The Lasting Impact of Epistemological Warfare

This message comes from Total Wine and More. The biggest tournament in soccer is finally here. Total Wine and More offers a selection of wine, beer, and seelters for soccer tournament watch parties designed to provide options for a full day of matches and at the lowest prices. You can prepare for match dayay by visiting tootalwine dot com spirits are not sold in Virginia and North Carolina. Drink responsibly must be twenty one This is Planet Money from NPR On Friday, if all goes according to plan, representatives from the US and Iran will meet in Geneva to sign another sixty day ceasefire agreement But the two sides still have not come to an agreement on what's been at the heart of this war and decades of conflict Iran's development of nuclear weapons This conflict has been on again and off again for years And while the most recent iteration has been very violent with bombs and blockades There is a whole other almost entirely invisible war that the U.S and Allies have been waging with Iran. Using cyber espionage More accurately, cyber sabotage You know, computer viruses, malware Recently we heard a story about a piece of malware that might have been used in this invisible war that was Diabolically cunning becausecause it exploited weaknesses in computers, yes, but also maybe in the human psyche. The more I think about it, the more I think This must have driven people insane It also might have saved the world from nuclear destruction heard about this hack from someone whose job it is to identify computer hacks that could be a threat to all of us What's your name? do you do My name is Juan Andres Guerredoale, which is why everybody calls me jags. JA G S Jags. his initials are shorter and cooler. Yeah actually he is a pretty cool guy. He's got a fauhak sleeves of tattoos. He was on track to go get a PhD in philosophy, but now. I'm a security researcher, who I think would be the simplest term Some folks would say cyber paleontologist. Cyber paleontologist. Like he digs for the remnants of cyber attacks Jags works for a cybersecurity company called Sentinel One. It helps big companies like Samsung and the Golden State Wriors and the government protect their computers and networks. Hcking is a whole industry. And defending against hacks is this whole other industry Jags just so happens to have the raddest job of all. which is Dusting off old malware files buried deep on servers and reverse engineering how hackers got into systems in the first place And what they did when they got there so we can figure out how to defend against similar attacks in the future And Jags is kind of a big deal. There are actually a couple of pieces in the International Spy Museum in DC based on his cyber paleontology work This is a little crude, but in the Jurassic Park movie, which paleontologist or you As long as you don't immediately default to Jeff Goldblum and then I was gonna go Jeff Goldblum. I think that he is like a chaos theory mathematician, whichich I think fits the bill, right? What the hell do I actually know about paleontology? Right. We met up with Jags because we wanted to get a peek into the invisible warar because Jags has made a stunning discovery of of a Highly specialized, highly sophisticated cyber weapon Often these weapons Don't even get detected If they do, it's not usually until years later, when someone like Jags comes across an old fragment and tries to reconstruct top secret mission the weapon was designed to carry out For Jags, the fragment he found It wasn't even a piece of code. It was just six words came from a leaked list of malware from the NSA Yeahet, the list came from this tool, the NSA to help NSA operators while they were hacking into some computer in enemy territory Figure out whether some other hacker was already there If so, whether they were friends or foes, essentially, it'll run all these checks and it's going to give the operator it's going to give a list of instructions of saying, hey Auspicious thing here. We don't know what that is. Kn malware, pull back Little warning signs And this was a budding cyber paleontologist's dream Each piece of malware on that list had the potential to teach you so much about how the world's top hackers were getting the job done. And maybe One would turn out to be an incredibly sophisticated cyber weapon jags with great excitement. got a hold of this list and started scouring it for something he should start digging into and One item screamed. Look here There's one, just one line. That's like completely different to all the other ones. Okay. And it's it just says fast sixteen. Nothing to see here, carry on In all caps. That's it There's nothing else like it Fast sixteen was what the NSA was calling the malw And the cryptic instruction the agency was giving its operators seek help or pull back simply Nothing to see here cararry on. can't put that there like it's it was like catnip, right? It felt like couldn't let it go. I couldn't let it go. He didn't let it go He had