960 Right, you'd think he was a mastermind. 234 00:11:26.480 --> 00:11:29.600 But the man was a self admitted novice. He didn't 235 00:11:29.600 --> 00:11:30.440 write malware. 236 00:11:30.759 --> 00:11:35.000 No, he bypassed the technical perimeter entirely. He just attacked 237 00:11:35.039 --> 00:11:36.360 the account recovery process. 238 00:11:36.440 --> 00:11:39.480 Yeah. He simply typed their email addresses and clicked forgot 239 00:11:39.559 --> 00:11:42.720 password mm and the systems prompted him with those standard 240 00:11:42.759 --> 00:11:45.320 security questions things like what was the name of your 241 00:11:45.320 --> 00:11:48.159 first pet or what high school did you attend. 242 00:11:47.840 --> 00:11:50.919 Which is a huge flaw when your targets are public figures. 243 00:11:51.080 --> 00:11:54.559 Exactly because of their public figures, he just opened a second 244 00:11:54.559 --> 00:11:57.720 browser tab, read through their Wikipedia pages or some old 245 00:11:57.759 --> 00:11:59.360 magazine interviews. 246 00:11:59.200 --> 00:12:01.480 And typed in the an it's almost too easy. 247 00:12:01.559 --> 00:12:03.879 And once he was in the account, he accessed the 248 00:12:03.879 --> 00:12:08.000 settings and created a hidden forwarding rule, so every single 249 00:12:08.039 --> 00:12:12.039 future email they received was silently copied directly to his 250 00:12:12.080 --> 00:12:12.799 own inbox. 251 00:12:13.240 --> 00:12:18.519 It perfectly demonstrates how a static verification system relying on 252 00:12:18.799 --> 00:12:23.200 biographical trivia as a security credential, it just fails completely. 253 00:12:23.240 --> 00:12:25.360 In the era of search engines, it totally fails. 254 00:12:25.480 --> 00:12:28.399 It also highlights with the book calls the weaponization of software. 255 00:12:29.000 --> 00:12:31.799 Take the case of Barry Ardolf, the quote unquote neighbor 256 00:12:31.799 --> 00:12:32.240 from Hell. 257 00:12:32.519 --> 00:12:34.240 Oh, this story is wild. 258 00:12:34.320 --> 00:12:37.679 He gets into this petty suburban dispute and decides to 259 00:12:37.720 --> 00:12:41.399 frame his neighbor for federal crimes. So he breaches the 260 00:12:41.440 --> 00:12:45.799 neighbor's home wireless network, which was using this outdated protocol 261 00:12:45.840 --> 00:12:50.559 called WP, and he routes horrific emails, including bomb threats 262 00:12:50.600 --> 00:12:53.120 to the Vice President through the neighbor's IP address. 263 00:12:53.159 --> 00:12:55.080 Well just to trigger a secret service rate on the 264 00:12:55.080 --> 00:12:56.159 poor guy's house. 265 00:12:56.120 --> 00:13:00.080 Which worked. But okay, WP or wired equivalent privacy i' 266 00:13:00.120 --> 00:13:02.480 voice heard WP was weak. But what actually makes it 267 00:13:02.559 --> 00:13:03.440 so easy to break? 268 00:13:03.799 --> 00:13:06.159 Basically, it comes down to how it handles the encryption 269 00:13:06.320 --> 00:13:09.399 keys WEP uses a very short string of data called 270 00:13:09.399 --> 00:13:11.879 an initialization vector to scramble the signal. 271 00:13:12.000 --> 00:13:15.679 Okay, an initialization vector, right, But because that vector is 272 00:13:15.720 --> 00:13:19.200 so short, the router ends up reusing the exact same 273 00:13:19.240 --> 00:13:22.519 mathematical values repeatedly as it transmits data packets. 274 00:13:22.639 --> 00:13:23.320 Oh icee. 275 00:13:23.399 --> 00:13:25.840 So if an attacker just sits outside your house with 276 00:13:25.879 --> 00:13:29.600 an antenna and simply captures enough of those overlapping packets, 277 00:13:29.840 --> 00:13:32.159 they can use a basic software tool to analyze the 278 00:13:32.200 --> 00:13:33.120 patterns and. 279 00:13:33.080 --> 00:13:34.600 Just reverse engineer the master. 