Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Nicole Perlroth on spyware, “mutually assured digital destruction” and educating boardrooms
Guest:
Nicole Perlroth
Published:
Updated:
Duration:
40 min
Episode summary
In Nicole Perlroth’s blockbuster 2021 book, “This Is How They Tell Me the World Ends,” the former New York Times journalist conveys cybersecurity experts’ mounting anxiety about increasingly dangerous digital threats. From spyware to ransomware, the black market for cyber tools that skirt the law is lucrative and often poorly understood.
Nicole points to catastrophic cyberattacks like NotPetya, a 2017 ransomware look-alike that attempted to obliterate Ukraine’s critical infrastructure before causing billions of dollars in damages worldwide. But even with geopolitical tensions now at a fever pitch, Nicole, now a cybersecurity advisor and investor, explains why “mutually assured digital destruction” has so far helped stave off major attacks on U.S. critical infrastructure.
Also covered in the podcast:
The importance of educating board members about cybersecurity
What constitutes a cyber weapon
Why Nicole is optimistic about the future of ransomware
Spyware is not a weapon, but still dangerous Nicole distinguishes sabotage tools like Stuxnet from mobile spyware such as Pegasus, which she calls a potent surveillance tool that can be reverse engineered once sold and cannot be pulled back.
The West no longer controls the exploit market Brokers selling exclusively to Saudi Arabia and the UAE were nearly doubling prices for iOS and Android exploits, outbidding U.S. and Western agencies.
Disclosure changed the national conversation When The Times went public about being hacked by China, other organizations started admitting breaches too, shifting the debate from victim blaming to a national problem.
Deterrence rests on mutual access Adversaries and the U.S. are inside each other's critical infrastructure, and the risk of an immediate response has so far deterred major attacks; murky attribution through proxies is the West's weak point.
Boards now need the right questions Awareness is no longer the problem. Nicole points to CISA's cybersecurity performance goals as a way to give boards concrete questions about penetration testing, MFA and supplier vetting.
Notable quotes
By far, the hardest part of my time at the New York Times job was hacking the bureaucracy and getting the masthead to care about cybersecurity.
We're all in each other's systems holding guns to each other's heads.
If I'm not writing for my mom, mission will not be accomplished here, which is get everyday people to care.
We are now on the front lines of geopolitical conflict, which became very apparent with the NotPetya attack.
Questions this episode answers
Is NSO Group's Pegasus spyware a cyber weapon?
Nicole would not call it a cyber weapon, but a very potent espionage and surveillance tool that can turn a phone into an invisible ankle bracelet. She says it has too often been used against activists, journalists and dissidents. Read this section
Why does an Android zero-click exploit cost more than an iPhone one?
In her research Android exploits with the same capability were more expensive. She never confirmed whether that was due to Android's global market share or improved Android security. Read this section
How did The New York Times hack by China change cybersecurity coverage?
After The Times published its own breach story, many other organizations admitted they had also been hacked, and later reporting on a Shanghai-based PLA group helped lead to indictments and sanctions threats. Read this section
Why haven't nation-state hackers attacked U.S. critical infrastructure at scale?
Nicole describes an era of mutually assured digital destruction: countries are in each other's systems, and an attacker would expect the same attack back within moments. She worries more about Russia, which has less to lose. Read this section
What are recent wins against ransomware?
She points to the FBI and Justice Department quietly getting inside the Hive ransomware group and passing decryption keys to victims, and to Russia making its ties to criminal groups increasingly obvious. Read this section
About the guest
Nicole Perlroth is a former New York Times cybersecurity reporter and the author of the 2021 book This Is How They Tell Me the World Ends: The Cyberweapons Arms Race. At the time of recording, she had left journalism to work as a cybersecurity advisor and investor, including with Ballistic Ventures, and served as an advisor to CISA.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and I'm very excited to introduce our next guest on the show, Nicole Perlroth. She's a renowned InfoSec author, adviser, journalist, speaker, and all around cyber maverick. Nicole is perhaps best known for her twenty twenty one book. This is how they tell me the world ends the cyber weapons arms race, which is required reading for anyone interested in the dark underbelly of our increasingly digitized and interconnected world. The book's based on nearly a decade of her reporting at the New York Times where she wrote about pressing cyber threats to critical infrastructure, including nuclear power plants and major shipping companies. More recently, she left the journalism world to tackle cybersecurity problems head on as an adviser and investor. But before we hear from Nicole, let's get a quick word from our sponsor.
