[army shouting]
[Narrator] Normandy.
1204 A.D.
For two years,
the English-occupied fortress known as the Chateau Gaillard
has withstood the trebuchets,
battering rams
and tunneling efforts of an attacking French army.
It was a stalemate,
one that might have continued indefinitely
were it not for an otherwise unremarkable
French foot soldier
[Bogis] Bonjour!
[Narrator] named Peter Bogis.
One bloody day as the battle raged around him,
Bogis scanned the exterior of the fortress
and saw what no one else did.
A weak point ready to be exploited.
By some accounts, it was the exit chute of a latrine
located inside the fortress's chapel,
added at the specific request of England's King John.
Regardless of origin, it was a flaw.
The only one Bogis needed to enter undetected.
Once in, he hauled up dozens of his waiting French comrades.
Chaos ensued.
English defenders scattered.
The siege was over.
[crowd cheering]
Thousands of tons of stone,
the latest in defensive architecture,
and yet no one had thought to secure the toilet.
And so the vulnerability sat unnoticed for years
until the moment when Peter Bogis spotted it
and crawled his way into history.
Today's fortresses are made of code, not stone.
They guard information, not territory or treasure.
But they still contain vulnerabilities—
architectural flaws overlooked by their creators.
And just like in 1204, the Peter Bogis of today—
hackers,
spies,
cyber criminals,
are searching for undiscovered ways to gain access.
So what do you do if you are responsible
for protecting the accounts,
data centers
and cloud systems relied on by people around the world?
You do everything you can to find the vulnerabilities first,
wherever they may be.
[♪ anthemic music ♪]
When it's your job to keep billions of people safe online,
you have to live and breathe and see the internet
just like the attackers do,
because the only way to stop a hacker
is to think like one.
Remember Royal?
He's in charge of Privacy, Safety and Security at Google.
[Royal] How are you?
[Director] Hey, Royal. Good to see you again.
[Royal] Good to see you.
You're coming out of that little box there.
We are the central team that looks out across all
of the Google products
for the privacy of users,
the security of Google and much of the internet.
[Narrator] Wait, much of the internet?
That seems like a lot of extra work.
[Royal] Right. [laughs]
[Narrator] But to make sure Google's users are safe,
it's necessary.
After all, people don't just use Google's apps
and cloud services.
They use hundreds of devices, tools, websites
and operating systems, all different, all connected,
just as the internet's founders intended.
[Royal] They made a decision very early on
to open-source the standards by which computers
and then ultimately webpages would communicate
with one another.
That was a conscious decision to have an open internet.
You can place the improvements in the lives of the billions
of people on this planet at the feet of that decision
to allow everyone to participate and innovate.
[Narrator] But this interconnected world
comes at a price.
Today, a vulnerability in any part of the system
threatens every part of the system.
[Alex] Let's say I'm a normal user.
I wake up, I get my coffee.
I open up my phone.
This phone is made by one company.
I click on a button to check my email.
The app is written by another company.
I see a link, I click that link.
It opens up my social media site.
Something that to a normal user is a 90 second experience
that seems like it's nice and smooth and integrated,
there's actually a lot of complexity on the back end.
[Royal] The safety of that individual depends
on finding a vulnerability and getting it fixed faster
in one of those dependent platforms,
computers,
software packages,
before they're abused.
The open internet is harder to defend.
Google said "We're gonna dedicate a team
to finding
the hardest-to-find vulnerabilities."
[♪ upbeat music ♪]
[Narrator] Who’s responsible for this team of elite hackers?
Meet Parisa Tabriz.
She oversees Google's Project Zero
and in a former life, was a bit of a hacker herself.
[Parisa] I think I identified at some point as a hacker.
I still am in spirit,
but I also think of myself as more a hacker manager
than a hacker.
[♪ video game music ♪]
[Narrator] Years of dealing with the world's nastiest
exploits and vulnerabilities has made her the perfect person
to guide a team
that's always on the hunt for new ones.
[♪ upbeat music ♪]
[Parisa] Project Zero makes the internet safer
by looking at it through a hacker lens
and trying to rigorously,
ruthlessly break it
and then fix it
and prevent problems from happening in the first place.
[Narrator] That's right.
Project Zero is a team
of hackers that makes the internet safer
by trying to hack it.
Each success eliminates a weak point
that would have threatened the people and businesses
that rely on Google and the internet at large.
