(mysterious music)
- [Johnny] It's November 10, 2008.
Barack Obama just won an election,
and he travels to the White House to meet
with the outgoing president, George Bush.
In that meeting, Bush told Obama about a top-secret weapon
that the U.S. military had been developing
with Israel since 2005, code named Project Olympic Games.
This weapon was intended to hit
one of Iran's most fortified nuclear facilities,
buried deep underground,
where centrifuges spin uranium to enrich it
for use as energy or, with enough spinning,
to be used in a nuclear weapon.
(dramatic music continues)
But this secret weapon wasn't a missile.
They weren't planning an air strike.
Instead, it was a computer file,
less than a megabyte in size,
150,000 lines of pristine code.
This is the weapon
that the president had to tell Obama about.
This little file had been planted in Iran,
where it spread throughout the whole country.
But it didn't do anything.
It laid dormant until it found its way
onto a flash drive that was then plugged in
at this underground nuclear facility.
(air whooshing)
And then it spread,
finding its way to its final target: this one machine.
And then, the weapon started working,
quietly reprogramming the software
to very subtly sabotage these delicate spinning centrifuges,
opening a valve to change the pressure,
telling the centrifuge to spin a bit faster or a bit slower,
all while telling the technicians
that everything was working properly.
(mysterious music)
Over time, these subtle manipulations
destroyed these centrifuges.
This was one of several weapons that the U.S. had planted
in Iran using sophisticated computer code.
Now, if a war broke out with Iran,
the U.S. could turn off their power,
could turn off their military defense systems,
making it so they couldn't shoot down planes.
They could turn off their command and control systems
so they couldn't talk to each other during the fight.
This was a real war plan executed by thousands
of American military personnel,
hundreds of millions of dollars,
and a cyber operation that would, quote,
"Prepare the battlefield by weakening Iran's ability
to fight," all of it using code.
The code that sabotaged the nuclear facility
was eventually discovered
and named after some of the elements that were inside
of these many lines of code: .stub or MRxNet.
They called it Stuxnet.
Now, this weapon did slow down Iran's progress at first,
but it didn't stop them.
But what this did do was showcase a new style of war:
the use of quiet weapons in the form of a tiny text file
that could self-replicate
and wreak actual physical damage on an enemy.
We call this cyber warfare,
and it has become a fixture of modern conflict.
Let me show you how it works.
(mysterious music continues)
- [Speaker] We're moving into a new era here.
- [Speaker] People are actually getting killed.
- [Speaker] Dismantle our communications systems.
- [Speaker] At the click of a button,
you can bring down nations to their knees.
(mysterious music continues)
- Before Stuxnet, most cyber warfare was pretty basic.
Like in the '80s, you had this situation
where an East German hacker
broke into some military computers in the US
looking for secrets for the FSB,
which was like the Soviet spy agency.
Or more recently, like in 2007,
where Russian hackers attacked a bunch of Estonian websites
in the financial, government, and media sectors,
shutting them down, as retaliation against Estonia deciding
to relocate a Soviet monument.
These were cyber attacks,
but they were pretty weak and unsophisticated,
especially compared to what was soon to come.
So we live in a weird time.
Our information is less secure than ever.
And now my phone and my email
and my physical mailbox are inundated
with stuff I don't want to see.
I feel like my information is just leaked out
to anyone and everyone who wants it.
And this, of course, is a part of today's video.
But it also has to do with the sponsor of today's video,
which is Incogni.
Incogni is a platform that allows you
to get yourself off of the lists
that data brokers use to get your information.
It's really cumbersome and time-consuming
to go through the process to be taken off these lists.
The companies make it intentionally hard at times.
So what you do is you sign up for Incogni
and you give them permission to act on your behalf
to go out and request that you be taken off
of these data broker lists.
There's a link in my description.
It is incogni.com/johnnyharris.
When you click the link,
it helps support the channel, you get 60% off
when you sign up for the annual plan.
The annual plan allows Incogni to month after month go
and strip you off of these lists
so that you can retain your privacy over time.
So thank you, Incogni, for sponsoring today's video.
With that, let's dive into this deep, complicated,
intense, wild story of cyber warfare.
(dramatic music) - The true power
of the internet.
- [Speaker] Empowering the internet generation.