280 00:13:34.399 --> 00:13:36.480 Passwords exactly in a matter of minutes. 281 00:13:36.559 --> 00:13:40.639 Wow. And that's the crucial point about Ardolf. When federal 282 00:13:40.679 --> 00:13:44.879 agents finally analyzed his hard drive, they didn't find sophisticated 283 00:13:44.919 --> 00:13:49.120 custom code. They found step by step pdf tutorials downloaded 284 00:13:49.120 --> 00:13:49.799 from the internet. 285 00:13:49.879 --> 00:13:51.440 He was just following instructions. 286 00:13:51.519 --> 00:13:55.480 Yeah, he didn't understand the cryptographic failures of WEP. He 287 00:13:55.600 --> 00:13:57.759 was just following a recipe and using port and click 288 00:13:57.799 --> 00:13:59.159 software built by someone else. 289 00:13:59.240 --> 00:14:01.919 And that encapsulate it's the whole concept of the weaponization 290 00:14:02.000 --> 00:14:05.639 of software. Historically, to execute a cyber attack, you needed 291 00:14:05.679 --> 00:14:09.720 a deep understanding of networking protocols and memory allocation. But 292 00:14:09.840 --> 00:14:13.960 today these highly complex attack vectors are packaged into really 293 00:14:14.159 --> 00:14:19.360 user friendly interfaces. The barrier to entry has completely evaporated. 294 00:14:18.879 --> 00:14:23.240 Which empowers individuals with zero technical background to execute sophisticated 295 00:14:23.279 --> 00:14:26.759 attacks exactly which leads us to a pretty daunting pivot. 296 00:14:27.320 --> 00:14:29.799 If point and click tools in the hands of some 297 00:14:30.000 --> 00:14:35.080 angry neighbor can trigger a secret service investigation, what is 298 00:14:35.159 --> 00:14:36.000 the ceiling here? 299 00:14:36.080 --> 00:14:37.320 That's the terrifying question. 300 00:14:37.559 --> 00:14:41.159 What happens when the entities building these tools possess limitless funding, 301 00:14:41.720 --> 00:14:45.039 teams of elite mathematicians, and a geopolitical mandate. 302 00:14:45.080 --> 00:14:47.000 Well, that brings us right back to the apex of 303 00:14:47.039 --> 00:14:51.960 the threat pyramid. The true advanced persistent threats typically nation states, 304 00:14:52.519 --> 00:14:55.559 and the clearest manifestation of that capability discussed in the 305 00:14:55.600 --> 00:14:56.679 text is Stucksnet. 306 00:14:56.879 --> 00:14:59.159 Okay, so before we dive into the architecture of stuxnet, 307 00:14:59.240 --> 00:15:01.559 I need to set an necessary guardrail for you listening. 308 00:15:02.159 --> 00:15:05.360 The book attributes the creation of stucksnet and its variants 309 00:15:05.440 --> 00:15:09.840 to specific nations, namely the United States and Israel operating 310 00:15:09.879 --> 00:15:13.279 against the Iranian nuclear program. We are strictly examining the 311 00:15:13.320 --> 00:15:17.159 technical analyzes and historical claims exactly as they are presented 312 00:15:17.200 --> 00:15:19.440 by the author and the source XT We are not 313 00:15:19.639 --> 00:15:23.080 endorsing these geopolitical attributions, and we aren't taking a position 314 00:15:23.120 --> 00:15:26.440 on the underlying conflicts. We are just reporting on the 315 00:15:26.480 --> 00:15:28.639 technological milestones the book describes. 316 00:15:28.759 --> 00:15:31.000 And it's a vital distinction to make. But from a 317 00:15:31.000 --> 00:15:36.919 pure engineering perspective, stucksnet fundamentally altered the entire security landscape. 