Attackers scan your systems daily. You just don't get the report. Synack security testing platform stands out by drawing on a trusted network of global security researchers. From web apps to headless APIs, our platform helps you find and fix gaps in your security posture. Learn more at synack.com. That's synack.com.
Nicole, thank you so much for joining us on the show. Really appreciate it. I'm so excited for this conversation, and I hope your new year is off to a great start so far.
Yes. Thank you so much. I'm obviously a big fan of Synack. I think the last time I was pregnant, I was very pregnant with Jay Kaplan at the Pentagon talking about Synack and then immediately went into labor and never got to write about it. So I feel like I owe Synack a huge favor here.
Oh, wow. Okay. That is a very particular moment in time. So thank you for sharing that. And I did wanna kick things off right away by hearkening back to your New York Times bestselling book, This is How They Tell Me the Cyberweapons Arms Race. Now for any listeners who may be worried by that title, the world has not yet ended, I'm pleased to report. But, Nicole, you did still deal with some pretty intense topics in that book. So I wanted to just start by picking out a phrase from the cover, which is this concept of cyber weapons or digital weapons. What does that term really mean to you?
Yeah. So to me, Stuxnet was a cyber weapon. There's no question. Using code that that can sabotage or manipulate critical infrastructure and the end result being the destruction of a key ingredient to a nuclear weapon, that is a strategic cyber weapon. I think it gets more messy when you get down to things like WannaCry. You know, North Korea using nation state tools that were stolen and leaked online from the NSA in a global ransomware attack that paused operations for a number of companies and police agencies and that kind of thing. Is that a cyber weapon? No. Maybe not by some people's definition, but it was an act of sabotage and destruction for some targets.
NotPetya, I think, was more of a cyber weapon in that it was a tool used in an attack that was intended to look like ransomware, but actually wasn't ransomware. It was just an effort to decimate data and paralyze data on target systems. And those targets included everything from Chernobyl's radiation monitoring equipment to Merck's vaccine production lines. Some people might say calling that a cyber weapon goes too far, but I think it's certainly one of the most dangerous, costly acts of cyber destruction we've seen, and maybe it doesn't matter whether we call it a cyber weapon or not. It's something that is sort of, harbing of this new era we're in.
Now I'd be curious to hear where you think really sophisticated spyware fits into that discussion that... Of the likes produced by, say, NSO Group. And I did wanna ask you, I know this... The the CEO of NSO Group, I guess, recently visited Washington DC to talk a little bit about use of spyware and almost making a defense of it as needed for combating crime or finding terrorists.
I wouldn't call it a cyber weapon, but it's certainly a very potent espionage tool, surveillance tool. NSO Group, for those who've been not paying attention over the last few years, is they're an Israeli company that sells mobile spyware predominantly that can be used to essentially turn your phone into an invisible ankle bracelet. And I talk about in the book how one of my sources just came over to my house, engaged in some banter. And then before he left said, take some pictures of my computer screen. And it was all of this internal documentation inside NSO about the capabilities of Pegasus, which is really their blockbuster product, which is mobile spyware. And some of the contracts that they were negotiating with governments like Mexico and The United Arab Emirates for their sale.
And that was the first time I'd heard of NSO Group. And that was around two thousand fifteen, sixteen. And then the next time I heard about it was when it started popping up on the phones of human rights activists in The UAE, journalists in Mexico, of people who were actually nutritionists in Mexico who were advocating for a soda tax there and really in these insidious use cases. And it was being used in some cases as an intimidation tool or a silencing tool, which was really disturbing. And so I was outing these cases, in some cases on the front page of the New York Times and NSO mounted a pretty big defense of its product. They said that it had played a role in catching Chapo, the Mexican drug lord.