- [Speaker] I got on the internet.
- We have to remember that, in the early 2000s,
most of the world wasn't built off of the internet yet.
Internet speeds were getting good,
software was getting sophisticated,
and computers and their software were becoming
the foundation to many big invisible industries,
like shipping, finance, and energy.
And crucially, hackers, who had grown up on the internet,
were getting really good at finding vulnerabilities
in these systems, breaking into them,
learning to exploit them.
Now, how those hackers ended up selling their secrets
to the U.S. government in the name of making cyber weapons
is the next part of the story.
(mysterious music)
But first, a quick word on software,
this thing that runs our modern life
that is mostly invisible but that is endlessly important.
That ensures that you have electricity
and that you can access your bank account and do your job.
All of this is made possible because of something
that looks very simple:
lines and lines of code.
They're just basically lists of instructions
on how a system should run,
what it should do in every circumstance,
and who has access to what.
But because more and more of the world is run on software
and software contains sensitive information,
like your Social Security number or bank account number,
whatever, developers build their software like a castle.
(mysterious music)
So this is our software castle.
It has walls and locked doors
that only authorized users are allowed to get into.
But inevitably, because it's a big, complex castle,
the builders of this castle, on accident,
left little holes, little vulnerabilities,
weak spots, secret doors,
that if an intruder could find would allow them
to get in, where they can steal things
or even take control of parts of the castle.
They can lock the owner out and only give them access
in exchange for money.
Or they could just leave little time bombs
that will blow up later.
Almost all software has some kind of vulnerability
that would allow a hacker to get in and control things.
But the worst kind, arguably, and the nightmare scenario
for software developers is the zero-day.
(mysterious music)
It's called a zero-day exploit
because, by the time the intruder gets
into the software castle,
the developers had known about this for zero days,
meaning they didn't know, they were unaware.
They were blindsided by this attack.
It was a hole in their castle that somebody found,
and now they're screwed.
Now, once a hacker gets in,
developers often know that there was a vulnerability.
They can work on patching it,
but that takes time, and then, of course,
they have to get the users to update their software
in order for that patch to actually work.
And we all know how kind of annoying that is.
A zero-day exploit is a software developer's nightmare,
which, in turn, makes it a hacker's dream.
Some hackers will spend their time looking
for zero-day exploits in really powerful software,
like the software that runs your iPhone
or Google Chrome or Windows operating systems
or a million other pieces of software that run our world.
Some are interested in doing this
so that they can get money or passwords.
That's the criminals.
Or others are interested in gaining control
of underground nuclear facilities and electricity grids.
That would be the government.
(mysterious music)
Okay, so let's say that you're a really sophisticated hacker
and you have somehow found a zero-day exploit
for an Apple iPhone iOS.
You can get into someone's iPhone and control it.
That's a really valuable thing.
You now have a few choices on what to do
with that information.
Number one, you could go right to Apple
and you could give it to them.
And they will pay you handsomely.
Right now, they will pay you $1 million
in exchange for a zero-day exploit
that allows you to hack into their iPhone.
Every big software company does this.
Like Google will give you $150,000
if you can find a way to take over one of their Chromebooks
via a website.
Software companies offer these bug bounties
because they want to know
where the holes in their castle are.
They want to patch them.
They want to avoid the nightmare of being hacked into
and compromising the security and privacy of their users.
So yeah, that's one of your options, sell it to Apple,
get a million bucks, totally aboveboard.
We'll call this the white market.
But you could also sell it on the black market
to criminals who want to use these exploits
to make money, which happens.
Like in 2016, there was this case where hackers
that may or may not have been linked to North Korea
were able to hack into the central bank
of the country of Bangladesh.
They were able to make all these fraudulent requests
and like hijack the Swift system
that transfers all the money.
And in the end,
they were able to get $81 million transferred
to their bank account in the Philippines.
Their end goal was to get closer to $1 billion,
but because of a typo in one of their fraudulent requests,
they got caught and it got shut down.
But the point is that there's a black market
for zero-days because there's a lotta money to be made
if you can hack into a financial system.
But you also have a third option here.
If you have a zero-day exploit,
you can sell it to a government or a military.
They tend to have pretty big budgets.