to know what this thing was What did it do? What was its target NSA seemed to know about it, but who made it And what was so topop top secret that the NSA was resorting to Jedi mind tricks to try to keep its own people in the dark At this point, Jraags just had the name of this malware. Fast, sixteen atibia But he was able to use that to dig up the rest of the bones. Basically, he rummaged around this like public library of suspected malware until he found it. And eventually, he was able to put together the pieces of the skeleton that is Fast sixteen. But still, when he tried to reverse engineer it to understand what its secret mission was, he couldn't I worked these like cracked out nights and Very often, I'll run into something. I'm like, oh my Godd, Ive found this amazing thing. And then by the morning you're like, No, this doesn't work. We call this the Valley of Despair. Oh yes, I have built a home in the Valley of Dpair. I'm in the process of gentrifying the Valley of Dpair. If any of you would like to join me there, After many, many fruitless nights, weeks Bths Jags had to turn to other projects Fast sixteen down But to remind him of what was not solved Inked fast sixteen on his skin. Forever Fast sixteen has been on the back of my arm for. You got it tattooed? Oh, yeah. Where' Fast sixteen? It's you can see Fast sixteen and nothing to see here. Nothing to see here. carry on Hello welcome to Play of Money, I' M Fountain. and I'm Erica Barris. Today on the show, notothing to see here. Carry on Jag sets out to solve the mystery of Fast sixteen and finds a cyber weapon with the potential to chip away at our very grasp of reality This message comes from Schwab. With the new Schwab teen Investor account, teens can gain hands on investing experience. It's co owned by you and your teen, so you can monitor the account while your teen learns how to invest and manage money. Learn more at Swab. com This message comes from LinkedIn ads. Ever invest in something that seemed incredible at first, but didn't live up to the hype? For marketers, that's impressions. When ads don't create revenue, that's a tough conversation with the CFO. Instead, invest in results your CFO will love. LinkedIn adds generates the highest Raz of all major ad networks So advertise on LinkedIn. spepend two hundred and fifty dollars and get a two hundred and fifty dollars credit. Just go to linkedIn d. com slash NPR pod. Terms and conditions apply This message comes from Dell teechnologies. Interruptions happen at work, but with the Dell Pro laptop powered by Intel Core Ultra with VPro, built with optimized battery and built in intelligence, your tech won't slow you down Dell. com slash deell dash pro for you. So What was this mysterious piece of malware that was so secret that the NSA was using Jedi mind tricks to try to keep their people away from me And so enticing that security researchers att least one overcaffinated keyboard wielding security researcher tattooed on his triceps. theoretical tricep, yes Stags, said researcher, was pretty blocked He knew he had to keep at it, because he had a hunch that FAast sixteen might reveal important details about that invisible side of the conflicts we read about every day. L back when security researchers discovered a cyber sabotage operation that blew everyone's mind It was called 'snet Yeah, Stuxat is kind of the mother of all cyber sabotage operations In many ways, my industry is birth by the discovery of Stuckon For those not familiar, Stuucks Net was this absolutely ers' hacking operation that reportedly slowed down Iran's nuclear program back in the mid two thousands. And to hear Jags describe it, it totally redefineed what was possible So before Stucksnet If you went to these antivirus conferences with a lot of fun gals and guys possibility of cyber espionage was discussed as that as a possibility. It was theoretical. It was theoretical They might be cool. this might be happening. Yeah, you're like there's no way people won't. There's value there, of course as and then you know, Stuxnet is discovered and you realize Not only has this been happening and at a scale and capacity way above anything we'd ever found before But it's been happening for years What had been happening was that Israel and the US, allegedly, had used cyber weapons to destroy real world physical things. They did this by managing to get a thumb drive into Iran and inserting malware into the computer network at the heart of their uranium enrichment program, the system that controlled the centrifuges And Stucknet was Very, very clever It spread throughout the network and carefully noted how everything looked when it was working normally Save that And then gave the centrifugge's instructions to go haywire, speeding up and slowing down and breaking all while making everything in the computer system look a okay, look normal So the operators are hearing Things are like making these weird noises, they're spinning up. they sound like it sounds like things aren't going well in this