318 00:15:37.000 --> 00:15:40.799 How so well in the security community, discovering a single 319 00:15:41.080 --> 00:15:45.120 zero day exploit, meaning a software vulnerability that is completely 320 00:15:45.200 --> 00:15:48.639 unknown to the vendor so no patch exists, that is 321 00:15:48.679 --> 00:15:50.120 considered a massive. 322 00:15:49.799 --> 00:15:51.679 Win, right, A zero days the holy grail. 323 00:15:51.799 --> 00:15:56.960 Yeah, but stucksnet suxnet deployed four distinct Windows zero day 324 00:15:57.039 --> 00:15:59.240 exploits simultaneously, four of them. 325 00:15:59.320 --> 00:16:02.600 Yeah, just put that in perspective. Possessing four zero days 326 00:16:02.639 --> 00:16:04.720 is like walking up to the world's most secure facility 327 00:16:04.960 --> 00:16:08.120 and realizing you secretly hold master keys to the front gate, 328 00:16:08.159 --> 00:16:11.120 the elevator, the vault door, and the safety deposit boxes. 329 00:16:11.320 --> 00:16:14.519 That's exactly what it's like. Furthermore, the nature of these 330 00:16:14.519 --> 00:16:18.919 specific exports was totally unprecedented. The text highlights that none 331 00:16:18.919 --> 00:16:20.320 of them relied on memory corruption. 332 00:16:20.639 --> 00:16:23.360 Okay, let me see if I grasp the significance of that. 333 00:16:24.559 --> 00:16:28.240 My understanding of memory corruption like a buffer overflow, is 334 00:16:28.240 --> 00:16:30.799 that you try to force a computer to store more 335 00:16:30.919 --> 00:16:34.080 data in a specific block of memory than it was 336 00:16:34.080 --> 00:16:34.840 designed to hold. 337 00:16:35.000 --> 00:16:37.120 Yes, exactly, It's like trying to pour. 338 00:16:36.960 --> 00:16:39.840 A gallon of water into a tank glass. Great visual 339 00:16:40.200 --> 00:16:44.080 The excess spills over overwriting adjacent memory spaces where the 340 00:16:44.080 --> 00:16:48.240 computer actually keeps its operating instructions, and the attacker hopes 341 00:16:48.279 --> 00:16:51.039 to overwrite those instructions with their own malicious code. 342 00:16:51.120 --> 00:16:55.159 That is a highly accurate visualization. The problem for an attacker, though, 343 00:16:55.200 --> 00:16:58.679 is that buffer overflows are inherently unstable. Often the program 344 00:16:58.759 --> 00:17:02.279 simply crashes, the user notices the application froze, and it 345 00:17:02.679 --> 00:17:03.399 gets notified. 346 00:17:03.519 --> 00:17:07.160 Ah So, by avoiding memory corruption entirely, the creators of 347 00:17:07.240 --> 00:17:12.319 Stuxnet ensured their exploits relied on perfectly reliable, quiet logic flaws. 348 00:17:12.400 --> 00:17:15.680 Yes, the system never crashed, It just seamlessly executed the 349 00:17:15.759 --> 00:17:16.839 unauthorized commands. 350 00:17:17.359 --> 00:17:21.079 And to further mask its presence, the worm signed its 351 00:17:21.119 --> 00:17:25.480 own code using legitimate digital certificates stolen from major hardware 352 00:17:25.519 --> 00:17:29.599 manufacturers in Taiwan. So the operating system just trusted it 353 00:17:29.640 --> 00:17:30.559 implicitly it. 354 00:17:30.599 --> 00:17:33.920 Did, But the truly groundbreaking element of stux Net was 355 00:17:34.000 --> 00:17:37.160 its final payload, the PLC rootkit. 356 00:17:37.400 --> 00:17:40.839 I found the concept of a PLC fascinating because, well, 357 00:17:40.960 --> 00:17:44.440 my laptop doesn't have one. Why is a programmable logic 358 00:17:44.480 --> 00:17:47.480 controller so vital to an industrial facility? 