But to understand this team's name,
you have to understand the vulnerabilities they hunt.
A zero-day vulnerability
is a weak point in a program's code
that’s been discovered by an attacker
but not by the people responsible for fixing it.
That means when the vulnerability is exploited,
defenders will have had zero days notice.
They'll be surprised,
exposed,
scrambling,
just like the English defenders inside Chateau Gaillard.
[Tim] Zero-day vulnerabilities are too powerful,
too cheap and too numerous.
[Commander] There is nothing you can do now.
[Tim] And we think someone has to do something
about making them harder to use,
making them more expensive,
making them less frequent.
[Narrator] Zero-days have been used in cyber attacks
of all kinds,
from surveilling human rights activists
to damaging physical infrastructure,
to well, you remember Aurora.
[Tim] The vulnerability that was exploited there
was a bug in Internet Explorer,
a Microsoft product.
That is the kind of case
in point that sometimes the weakest point
for Google might be a non-Google product.
[Narrator] This is Tim.
[Director] Smiling is encouraged.
[Tim] Ha!
[laughs]
Alright. Hi.
[Narrator] Tim is the ringleader of Project Zero.
And at the age of 15, he was hacked.
[Tim] I was chatting to random people
and they're like "Do you want a cup holder?"
And I'm like, “What?”
"Do you want a cup holder?"
I'm like, "Uh...
okay."
And then they opened my CD drive,
and I was like,
“Oh, that's really cool.
How did you do that?"
And then they wouldn't tell me.
[Narrator] Each member of the team
has their own origin story,
but they all have a few things in common.
[Parisa] So a great Project Zero member is somebody
who loves security research
and finding bugs
and wanting to find problems
that nobody else knows exists.
Sometimes people will ask me,
“How do you find a bug?”
Or, “How do you do vulnerability research?"
And at the end of the day,
it's almost like asking someone,
“How do you make art?”
[Narrator] To find vulnerabilities hidden
inside connected fortresses of all kinds,
you need the best— a hacker who can hack anything.
[Natalie] My motto is
"Hack Everything."
[Narrator] Meet Natalie.
[Natalie] Hey.
[Narrator] True to her motto,
Natalie has hacked phones,
webcams,
arcade games,
microwaves,
selfie sticks—
[Natalie] I do have a crate
of 50 dismantled selfie sticks.
[Narrator] Keyboards,
USB sticks,
battery packs,
fans,
and Tamagotchis.
[Natalie] I won't lie.
I am an extremely big fan of Tamagotchis.
If you wanna hack strange things,
there's a lot of stuff out there.
[Narrator] And that's just what she does on the weekends.
At work, she looks for dangerous vulnerabilities
in the apps used by billions of people.
[Natalie] I've been looking for vulnerabilities
in software for more than 10 years now.
And you start to get a feel
for where vulnerabilities will be.
What sort of stuff do developers make mistakes
while writing?
And video processing is actually a big one.
[Narrator] That's right.
The apps we use every day to talk to
family,
friends,
school
and work
were potentially home to a zero-day vulnerability.
With little more than a hunch,
Natalie went to work testing the defensive architecture
of various video chat apps by calling herself...
[phone ringing]
a lot.
[Natalie] I would say one in a thousand things
I tried or less worked.
That's the nature of hacking and finding vulnerabilities.
Almost everything you try doesn't work.
But the odd thing does.
[Narrator] In this case,
the odd thing led to an important discovery,
a way to force someone's phone
to start transmitting video and audio
without them even knowing.
Here's how the hack actually works:
Natalie sends a chunk of data
known as a packet
to a target phone.
A perfectly normal step in making a video call.
But hidden in this packet
along with the typical call commands is extra data
that the target software isn't expecting.
Most random extra data would simply cause an error,
but this extra data,
one of the thousands of combinations Natalie tried,
acts like a key,
tricking the target phone
into answering the call without anyone even touching it.
Vulnerability confirmed.
Exploit executed.
Hack completed.
Five different video chat applications
all had the vulnerability.
Meaning if you're one
of the billions of people that use these services,
it would've been possible for someone to watch
and listen to you without your knowledge.
Fortunately, there was no evidence the flaw
had ever been used for harm,
but just like with all of Project Zero's biggest finds,
the implications for the safety
of our connected world were more than a little ominous.
[Natalie] There always is this caution where
what might be a good day of work for you
is actually a bad day
for users and might reveal something
about security that shows things
are less secure than we thought.