And more and more, they interested
in developing cyber weapons, hacking tools that they can use
against their enemies.
We'll call this the gray market,
and the money here is pretty big.
(mysterious music continues)
So there's all these middlemen brokers for zero-days.
They're like dealers.
There's one Russian zero-day dealer who,
a few months ago, tweeted out that,
"Due to high demand," their clients are now willing
to pay $20 million, a hundreds times more,
for a hacking tool that uses zero-day exploits
that allows them to fully hack an iPhone or Android device.
And then, they specified that their client
is a non-NATO country,
which experts basically say is them saying like,
"This is Russia.
Like our client is Russia."
(mysterious music continues)
These three markets for zero-days
show us just how valuable these little bits of code
have become, because they aren't just little bits of code.
They are now weapons.
They are access to very valuable castles of software.
Criminals want them.
Software companies want them.
But more and more, governments want them.
And this is how the U.S. and Israel built Stuxnet,
their big weapon against Iran, using zero-days.
Not just one zero-day exploit, but four.
- [Journalist] And what Iranian official describe
as an act of nuclear terrorism.
- And this is the reason why experts
and the ex-director of the CIA call Stuxnet
a game-changer for warfare.
Because whenever a county uses a big new weapon,
all of the other countries,
especially the rivals, realize that they have to match
that capability and ideally one-up it.
That's how arms race works.
That's how nuclear weapons have worked.
And that explains the concern of the ex-director of the CIA.
- This has the whiff of August 1945.
- 1945 being the year that a nuclear weapon was used in war,
thus changing the world and the balance of power
between countries forever.
- Somebody just used a new weapon.
And this weapon will not be put back into the box.
(dramatic music)
- So by the end of the early 2000s, after Stuxnet,
it truly was the beginning of a new era,
a new era of cyber warfare.
(mysterious music)
In 2012, Chinese-backed hackers broke
into the computer systems
of over a dozen oil and gas companies.
There was an investigation,
and the FBI and Homeland Security concluded
that the attack wasn't to steal anything
or even to sabotage the infrastructure,
but rather, to quote, "Gain strategic access
for future operations,"
meaning to gain leverage over the United States.
Investigators said that this was the first time
that they had seen anything like this.
That same year,
an Iranian hacker group attacked Saudi Arabia, Iran's enemy,
using a cyber weapon that is kind of like a digital bomb.
It was a virus called Shamoon,
and it got into the computers
of Saudi Arabia's state oil company,
wiping their hard drives clean.
This thing spread across the company's networks,
ultimately wiping data from tens of thousands of computers
and rendering them totally inoperable,
a huge blow to the company.
In 2015, a huge cyber attack occurred
when the Russian hacking group Sandworm shut off the power
to a quarter million Ukrainians by gaining control
of the computers that ran the power stations.
This is actual footage of them remotely controlling
these stations' computers.
- They used a piece of automated malware to do that,
which is a sign
that they will probably wanna use that again.
That looked like a kinda practice rounds
to develop the capability that they wanna have
to use globally.
- This set a new precedent.
People theoretically knew that cyber weapons could be used
against electricity grids,
which is like the lifeblood of our economy and society,
but it hadn't actually happened until this 2015 attack.
(mysterious music continues)
These are just a few examples,
but they're examples that show how cyber weapons
became employed in a war context between countries.
It wasn't just hackers trying to steal money.
It was countries trying to hurt their enemy,
trying to demonstrate their capabilities
to deter their enemy, to let them know
that they have power over them,
a tool of war, of national power.
And indeed, in 2010, the U.S. acknowledged this very overtly
by adding the U.S. Cyber Command as a new department
to the military.
Cyber war was here and it was here to stay.
- Today we face threats that have increased
in sophistication, magnitude, intensity,
volume, and velocity.
- But here's what's crazy is that these aren't weapons.
These aren't like missiles,
where a country has a monopoly over buying and using them.
Cyber weapons are just bits of code.
They're text files that are really small
and easy to transfer around.
So what happens when a cyber weapon developed
by a military gets into the hands of everyone
and they can use it however they want?
Well, that's exactly what happened in 2016.
- [Speaker] The DNC has called the FBI
after a deleting attempt to hack into voter databases.
- [Johnny] During the 2016 presidential election,
the U.S. was hit with a barrage of cyber attacks.