They said it had been used to thwart major terrorist attacks, but I think we never really got clear evidence of those cases. Certainly in this era we're in, where Apple is increasingly adding encryption to our iPhones, etcetera, this is a potent tool for law enforcement, and it can be used in a lot of legitimate use cases. Unfortunately, we are hearing about too many cases in which it was used illegitimately or for corrupt purposes or to suppress the first amendment or human rights or dissidents, journalism, etcetera. And at the end of the day, it's not a cyber weapon, but it's certainly a critical ingredient for a surveillance state with a lack of oversight. And these are... You know, once you once once you sold these tools, they can be reverse engineered.
Right. It's so interesting. It's really releasing this very powerful functionality. I think you're I think you're right to draw a distinction between that and say, like, a weapon, which is just solely intended to maybe do damage or however you wanna define it. But it is so interesting. These, like, zero click. Like, you don't even have to click on anything, and suddenly you're infected, and they can get full visibility into everything that you're doing. One question that I have is with something so powerful and so expensive as well, these things can market for upwards of 7 figures, 8 figures even, depending on the extent of it. If a zero click iPhone exploit that works across multiple devices landed in your lap, what do you even do with that? I feel like it's such a hot potato.
Yeah. I think it is truly the crown jewels. That is what every government wants is a zero click remote code execution exploit that works on the iPhone or on Android phones. You know, it was interesting as I was doing my research to see that the cost of an Android exploit that gave you the same capability was actually more expensive. And we never really got to the bottom of it. Was it that Android just enjoys more global market share? Or was it that Android security had improved such that it was harder to hack than the iPhone? But what was really interesting to me is there is a market for these tools, for these exploits, and they're readily advertised on websites of companies like Zerodium in The United States. And we know NSO buys these exploits to bake into Pegasus and their other spyware technology.
But what was interesting to me is as I was wrapping up my book, I came across this new player in the space I'd never heard before called CrowdFence. I have no idea whether they're still operational, but they were outbidding the Zerodiums of the world. They were almost doubling the asking price for an iPhone or iOS or Android exploit. And who did they provide those tools to? They exclusively provided them to the Saudis and Emiratis. And so in other words, American government agencies or agencies in the West were already being outbid by some of these Gulf states when it came to, it came down to it. That's just kind of another red flag, I guess you'd say that these tools are... They're just out there. The West maybe at one point could claim control over this market or could say that they could outbid anyone else in this market, but that's just not true anymore.
And there are other states that technically are allies of ours, but have, let's say, more reckless human rights records and far more limited freedom of the press. And there... You know, it could go down a huge list... Long list of examples who are outbidding The United States for these tools. And so maybe it's time we talk about the fact that the cat's out of the bag and we talk about should there be some kind of boundaries for this market or some kind of international agreements or rules, or should companies like NSO be sanctioned or get in trouble or be blacklisted when they're caught selling these tools to governments that have less than stellar human rights record?
It's really interesting that you mentioned that evolution, and I know you do put in years of reporting ultimately into this this is how they tell me the world ends. Kicking off, as I understand it, with S4x13, I guess, this illustrious, we'll call it, cybersecurity conference in Miami Beach that draws some of the big control system and energy cybersecurity experts down to Florida once a year. I guess, what can you tell me about how both these markets that we've been discussing have changed and just how much the cybersecurity landscape has evolved since you really started putting together the concept for this book?
You know, the reason I dedicated this full chapter to that one S4 conference in Miami was because people like you and I and everyone in the cybersecurity industry knew that there was a market for zero days. We'd heard about it. It had been really hard as journalists to get to the bottom of it. Although people, certain journalists made big dents in a space like Andy Greenberg's wired story with the Grugq, etcetera. But what really brought me to this project was that S4 because it was the first time I had met people in this case, Luigi and Donato who had started ReVuln and this company based in Malta that sold zero days. But they didn't just sell zero days. They sold zero days specifically in ICS systems and industrial control systems. And those are used as we could start seeing that year, for acts of sabotage, like the Saudi Aramco attack or a Stuxnet like attack.