room next door, but I'm looking at the computer and the computer tells me everything's normal All in all x Net reportedly destroyed a fifth of all the centrifuges that Iran was using. It led to nuclear scientists getting fired Most importantly, it is widely believed to have slowed down Iran's nuclear program to the cyber paleontologists of the world like Jags When the bones of Stucknet were dug up They revealed this He New age of cyber warfare Jags always believed that Stuuckxnet was just a of what was out Clearly, we didn't even know about all the different things they were doing. So Year after year, Jags remain committed to figuring out his white whale, figuring out the puzzle of Fast sixteen. Who made it Who were they targeting? What exactly were they doing to that target? He didn't make much progress until earlier this year for a very this year reason AI Here's why Jags heads a big team of researchers at his cybersecurity firm. And like everyone else these days, he was wondering Could these new AI tools help us in our jobs? Could they do our jobs Could they do a job that was so hard even I, Jags, couldn't do it. Could they solve the puzzle that is fast sixteen There is no public guide to solving it If it's going to figure it out, it's going to have to figure it out just in this little sandbox with a few tools and go all right, kid, like what can you do? Jags sent a colleague to oversee these AI tests. That colleague was Vitali Kamluke, a Belarusian cybersecurity researcher who also has a fauhawk. He lives in Singapore and according to Jags, is very Zenlike. Jack says Vitali, like any self respecting human, he decided to John Henry Styyle tried to beat the machines I. being put in that position would have said, cool, let's go make the AI sweat And Vitali being a much more patient Zen master style He said, Well, if I'm going to know if it's doing well, I need to know what this thing does And Vitali spent like, two weeks in a cold somewhere, not answering messages, notothing. I was like, is this guy okay? L what happened to Vitali? And all of a sudden, I get a message from Vitali super late I guess for him. Yeah, yeah, it was like about one AM or so. He's like, Hey, man, like I need to talk. Jackaxs, Yeah, we need to talk. This of course is Vitali Kamluke, reverse engineering Legend He describes you as Zen like Do you think that's fair? Is that like? Yeah Does this make me more peaceful and simple? I hope so, But on this call, he was not very zenless Vitali said he'd done the reverse engineering. And he'd had the AI models double and triple check his work And now Jack says He seemed retty disturbed. He's like I need you to test me here, but like All the models at least agree with me, so I now need to talk to a human being This is Stuck's Net L and I hear that kind of nonsense from students, right? Like, you know, I hear this kind of I'm like a lightning rod. Anybody in this industry is a lightning rod for like DMs from people clearly having like schizophrenic episodes about like the government spying on me. So you hear this kind of stuff all the time. When you hear it from Vitali, who's a very measured person Um makes you take pause. you go okay, what are you talking about? What do you mean Natali explained they're from the same era, the mid two thousands ough they don't share any code, they seem to share similar architecture. Vatali couldn't figure out what exactly FAast sixteen's mission was, only that it targeted the part of a computer that did complex math. think of it as like floating point math. like the really, really u details based hard calculation stuff that most of the time you never deal with And I've never run into a piece of malware that does that Jack says, he's never seen malware that messed with high precision math Most spy malware is designed to steal data, or like in Stuckxnet, make things go haywire This one was basically telling the computer two plus two equals At this point, Jags had found Fast sixteen buried in a cyber library. based on a hunch that it was something to pay attention to Vitali had confirmed it was. Be Who messes with math? mayaybe more importantly Whose math were they messing Who is running? precision calculations backack in two thousand five, doing something so interesting. that it got somebody to Build a super specific custom piece of malware to modify and mess with their workloads. Everything about this thing It screams special. likeike it screams unique, it screams groundbreaking. And I think what's most excruciating about it is that The mystery won't yield. L youre just kind of have to keep pushing and say, okay Why After the break? Okay, I guess we're back to the trenches of like, okay, how do we nail this de? Jags puts all the pieces together Support for NPR comes from IBM On Smart Talks with IBM, Malcolm Gladwell explores how organizations are using technology to solve complex challenges spoke with Sergi Goosch, Heineken's chief AI officer. If you can connect all the different applications, all the platforms, remove