This included the hacking of emails
of the Democratic Party,
a misinformation campaign on social media,
and even an attempted hack of voter registration databases
in several states.
American intelligence agencies came together,
they investigated, and they concluded that this was Russia.
It was Russian hackers that were supported
and directed by the Russian government itself.
And the goal was to sabotage the American electoral system.
- The Russians were responsible for hacking the DNC.
- This was like a frenzy here in the United States.
Like everyone was talking about it.
It was a huge deal.
But in the middle of all of this,
a post quietly appears on GitHub
from a user by the name of theshadowbrokers.
This was a few months before the election.
It was a tense time for a lotta reasons.
They claimed that they had super powerful cyber weapons
from the American government's most elite cyber war group,
the ones who created Stuxnet,
and that they would sell these hacking weapons
to the highest bidder.
They would take their bids in Bitcoin.
They released a few pretty impressive samples
that actually looked pretty legitimate.
They released an encrypted file that said
contained more hacking weapons,
but you needed the password for it.
But they held onto it,
posting every once in awhile with a trickle
of more information, and honestly,
a lot of like bizarre rants on American hypocrisy
and broken English that felt
kind of intentional and caricatured.
They didn't end up getting very much money,
and it all looked fairly ridiculous.
But then, out of nowhere came this post.
(mysterious music) - [Computer Voice] "Last week
theshadowbrokers be trying to help peoples.
This week theshadowbrokers be thinking (beep) peoples."
- They were getting pretty spicy, and indeed,
they released this password,
this weird, weird password that they said
was the password to that encrypted file
that they had posted earlier.
And when you put that password in the encrypted file,
you discover that it is
exactly what theshadowbrokers said it was.
(intense music) 67 files
that comprised some of the most sophisticated
and dangerous cyber weapons that the NSA had ever created.
(intense music continues)
And among them, the most powerful of the bunch,
a tool called EternalBlue,
which allowed hackers to break into
and control the Windows operating system,
which is what most computers in this world use.
EternalBlue was like an open door.
Back to our castle analogy.
This was like a door into millions of castles
and the power to spy inside of the castle,
to unlock any door, to steal the contents of the castle,
to disrupt and break and destroy whatever you wanted
inside of the castle, to lock people out
of their own castle.
Yeah, I mean, this was like a sophisticated military weapon
that had just been duplicated and sent to anyone
who had an internet connection.
And what it meant was that theshadowbrokers,
in all of their like caricatured broken English,
were actually legit.
They had hacked in to our National Security Agency,
our secret spy agency, and stolen the cyber weapons
and sent them out to the entire world.
Not just to other governments, but to anyone.
So who are these shadowbrokers,
and how did they do this?
The answer and the kind of scary thing about cyber war
is that we don't totally know.
Experts think that Russia did this
to send a very clear signal to the NSA
and to the United States at-large
that, "Hey, we can do this.
We have the power to break into your biggest secrets,
and we will release them if we want to."
So now, after 2016,
we enter a new era of cyber warfare.
Stuxnet was a big turning point.
Theshadowbrokers and EternalBlue is our next turning point.
From here on, you see a new genre of more sophisticated,
more powerful cyber attacks.
(mysterious music)
Barely a month after the NSA's secret weapons leak out
by theshadowbrokers, a North Korean-linked hacking group
uses them to deploy a virus that spreads
to nearly every country on Earth within hours,
locking up hundreds of thousands of computers,
making them unusable, which halted hospital equipment,
police departments, governments, and railways
in over 150 countries.
(mysterious music)
You're sitting there on your computer and this pops up,
saying that your files are locked
and that you can get them back, but, quote,
- [Computer Voice] "You have not so enough time."
- [Johnny] Close quote, and that, quote,
- [Computer Voice] "You need to pay $300
worth of Bitcoin to do so."
- [Speaker] Malicious software (intense music)
has been taking computers hostage
in an unprecedented worldwide outbreak.
- This is called ransomware.
Basically, you ransom the computer files
and you have to pay.
This happened in a matter of hours.
It was only stopped because a 22-year-old researcher
accidentally activated a kill switch baked into the code.