I mean, we haven't seen another Stuxnet, but things are getting pretty damn close. And so to me, it was raising this different question, which was, okay. We know that the tools of traditional espionage has been sold for as long as people have... As long as human history, as long as people have been spying on one another. That's not new. But selling code that can be used to sabotage pipelines, power grids, oil, gas, water, name your critical infrastructure, that's new. And I know from my reporting, at least that year, that there were a lot of adversaries for US adversaries that had the will to do us harm in the space, but really lack the skills.
And so it raised the question where people like Luigi and Donato and helping bridge that gap for governments or who knows who that wouldn't otherwise have the know how or skill sets to to find those zero days and craft those exploits and click and shoot tools of destruction. Was this sort of something we should all be paying attention to? And I think it turned out the answer was yes, because as we saw over the next couple of years, we started seeing serious acts of destruction, probably the worst of which was the Russian black energy attacks in Ukraine. But clearly governments were starting to focus here and the market was really for government agencies and many of whom had the will to achieve the Stuxnet success of The United States, but very different motivations.
I wanted to go back to some of your experiences at the New York Times because I think it could be pretty interesting and even instructive for a lot of our listeners. And coming from a bit of a wonkier journalism background myself, I got a lot of leeway to write about some of these nexus of energy and cybersecurity stories that you're alluding to, whether it's, you know, Russian sandworm hackers targeting American nuclear plants or whether it's the blackouts in Ukraine caused by the black energy malware and these sophisticated tools. But I didn't really have to do a lot of convincing to skeptical editors of whether this belongs on the front page. I... I'd be curious, you know, how did you insist, like, no. Actually, this is a big deal. We should be writing about this. How did you kind of break break through in some of your pitches to your editors? And, I guess, what made a cybersecurity story truly newsworthy for an outlet like the times?
Yeah. I would say, by far, the hardest part of my time at the New York Times job was hacking the bureaucracy and getting the masthead to care about cybersecurity. I don't think anyone realizes how tough a job that is. So, you know, it's interesting just to go back a bit. You know, when the times hired me, this was like 2009, 2010. We were just starting to really learn about Stuxnet, which was obviously a game changer. But I was hired by the business desk to cover enterprise technology, specifically cybersecurity, like YONFest. It's just, you know, who's acquiring who? You know? How are the antivirus companies doing? Should I cover their earnings announcements? That kind of thing.
Well, in fact then, the acquisition stories weren't that interesting. The the economy was still recovering from 2008, and the acquisitions were small. And usually, it was Symantec or McAfee or, I guess, Intel that were doing a lot of the acquiring and yada yada. But really the story was antivirus isn't working. The perimeter's gone. Hackers are finding new ways into the enterprise. Bring your own device is a freaking nightmare. The cloud's gonna be a freaking nightmare. And how many times can you tell that story? But the more interesting thing that was happening was I kept hearing this phrase. There's only two types of companies left in The United States. Companies that have been hacked, companies that don't know they've been hacked, which we can originally attribute to Dmitri Alperovitch, one of the cofounders of CrowdStrike, but was being plagiarized to death. Keith Alexander was testifying before congress that we were witnessing the greatest wealth transfer in history, and he was referring to Chinese IP theft.
I think James Comey had some similar quote along the same lines. And so from a journalist perspective, to me, there was nothing happening in the cybersecurity industry that was as interesting as is that true? Our companies... Has everyone really been hacked? Is all of our IP now in China? And so that's where I started. And it was really hard to get companies to open up about this, I think, because a lot of them worried about what their... What it would do to their share price if it came out that their IP had been stolen, what it would do to their potential acquisition. Again, everyone was still in sort of recession recovery mode. No one wanted to talk about this. They were worried they'd get a scarlet letter on their forehead. And then what happened next, I think was a blessing and a curse.