fragmentation, scale very quick, that's what we call the best connected growwer. That's where IBM is really partnering with us Listen to Smart Talks with IBM wherever you get your podcasts This message comes from Schwab. With the new Schwab teen Investor account, teens can gain hands on investing experience. It's co owned by you and your teen, so you can monitor the account while your teen learns how to invest and manage money. Learn more at Swab. com This message comes from Better Help Summer can feel like a sprint, kids home, trips to plan, routines flipped upside down. It's easy to slip into survival mode, just trying to get through it. Then suddenly, it's over and you're wishing you enjoyed the days just a little bit more therapy can help you slow down and actually be present for the moments that matter. With better help, you can connect with a licensed therapist from anywhere on your schedule Don't just survive the summer To Thrive, visit betterhelp d. com slash and PR So Jags and Vitali, still separated by a twelve hour time difference, set out to answer their next question Whose math was Fast sixteen designed to target prettyretty quickly they come upon a major clue. By looking at a rules engine embedded in Fast sixteen's code A list of instructions, basically if then rules fast sixteen see something happen on a computer, then it goes, Ohh, I've recognized this thing. What does my rule engine say? Oh, if I find this string, then I need to change these six bytes into these six other bytes. If I find this thing, then I need to set this thing back into whatever the old value was. If I find this thing the hell do those six bytes represent So they start scanning old systems and software from way back in the day looking for those strings of bites Jack says it was like looking through a mathematician's notebook of scribbles for a particular string of numbers, which is not easy. And it's not like old code just exists out in the wild But eventually, they do find a few pieces of software that contain some of those same strings of six bytes Which all had to do with complex Physics models How to design a car that'll crumple safely when it crashes or a bridge that will withstand an earthquake for Vitali The idea that someone was targeting calculations that were supposed to keep us safe was incredibly disturbing Do they have limits really? L it' just a new type of evil ideas I felt that the target was scientists, civil engineers, corrupt their calculation results and that would eventually produce risks for lives of others So I was terrified like, why would people do that? Very soon They had a breakthrough that kind of Answered the question Jags was seearch around for one of those pieces of software. It's called LS Dina It's short for Livermore software, dynamic analysis. Something that I run into right away as I'm looking up LSDina is this report by G IS.'s That's what they call themselves. I don't know what ISIS stand for It's some kind of think tank. The Good ISIS. Institute for something something or other. The good ISIS has this report saying if you look back at this research that Iranian scientists have been publicly putting out, you can see that they were using software that they shouldn't have been using They knew that these guys had this piece of software LSDina. Yeah. and what's interesting is the example they put for LS Dina is trying to figure out The right explosive materials for nuclear payloads In other words, this documentation from the Institute of Science and International Security seemed to suggest that the software Fast sixteen was supposed to mess with was being used by Iranian nuclear scientists to maybe design nuclear bombs So that was the software that the Fast sixteen malware was likely targeting. telling it If you find these bites, change them to these other ones Why change those specific bytes What would changing the math in the software achieve? to solve that part of the puzzle, they had to get their hands on that software the Iranian scientists were using A very bespoke piece of physics modeling software released decades ago. Very much not on the app store Does you pay for it You can't buy it. You can't just buy it. And moreover People don't love it when you're like, Hey, yeah Do you happen to have a copy of your software twenty one years ago Why Don't worry about it. Don't worry about it. Just You know, so you got to get your hands on this thing somehow And Jackson Fitali did They found was that Fast sixteen was designed to Biden sed his computers and Do nothing Bically to keep watch, to wait for LS Dina to get installed At that point, It would stay low key Until It saw the computer doing these very specific test that only someone developing a nuclear warhead would be doing had to do with the pressure calculations to simulate a nuclear explosion And that is when Fast sixteen would Do its mayhem At the point when the engineers got near the pressure they needed Fast sixteen would Rrow those calculations off changing the math two plus two equals