So the bigger crisis was kind of diverted,
but even still, in just that few hours,
as WannaCry was spreading to 150 countries,
it caused hundreds of millions of dollars,
maybe even billions of dollars, of damage
and economic loss.
This showed us how powerful these NSA weapons could be
in the hands of bad actors.
And we learned this lesson once again
when these same weapons were used
by the masters of cyber warfare: Russia.
(mysterious music)
- [Speaker] The single biggest attack on record.
- [Johnny] It was June of 2017,
the night before Ukraine's Constitution Day,
when the Russian hacking group Sandworm deployed an attack
that was similar to their 2015 electrical grid attack.
But this time, they had the NSA weapons in their hands,
so it was a whole new level.
This one was called NotPetya.
This thing was potent.
It spread very quickly, and soon,
Ukrainians were seeing this scary screen
on their computer that literally started with, quote,
- [Computer Voice] "Ooops,
your important files are encrypted.
Perhaps you are busy looking for ways to recover your files,
but don't waste your time.
Nobody can recover your files
without our decryption service."
- It looked like another ransomware attack,
saying that you have to pay $300 worth of Bitcoin
in order to get your files released.
But meanwhile, it was spreading super fast
and wiping everything out in its path.
It took down Kyiv's mass transit system,
airports, hospitals, and it rapidly spread
through government agencies.
Gas stations and power grids went down,
credit cards stopped working,
and it shut down almost every ATM machine in the capital.
One person who was caught in the middle
of this cyber attack described it as,
"Life went very fast from, 'What's new on Facebook?'
to, 'Do I have enough money to buy food for tomorrow?'"
And it's a moment like this that we can really grasp
just how fundamental this infrastructure is to our lives.
And in this case, there was no kill switch.
It was so viral that it spread beyond its target of Ukraine
into other parts of the region,
hitting the systems of a bunch of companies,
like FedEx or the shipping company Maersk,
and soon tens of thousands of trucks were stuck for days
with no computers to guide them.
I mean, that's a lotta trucks.
And many, many others.
It affected tons of companies and agencies and systems,
all because of this one virus.
Unlike a missile or an invasion,
cyber can hide behind this hackery-looking screen.
This doesn't look like a state entity.
This looks like a hacker doing a ransomware attack
so they can make some money in Bitcoin.
But that's not what this was.
This was a coordinated, sophisticated attack
by the Russian government using an American cyber weapon
to make it more viral that caused an estimated $10 billion
in economic loss and damages.
And in the process, really blurring the lines
of the rules of war, where usually like,
you know what a country did to you
and you know how you're supposed to respond.
And all of that creates this nice balance
of like deterrence.
That's kind of the lifeblood of stability
in our global order.
When you've got these like shadowy,
like deniable attacks, it makes it way harder
to know how to respond,
to whom to respond,
and like what's proportional.
It just changes our view of conflict.
Which is why regimes like North Korea or Russia
have leaned very heavily on this type of engagement,
because as they become more isolated
and as their military becomes less effective,
this is a way for them to stay relevant,
for their enemies to continue to fear them,
because cyber is an actual weapon of war now.
(mysterious music continues)
But let me just say something that is probably not obvious
and might be surprising to you here at the end of the video.
Which is that the biggest threat in the future,
the thing that's gonna be the biggest part of cyber warfare
isn't gonna be these big, splashy,
like shut down the electrical grid,
doomsday scenario situations.
Those might happen. Those are real threats.
We need to prepare for them.
But like any weapon of war,
cyber is turning into a weapon
that is being deployed subtly,
that countries will use to get into the minds
of their enemies.
Like right now, we could be pretty certain
that Russia and China have quietly infiltrated parts
of our infrastructure systems.
They haven't done anything with that.
But they're probably there,
at least that's what a lot of analysts and experts think.
And that we have probably done the same to them.
And that we're all just sitting there
with our little time bombs put into our enemy's castle
in case we need to use them.
And we want our enemy to kind of know that we're there.
There's this list that I've been looking at
of all of the cyber attacks.
CSIS, the think tank
that I used to work at, documents these.
And I was surprised that I hadn't heard
of almost any of them because they're small,
but they're frequent.
To me, this is the future of cyber warfare.
It's not Stuxnet and WannaCry.
It's these death by 1,000 pokes,
psychological warfare, revealing to your enemy
that you have capabilities to infiltrate their systems.