But for your question, this is what happened. The Times was hacked by China. And by the way, the story wasn't assigned to me. There was one editor who heard about it. I started hearing something from our IT department at the time who were always a fantastic resource for me. And I just started reporting on it. And Mandiant was still not really a household name then, but we brought Mandiant in. I could see how really not helpful the FBI was. They came in with their binders, and you have this feeling as a journalist or even as a citizen like, alright. Who did it? When are we gonna see people in the end cast? And so they ask you a bunch of questions. They close their binders, and you're lucky if you ever hear from them again. And I was hearing from Mandiant, like, you're just one of thousands. Sorry. This is what they do. And I was seeing how they moved laterally through an organization, ultimately what they were after, what incident response looked like in real time.
We would talk and joke about the Beijing summer intern who rolled into our networks at 9AM Beijing time and rolled out around five, ultimately in search of our sources. And just the headache it caused for the organization, calling my colleagues who were in China who hadn't even been told that they've been hacked. It was just the whole thing. It's just... It was an incredible opportunity to see what this actually looks like. And I knew it was playing out at companies all over The US that were were covering it up. And to the time's great credit, they let me tell the story on the front page. And there was at the very last minute some second guessing. Like, mascot was like, wait a minute. Why are we telling the story? I think someone asked, what will our competitors say? The Wall Street Journal, the Washington Post. And I remember saying, listen, I'm... This is way above my pay grade, but my two cents, I don't think they're gonna say very much because I think there's a very high likelihood that they have been hacked too.
And, ultimately, I think that argument went the day and when the story came out, it was like, weren't cool if you hadn't been hacked by China. Suddenly, everyone started raising their hands, and it really cracked open the conversation nationally. And next we did the story with Mandiant on Shanghai based PLA group who was conducting a lot of these hacks, also opened up the... This conversation much more and ultimately led the way for indictments and the threat of sanctions and on. That single hack though, I think arguably changed the national conversation from one a victim blaming to we have a huge freaking problem on our hands as a country.
Well, drawing connection to your current role as a cybersecurity adviser to various companies, including I saw recently, congratulations, Ballistic Ventures coming on board there, not to mention your role as an adviser for the cybersecurity and infrastructure security agency. I'm wondering those conversations with the masthead, that's convincing. How does that play out in boardrooms nowadays? How do you get companies that may be skeptical of cybersecurity of doing something about this problem? Are there any parallels there?
Yes. And I think this has been the ninth life ninth life of my book being a cybersecurity journalist in the space. We have multiple audiences. It's one of the biggest challenges of your job. How do you satisfy the technical cybersecurity infosec community and all of the nitpicking that they're going to have without losing the mainstream audience? But it's really important for everyone to understand what the stakes are and where this thing's going. And I always put up a picture of my mom. You know, I'm writing this for my mom who texts me once a week. How do I save that picture of your kid that you just texted me? I'm not writing it for the technical audience. It would keep me up at night and I'll panic about whether I'm getting every technical description correct, but I have to write for my mom because I'm... If I'm not writing for my mom, mission will not be accomplished here, which is get everyday people to care.
What I wasn't thinking was that policymakers actually needed this. They needed a translator badly and that boards really needed this. And so I've been doing a lot of board level education. And the number one thing that they say is we thought we were cutting edge because we would hear directly from our CISO once a year or twice a year, or we had this one person from Salesforce on our board. So we checked off the technical box there. But after reading your book, we realized we've been actually negligent in some regard here because we weren't asking the right questions. We didn't even know which questions to ask. We didn't understand that businesses are now us. We are now on the front lines of geopolitical conflict, which became very apparent with the NotPetya attack.
And so I think that has really been the biggest blessing is that if my goal was awareness, mass awareness, high level awareness, that has been happening. The the question now is, okay. Finally, they're saying, get it. You got us. You've got our attention. We brought you in here. We're aware. We have the appetite. But how do we get from awareness to operationalizing these solutions? Because it sounds to us like nothing works, and these things are getting through no matter what we do. And we're fed up with our CIOs, CISO coming in and asking us for more money every single quarter. And I think that is the biggest challenge. And then it gets even harder when you move from the fortune 500. What is that? Fortune 400?
