This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

Zero-day brokers are notoriously secretive because their livelihoods depend upon their reputation for discretion. In 2015, Perlroth interviewed a man with the pseudonym Jimmy Sabien, who had been one of the first brokers of zero-days in the 1990s and early 2000s. Espionage tactics changed after the end of the Cold War because all nations began using the same kinds of technology and software; this shift meant that the tools developed by one nation could potentially be appropriated to target allies, enemies, and the originating nation itself. Nowadays, practically every country has a stockpile of zero-day exploits—even if they have no plans or means of implementing them.

Prior to his career as a broker, Sabien had previously served in the US military and worked in the private sector, developing cyberweapons. However, he realized that cyberweapons were only useful if one could access the targeted system, hence the need for zero-day exploits. Because of the inevitability of human error, eventually even the most secure systems could be infiltrated. Government agencies were willing to pay significant sums for the means to secretly access computer systems in embassies, foreign governments, and other such arenas. Sabien began by developing his own exploits, then tweaking ones that he found on BugTraq. He then moved on to contacting active hackers and buying newly discovered exploits directly from them.

Many such hackers came from Eastern Europe or Israel, and deals were always conducted in utmost secrecy: a practice that caused significant inefficiency because all exploits had to be verified before payment was made, and hackers were always paid in cash. In the early 2000s, Sabien could sell a single exploit several times over to different US government agencies because they all had similar goals and massive defense budgets, and they did not communicate effectively. These agencies were particularly interested in developed tools that chained zero-day exploits and programs together so that they could easily enter systems, harvest data, and affect processes without leaving traces.

Charlie Miller is a hacker who is renowned for his skill in finding critical zero-days in well-secured commercial software. He worked for the NSA between 2001 and 2006, then continued to engage in hacking due to his own intellectual curiosity, earning considerably credibility in hacking circles.

The inefficiency and lack of transparency in the zero-day market often meant that hackers were mistreated and that both buyers and sellers were frequently left frustrated. Charlie researched the wildly inconsistent pricing in the zero-day market and sold a zero-day of his own in the Linux program Samba for a price of $50,000. (In the wrong hands, this zero-day could have crippled NASA and other major government agencies.) He then wrote an academic paper on the zero-day market. The NSA first attempted to bully him into keeping silent, and it only grudgingly authorized him to publish under the conditions of his prior NDAs. Charlie presented the paper in a lecture at Carnegie Mellon in 2009, outraging government intelligence agencies with his candor and confirming the worst fears of major tech companies who had long suspected that the government was undermining their security.

Charlie continued winning prestigious prizes at hacking conferences and discovering critical zero-days in Apple and Android products, which he would then help developers to patch for free instead of selling them. However, he was outraged to learn that despite his altruism, his contacts at Google tried unsuccessfully to get him fired from his job. Charlie and some of his hacker friends lamented that the most moral reaction to discovering a zero-day—reporting it to the developer and working to fix it—was often the one that had the worst outcome for the hacker. At a Vancouver hacking conference, Charlie and his friends decided that they would never again provide ungrateful corporations with zero-day exploits for free; they started a movement called No More Free Bugs, which trended under the hashtag “#NMFB.”