359 00:17:47.599 --> 00:17:50.400 So a PLC is the critical junction between the digital 360 00:17:50.440 --> 00:17:52.319 instructions and kinetic reality. 361 00:17:52.359 --> 00:17:53.200 Ginetic reality. 362 00:17:53.279 --> 00:17:55.519 Yeah, it's the physical piece of hardware that receives a 363 00:17:55.559 --> 00:17:59.400 command from a computer, like increase pressure, and it physically 364 00:17:59.440 --> 00:18:01.319 opens a vow, accelerates a motor. 365 00:18:01.440 --> 00:18:01.920 Oh wow. 366 00:18:02.000 --> 00:18:05.039 So stucks neet infected the windows baked monitoring computers in 367 00:18:05.079 --> 00:18:07.839 the control room. Sure, but its ultimate objective was to 368 00:18:07.839 --> 00:18:10.720 rewrite the logic residing on the PLCs that were connected 369 00:18:10.720 --> 00:18:12.640 to the uranium enrichmentd centrifuges. 370 00:18:12.920 --> 00:18:15.480 The book uses an analogy here that I think perfectly 371 00:18:15.480 --> 00:18:19.599 distills the horror of a PLC rootkit. Imagine you're driving 372 00:18:19.599 --> 00:18:24.640 a modern car. Stucksnet infects the car's central computer. It 373 00:18:24.720 --> 00:18:28.440 maliciously commands the engine control unit to accelerate to one 374 00:18:28.480 --> 00:18:31.519 hundred miles per hour, pushing the engine way past its 375 00:18:31.559 --> 00:18:35.400 red line until it physically destroys itself. Right, However, and 376 00:18:35.440 --> 00:18:38.480 this is the insidious part it intercepts the data flowing 377 00:18:38.519 --> 00:18:41.240 back to your dashboard, so your speedometer is locked at 378 00:18:41.240 --> 00:18:43.319 a reassuring thirty five miles per hour. 379 00:18:43.480 --> 00:18:47.640 It's chilling. Stucks net manipulated the PLCs to force the 380 00:18:47.680 --> 00:18:53.160 physical centrifuges to spin at destructive erratic frequencies, but simultaneously 381 00:18:53.279 --> 00:18:57.880 it fed pre recorded, completely normal operational data back to 382 00:18:57.920 --> 00:19:00.200 the human operators staring at their monitors, so. 383 00:19:00.160 --> 00:19:03.039 The engineers had no indication anything was wrong, none at all. 384 00:19:02.960 --> 00:19:05.319 Not until the hardware literally tore itself apart in the 385 00:19:05.359 --> 00:19:05.960 physical world. 386 00:19:06.079 --> 00:19:09.160 It totally bridges the gap between digital sabotage and physical destruction, 387 00:19:09.400 --> 00:19:12.039 and the text details how STUCKSNT was really merely the 388 00:19:12.079 --> 00:19:15.759 opening salvo. It was followed by these incredibly sophisticated descendants 389 00:19:15.920 --> 00:19:17.000 like Duqua and Flame. 390 00:19:17.319 --> 00:19:22.440 Right Degree was repurposed primarily for reconnaissance rather than destroying hardware. 391 00:19:22.799 --> 00:19:27.279 Its objective was to silently infiltrate networks and gather intelligence. 392 00:19:26.839 --> 00:19:30.640 And it achieved this via a highly targeted fishing campaign 393 00:19:30.720 --> 00:19:32.799 carrying a word document right Yes. 394 00:19:33.119 --> 00:19:36.119 The exploit triggered of vulnerability in the way the Windows 395 00:19:36.119 --> 00:19:39.480 operating system rendered a specific true type font. 396 00:19:39.720 --> 00:19:43.039 Which sounds completely bizarre. On the surface, we think of 397 00:19:43.039 --> 00:19:45.480 a font as just a collection of visual shapes, like 398 00:19:45.519 --> 00:19:47.480 the curve of an S or the stem of a T. 399 00:19:48.400 --> 00:19:50.839 How does a shape compromise an operating system? 400 00:19:51.039 --> 00:19:54.200 Well, it's because fonts are not just static images. They 401 00:19:54.200 --> 00:19:59.200