And in that sense,
cyber warfare starts to look a lot like nuclear deterrence,
like a shadowy, hidden submarine with nuclear weapons
floating through the ocean somewhere,
capable of hitting your enemy.
And your enemy knows that.
They don't know where it is,
but they know that it's there.
And any calculation that they make on conflict
takes into account that that weapon is there
and could be used at any point.
This is the weird paradox of war and peace and deterrence.
That one of the forces that has kept our world stable
and rid of great powers conflict since 1945
has been the fact that we have very powerful weapons
all pointed at each other.
And therefore, we don't use them.
Cyber weapons are going the way of that kind of deterrence.
Hopefully, they'll never be used in the way
that we fear, that the sort of doomsday scenario
of like they shut down the electrical grid
and they do a full-scale attack.
Yes, there will continue to be these moments
where viruses spread, and to avoid those,
just update your damn software.
I hate it as much as you do, but like,
two-factor authentication, we gotta do it.
All that stuff, it's there for a reason,
because we live in a new world,
and we should be prepared for that world.
As for the war and the geopolitics of it all,
I'm gonna keep an eye on it,
because one thing in all of this is certain:
cyber is here to stay.
It is something we have to think about and understand
if we're going to understand the future of war.
(mysterious music continues)
Did you guys notice that this thing is here?
Nick, the studio manager, who's right over there,
brought this in and made it amazing.
And every time I talk, it moves.
And that is just freakin' cool.
Good job, Nick.
Also, Alex, (hands clapping)
good job to Alex as well,
who is the visual producer.
I want to say a giant thank you for all of those
who are here and especially those who are a part
of The Newsroom, which is our Patreon community.
We're doing this thing called independent journalism
on YouTube, and it is exciting and fun
and it's a lot of work.
And it is a lot of meticulous effort.
So I am very grateful for all those who support monthly
over on Patreon.
For those who do support over on Patreon,
you get access to my scripts.
You get this behind-the-scenes vlog
where you get to meet the team.
You get to see some behind-the-scenes action
of like what we're up to,
including like setting up this set.
We like filmed some of this,
and like you get to see sort of how it works.
You get to meet all of the like creative people
who are a part of it.
If you're looking for other ways to support the channel,
we have a poster that has a bunch of maps on it.
I don't know if by the time you're watching this,
it is still in print.
It could be sold out because we're only doing
like 1,000, I think.
So go click on the link in the description
and see if it's still there if it's interesting to you.
We also have LUTs and presets,
which is what we use to color our videos and our photos.
And oh, I don't know if you know this,
Tom Fox, who composes all of our music,
is now offering all of his music for free
for you to use in your videos.
That is a thing.
You can now use all of the music that you heard
in this video, (mysterious music continues)
which is like sick synth music
that we developed just for this video.
This is Tom Fox's synth.
You can download it for free, you can use it for free.
The caveat is, if you use it and you monetize your videos,
we will split the revenue 50/50.
And if you wanna license it for like one of your projects
or something, like you're making a documentary,
reach out to music@johnnyharris.ch
and we license music for your projects.
So that's cool.
A lot of you don't know, but we launched a new channel.
It is called Search Party.
It is with my old Vox colleague, Sam Ellis,
who is leading out on building this amazing new
like news brand that explains geopolitics,
as well as global sports, which strangely intersect
in more and more ways in our modern world.
That is Search Party.
It is live now.
There's loads of videos you can go check out.
They're similar to what I do here,
but Sam has his own style, his own approach,
very good, concise, journalism.
So go check that out, go subscribe, support that channel.
And I think that's it.
So yeah, that's it for me.
I guess I should say the thing that is strange.
Subscribe to my channel.
There's some real psychology around if I say,
like if you're not subscribed to the channel,
let me tell you that here, it matters.
Like the subscriber number really matters,
and it means that the video has a better chance
of doing well, which is the lifeblood
of everything we do here,
is like getting this journalism out
to as large of an audience as possible.
So if you're not subscribed, click the button.
And yeah, that's it, that's all I have to say.
Thank you all for being here.
Thanks for watching.
We've got a lot more videos coming up,
and I will see you in the next one.
(mysterious music continues)
Bye.
(screen hissing and whooshing)