Fortune five Down to the what we're calling target rich security poor entities like water treatment facilities and high stakes targets that it would be of extreme interest to an adversary or have a lot of urgency to a ransomware attack that don't even have one single IT guy on staff. So the good news is, like, we are all aware now. And if you're not aware of this threat, like, you really have an ostrich head in the sand problem and you have other problems. But we're all aware. The question is now now what do we do?
Yeah. And, actually, to circle back to what you said earlier about this notion, this quote attributed to Dmitri Alperovitch, like, you're either you're either... You've been hacked or you just don't know that you've been hacked. And to your question, is it true? I feel like it can be so challenging in this space to really suss out when something's an exaggeration and when it's actually cause for alarm. A quote from national cyber director Chris Inglis comes to mind. It's a little old, but back in 2019, he asked, quote, why are the Russians, as we speak, managing 200,000 implants in US critical infrastructure? Malware which has no purpose to be there for any legitimate intelligence reason. And as somebody who's reported on this Russia linked cyber espionage, I mean, 200,000. I just... I heard that quote, and I was like, wait a minute. What? They're just ready to flip a switch and cause all sorts of havoc in our critical infrastructure? Should we be running around like chickens with our heads cut off?
What is going on here? I guess I'd be curious to to hear what you think of of that and this concept of APTs, advanced persistent threats, almost lurking and waiting for some moment to act.
Yeah. I'll address that, but I'll go back a little bit before Russian implants to talk about there was a hack that really bothered me that I covered. And I think it was back in 2012. It was a Canadian company called Telvent and they provided software to, I think the vast majority of North American pipelines. And they were badly hacked by a Chinese APT. And the Dale Petersons and the S4 attendees of the world were saying this is not getting enough coverage. Because essentially, if you wanted a blueprint to the North American pipeline network, this is the company that you would hack. Now it doesn't have any brand recognition whatsoever. So Target was getting most of the airtime that following year. But to me, this was the far more serious threat. And so I covered that story and you have to be very careful not to scare everyone.
But I had some lines in my coverage that said, you know, we've been covering a lot of Chinese IP theft and trade secret theft. The question is, is this IP theft? You know, is is is the... It's China so interested in clean energy or digital... Digitizing critical infrastructure that this is the IP they want because this this is the keys to the kingdom if you wanted to pull off a pipeline attack at scale that would freeze The United States. And so there was some just wording around, is this just espionage, or should we be worried about something more sinister, more sabotage like? And I remember just getting a ton of crap on Twitter about this, that I was stoking FUD, fear, uncertainty, and doubt being a really alarmist. Well, fast forward to, I think last year, was that the 2021 that The US declassified its findings that China was in our pipelines and it wasn't...
They were not there for IP theft. So they were there for some kind of foothold, in the event of some geopolitical escalation or conflict that they would have a foothold to essentially hold our gas pipeline network hostage. And I think they were referring to, although they don't say it, the Telvent like attacks. Yeah. It's really hard as a journalist as these things are happening and they were happening so fast to point out, here's what's happened and no, nothing's happened yet. You don't need to scare everyone. But, hey, this target is the exact target you would pick if you wanted to pull off a colonial pipeline attack at scale. And and then Russia just started making that threat very obvious and never more so obvious than with the black energy Ukraine attacks.
When I would interview people in the administration, then the Obama administration, And I think I had this in the book. They would say, until then, we thought this is a gentleman's game. You're spying on us. We're spying on you. Occasionally, we dig into your critical infrastructure. We make maybe a little bit more of a loud show of it when we get into your power grid, that kind of thing. But no one's actually gonna use this access for sabotage. And then after Ukraine, it was sort of like, okay. We need to all sit back and change our risk calculus here.