[Narrator] As soon as Natalie notified
the various companies of their apps' vulnerabilities,
changes got made,
patches went out.
The online world got a little more secure.
[♪ ambient music ♪]
But getting zero-days fixed quickly
hasn't always been so easy.
[dial up modem beeps]
Back in the 90s,
members of the hacker collective The L0pht
would look for vulnerabilities in the early internet,
then do whatever it took to get people to listen,
even talk to Congress.
[Sen. Fred Thompson] The Washington Post describe you
as rock stars of the computer hacking elite.
We appreciate your being with us here today.
Within 30 minutes,
the seven of you could make the internet unusable
for the entire nation.
Is that correct?
[Mudge] That's correct.
And until the problem mushrooms up
and enough people complain about it,
then they'll come out with a public fix.
[Tim] It was fairly common for particular companies
if you report a bug to them,
some of them took more than six months to get fixed.
Some of them were just, they just were never fixed.
They just went into a black hole.
[♪ ambient music ♪]
So when Project Zero finds a vulnerability
from our own research, [♪ upbeat music ♪]
we report it to the company.
"That's day zero.
This is the vulnerability.
This is where we think it is."
Sometimes even ,"This is how we think you should fix it."
And that's when we'll start the timer.
If the company doesn't fix the bug in 90 days,
then on day 90, we put it all online.
[Narrator] By online,
he means on the Project Zero blog.
And while this kind of reveal doesn't happen often,
the prospect of having an unpatched vulnerability exposed
to the whole world is a powerful motivator.
[Tim] Companies would disagree with us by the way.
They would prefer that we stay silent a lot of the time
and not talk about this type of stuff.
The real core of all of this
is that
users lose when things don't get fixed quickly.
[♪ ominous music ♪]
In December 2018,
Google's Threat Analysis Group, or T.A.G.
had discovered a cache of exploits
that were being used
against a popular mobile device.
They came over to Project Zero for analysis.
We were able to reverse the exploits,
reverse out the vulnerabilities.
The implant in there allowed them to pull chat history,
photos,
GPS locations,
you name it—
it was capable of doing it.
We reported those issues to the company and the company
that makes that device,
I believe, pushed out a fix within seven days.
[Narrator] More troubling,
was that Project Zero's analysis revealed the exploits
had been in use for quite some time.
[Tim] The exploits that were discovered
went back many generations
of this particular mobile technology device.
This had been happening for many years.
[Narrator] The exploits were being used to surveil members
of the Uyghur community, an ethnic minority in China.
[Tim] Seeing a capability like this being used
against a population,
it's like a stark reminder
of what we're doing here has importance.
And it's not just playing around
with code or dealing with vendor politics
or company politics when it comes to disclosures
and to and fros.
There are real people getting attacked by bugs like this.
And it's important that we do something about it.
[city sounds]
[♪ soft music ♪]
[Narrator] The exploit being used
to surveil the Uyghurs was a major find,
but it was just one of many.
To date, Project Zero has found
over 1,800 zero-day vulnerabilities
in everything from operating systems to dating sites
to Google's own apps and services.
That's 1,800 trap doors
that will never be crawled through.
1,800 fortresses that have been made a little more secure.
But every day new code is written,
new apps are launched
and the internet we all depend on
gets a little more interconnected
and a little more vulnerable.
[Tim] Is my job getting harder every year?
Well I hope so,
because otherwise we're probably not doing it well.
[Natalie] We could sometimes see on the forums
these financial attackers,
credit card thieves being like, “Darn it,
that didn't work anymore.”
And that was extremely satisfying
because I think everyone deserves to be secure.
I think that vulnerabilities
and security problems harm people
both financially and sometimes physically.
And I think it's important
that everyone is able to use computers
in a way that doesn't threaten them.
[Tim] Is there an end game for Project Zero?
I would like to see a world where
it's incredibly hard to find a vulnerability.
Will we get there anytime soon?
Probably not.
But does that mean we should stop trying?
Absolutely not.
[Narrator] So Project Zero stays on the battlefield,
inspecting the walls,
trying to find and test vulnerabilities first
so they can never be used for harm.
[Parisa] You have hackers who use their skills
to harm other people and profit.
And I usually call them attackers
and you have a lot of hackers
who do their work
to make software and systems more secure.
And I call those folks...
heroes.