five chs And furthermore, it was designed to spread from computer to computer The idea being that If you if I come to this computer and I run this simulation workload and go, hey, those results don't look right. Let's go try this other computer and you go and you run it in the other one, that too will give you the right wrong answer. The exact same wrong answer. Exactly So the idea was to drive these people nuts, right? Like you go. And like it's right math wrong answer, right formula wrong answer over and over everywhere you go. And you probably don't know that it's wrong until you then go and try to do another thing with it and you go, damnit, this thing is not working. Yeah, right? Like it's devious the cunning of this attack is truly fascinating because at some point I think before you ever consider that the computers are wrong Yeah, you almost certainly look at these scientists go maybe you Guys are clowns, Maybe you guys don't know what the hell you're doing Jags and Vitali were flabbergasted by the sophistication and the technical prowess of this malware from decades ago. Not just the cody parts, but also the deep knowledge of nuclear physics. And So many late nights of being haunted by Fast sixteen Jags and Vitali were finally able to announce in April of this year Fast sixteen, which they'd started looking into on a hunch was indeed a major cyber weapon Whse mission seemed like it was to sabotage Iran's nuclear development program Was it worth the wait Absolutely. I mean, walking around with this like bag of open questions, right Yeah, there are still some unknowns. Number one We don't know definitively that this was targeting Iran For example North Korea also had nuclear ambitions at that time. Back you go, well, North Korea was having a whole lot of problems with their missile program back then We don't know where all of these things were being used. We just know of one target that they definitely used this kind of stuff against, which is Iran You're that confident Uh look let's let's put it a different way, right? We've never ever, ever, ever, ever, ever, ever heard of anybody doing this kind of cyber sabotage anywhere for anything other than the Iranian nuclear program in the same era as when Fas sixteen is developed Th number two, we don't know Who did this It has echoes of Stuxnet, which is widely reported to have been deployed by the U.S and Israel When we reached out to the NSA and the CIA and the Israeli defense Forces and asked them This fast sixteen U They didn't deny it. They didn't confirm it either. Yeah, that's true too. The IDF never got back to us and the other said, basically, sorry, but we have nothing to offer you on this. Sags for his part Al checked in with them Before you publish Do you reach out to the U. S and Israeli intelligence community and ask them Are we going to blow your? cover Yeah, um I won't go too far into that, right? Like most of the time, We are good collaborators and good friends Do these meetings happen in person? Was there any pushback this time? No Meaning we're not worried about you blowing our cover, you weird paleontologist. This stuff is twentywenty years old And the third thing we don't know is why the NSA wrote in reference to Fast sixteen, The instructions notothing to see here Carry on Is that like? One day when this stuff is declassified might get an answer to all three of those questions But we're much less likely to figure out Fast sixteen change history Jack says he's sure was deployed because he couldn't have found it otherwise But like sllowdown Iran or Someone's nuclear program did it Bring them to the bargaining table prevent nuclear war and the lastast enduring mystery How did Fast sixteen mess with the minds of the scientists who encountered it Like I have this picture in my head of the nuclear scientists in Iran working on this project of intense national significance. Presumably their boss's boss was constantly giving updates to Iran's president, the Ayatollah. And these scientists would have been doing their experiments right And then infuriatingly gettingetting the wrong answer Epistemological warfare, what you would call this If I had called it that, they would have said I was just being pretentious I wouldn't have allowed myself that as a repentant philosopher. Yeah, but as a repentant philosopher. Yeah, sure. I think epistemological warfare is a a fascinating way to frame it Break that out a little for me. Well, I think the granted how much we take for granted. certainty People think that certainty is a matter of coherent deduction, that somehow you're sitting here and you have this perfect cohesive worldview That's not actually how it works. That's not how anything works. If you questioned everything in your life, you would be paralyzed, right? If you questioned that when you, you know, get out of bed, you don't know if like the floor is gonna to hold you, right? You wouldn't be able to function Jags told us about an interaction he recently had with Vitali. that kind of Bring this home