I will say to the FUD point, I'm really glad you brought up the pipeline espionage and the risk there because that's an issue that was near and dear to my heart, reported on it very closely in my time at Politico and E News. And part of what was so alarming is unlike even a colonial incident, which impacted fuel supplies, gasoline, jet fuel, the like, you know, liquid substance. We have this network of natural gas pipelines throughout the country that feeds into power plants, often relies on just in time deliveries because it's coming in a gaseous form, so it's not as easy to store and use. So if that were disrupted, there's a huge risk there of actually causing a lot of problems cascading across critical infrastructures. And, yeah, I don't think you're exaggerating at all to be like, hey. You know, maybe we should pay attention to this. But you can't just brush it under the rug and hope that hackers are never gonna try that because we've just seen so many disruptions. I guess the natural follow-up to that though is why haven't we seen this trap sprung?
Yes. Okay. We saw the ransomware disruption of Colonial. That almost seemed bumbling, if not accidental, then certainly the attackers bit off more than they could chew. Why haven't we seen these advanced persistent threats really cause havoc on the scale of... NotPetya? I guess that was one example. But, again
Yeah. But we weren't a direct target. And why weren't we, I think, is also another way to phrase this question. I think we have settled into this era and it's precarious for sure, but of Mutually Assured Digital Destruction. Yes. China has access to our pipelines, but they also hold a huge amount of US currency. Why would they want to sabotage The United States and sabotage the economy essentially? It's that they'd be kicking themselves. They did. Russia, they... I worry about them more, especially right now because increasingly they have less to lose as we detach them from the global economy. And I did this story with David Sanger about how under Trump, the sort of rules around what cyber could... Cyber command could do in terms of who they could attack were loosened.
They no longer needed to get presidential approval for what's called CNA, computer network attacks. And so one of the first things we learned that they were doing, which we reported publicly was, attacking the Russian grid and they weren't being quiet about it. They were being loud about it and that this was an operation specifically aimed at messaging. If you dare do to us what you just did to Ukraine in 2015 and 2016, expect the same back. And, you know, that's where we are is... And you... We don't cover it as well, I think, here in The US, but China's response to a lot of these accusations that they've been hacking us has always been, we are also targets of cyber attacks. And I think there was a Chinese company and I'm sorry, I'm blanking on the name, but they just put out a great report on some of the attacks they're seeing.
And they are reporting that China's also likewise seeing a lot of of its critical infrastructure. So I think we have entered this new era of, yeah, we're all in each other's systems holding guns to each other's heads. And you'd have to think very carefully about whether you wanna pull the trigger because it would only be moments before you two would suffer the same attack. Now where I think it gets interesting is attribution. And I think that's really where The US and the West are at a strategic disadvantage here. Because if an attack comes from the West, usually comes from cyber command or one of the intelligence agencies, although there's a line there between espionage and attack. When it comes to our adversaries, it's not coming from inside the building. In Russia's case, they outsource a lot of their dirty work to cybercriminals.
In China, they've moved a lot of the responsibility for these operations from the PLA to not just the Ministry of State Security, but to the satellite network of private citizens who work or moonlight at the behest of the Ministry of State Security. We've indicted and I think sanctioned Iranian front companies that do a lot of this work. You know, the the lines are far more blurred when it comes to our adversaries. And then when you look at and you've covered these attacks really well, some of the attacks we really worry about coming from Russia, you can see that they're playing around with attribution. And I think it's because they don't wanna get caught red handed when one of these things happens because they know that we will respond in kind. And I think that's where a lot of the back channel negotiations conversations have been. I think they've been very direct between state officials.
Hey. Just so you know, this is how we would respond. That was Biden's first conversation with Putin in Geneva. Here's the list of our 16 critical infrastructure sectors. If there were to be another attack, like Colonial Pipeline, even from a cybercriminal group or directly from the GRU, expect the same.
I feel like so often in this space, it's it's it's doom and gloom. Right? Threats keep getting worse. Actors getting more sophisticated in their in their techniques. Let's talk about some cybersecurity victories. What do you think has really improved, for instance, since you started reporting on on... For your book?
So I think the most badass win has come in the last week, which is that the Department of Justice and FBI announced that they had gotten inside HIVE ransomware group and were quietly securing decryption keys for victims and passing them to victims so that they basically kept victims from having to pay something like a $130,000,000 in ransom. Awesome. You know, I've definitely been critical of some of these off... This focus on offense, but maybe offense is our way out of this ransomware hell we're in, where it's really about hacking these groups and quietly surreptitiously sabotaging them at every turn. So I think that's number one. Two, we've always had this question of what is the actual tie between the Kremlin and these Russian cyber criminal groups?
Russia's just making it very obvious at every turn just how tightly connected they are. I think HIVE, the state department put up a bounty site for some of its members. We'll pay you this bounty if you give us any information leading to the arrest of one of its members. And immediately, Russia blocked access to that website. You know? Why? Clearly, of their members are of strategic use to the Kremlin. And then I remember very early on in the Ukraine invasion, Conti came out and just said it. They just said, if there are any attacks on Russian infrastructure, we will respond in kind. It gets back to your previous question and my comments on attribution. Like, they can't use this cover of, oh, that's a cyber criminal group when they're clearly so closely tied in with them. So I just point that out because I think it would give us the ability to respond to some of these very serious ransomware groups in an escalated way versus a bumbling group of cyber criminals when it's clear that they have some closer nexus to the state.
I remember Conti Conti tried to roll that back so fast, and nobody was buying it. They're like, you said it. It's out there. Cat's out of the bag. We know where you stand now, Conti. Sorry.
Yes. Yes. Sorry. Sorry. Yeah. Right. And then, you know, then then there was the chapter where one of its Ukrainian members just, you know, doxxed their colleagues in Russia. So, yeah, very interesting. Another win that we actually touched on as well is just awareness. Know, that boards are really talking about this even in this economy. They're willing to continue to up budgets and do whatever it takes to stop the next NotPetya attack from from holding them hostage or or destroying their data. I think, you know, the... Where I now sit as an adviser to CISA, you know, CISA doesn't have regulatory authority. You know, it's it's it's definitely not the, you know, it's not the IRS, it's not the FDA, but I think they've done a really good job partnering with the private sector and bringing the private sector on voluntarily and providing the private sector with kind of quantifiable metrics about how they stack up.
Their latest goal here, and this is going to be a big focus for 2023, is what they're calling cybersecurity performance goals. Giving just board the language to ask their CISO and their CIO and their CTOs, do we have this? Are we using Synack? Are we getting penetration tests? Do we have multi factor authentication rolled on the back end? How are we vetting our suppliers and contractors? It's finally just giving them access to the right questions. And I think that really, you can't... That that cannot be understated how important that will be when it comes to kind of improving our attack surface.
I'm gonna stop you before you can jinx it or say any... No. Quote, Nicole, things aren't as bad as I thought there would be. There we go. We're we're we're we're set. Cybersecurity is solved. You heard it here first. No. Knock on wood. Yeah. Based on this conversation, I'm still gonna be looking over my shoulder a little bit going forward. And Nicole, thank you so much for coming on the podcast. I did have one final question for you before before we part ways here, which is what's something we wouldn't know about you by looking at your LinkedIn profile?
Yes. I mean, you don't jump out. I wanna make that clear. Some people do in these videos. I don't. We safely land. I get out and I go skiing. But, yeah, it's like... I feel like there are a lot of people in cyber security who have these passion or hobbies. Like George Kurtz at CrowdStrike does race car driving. You know, it's like people get their adrenaline rush in these totally other areas. And I always thought that someone should do a story about that.
Well, that's that's amazing to me both as somebody from Florida and somebody without that cool of a hobby. I do have an Instagram for my cat. I don't know if that counts for something.
Spearfish. Let's see. Why haven't I thought of this? Okay. Well, thank you for the idea. Please be safe when you're heli... Heli skiing. I mean, that does sound like fun to be fair.
Yes. And just to give you a sense of how safe it is, I went when I was seven months pregnant with my 80 year old dad. So, you know, you can make it as dangerous or safe as you want, but highly recommend it.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
