02:18
Sam : “This new era was made possible”
Me : “by skillshare, an online learnin…”
Sam : “by one single concept.”
Me : Oh

I read your comment before I watched the video. I still fell for it when it came round.

Omg I thought that too and went down to say it and saw it was the top comment

I knew it I couldn't be the only one 😂<br>I paused the video to find this comment. I actually thought he was gonna say Curiosity Stream

I knew it I couldn't be the only one 😂
I paused the video to find this comment. I actually thought he was gonna say Curiosity Stream

Hahaha went here to comment the exact same thing

2 weeks late on viewing this, I instantly knew this was gonna be top comment

Made possible has become a trigger phrase preparing me to skip

That single concept might still be skillshare tho

Bruh i literally thought of the same thing 😂😂😂

Bruh i literally thought of the same thing 😂😂😂

This is one reason I hate "smooth" ad segues. They trick users into thinking they're content, and thus train us to be averse to certain sentence structures.

...One single concept that they learned on Skillshare?

omfg. what timestamp the video actually begins ?

omfg. what timestamp the video actually begins ?

Repent to Jesus Christ
“Consider it pure joy, my brothers and sisters, whenever you face trials of many kinds, because you know that the testing of your faith produces perseverance.”
James 1:2-3 NIV
I

Seek Him with all your heart and you will find Him

i was about to write the exact same comment lmao

i was about to write the exact same comment lmao

Ha it got me too, but i was thinking of Curiosity Stream

This was the exact comment I was coming down here to leave 😂

Yuuuuuup you beat me to it lol was gonna put the time stamp as well 🤣🤣 it’s that engraved in our heads now…damn you skillshare

@Røde Get Sponsorblock, its an addon for firefox

@Røde Get Sponsorblock, its an addon for firefox

@NNx Sponsorblock for Firefox, get it :)

@NNx Sponsorblock for Firefox, get it :)

I anticipated NordVPN from the subject of this video, but nonetheless 😂

Lol stopped the video to see if this comment was here.

And it works too, the amount of times I'm like taking about something and I find myself like oh you shoild try <b>insert company that advertises on LTT, Wendover, MKBHD etc</b> even though I've never used their platform I know the name and exactly what they do

And it works too, the amount of times I'm like taking about something and I find myself like oh you shoild try *insert company that advertises on LTT, Wendover, MKBHD etc* even though I've never used their platform I know the name and exactly what they do

Yeah me too, and that is EXACTLY why these companies advertise on YouTube

Clearly, skillshare is getting value for money.

Clearly, skillshare is getting value for money.

My exact thought, but maybe skillshare's goateed evil twin

Oh lmao i thought that i was the only one

Oh lmao i thought that i was the only one

Sam: "by one signle concept,"
Me: "the concept of online learning"
Sam: "and perhaps more importantly made profitable by"
Me: "Skillshare, the online learn...."

I was also waiting for it XD

I was like just tell use who sponsored this video

I skipped  ahead and was like: "Wait did I miss something?"

Damn these YT ads have us in their grips lmao

lol I thought he was going to say SurfShark. That would be very fitting!

same, even to the point of specifically expectig skillshare for some reason (rather than another sponsor)

Lol my mind went straight to skillshare. Spooky.

Lol my mind went straight to skillshare. Spooky.

Bruhhh instantly my finger went into position to tap twice and skip 20s when I heard that part lmaoo

😊 Yapp! I was thinking Squarespace, but that one was good too!

I was waiting for a shout out to Brilliant

I was waiting for a shout out to Brilliant

Had the same joke planed… 🤣🤣 i laught at the possible outcome before he sad the real line

Well I guess everyone can read my mind lol

Well I guess everyone can read my mind lol

My head shot up to look at the screen when he said that first line. I was like "nooo... he doesn't even go this far on Half as Interesting"

We’re just so used to these smooth ad segways lmao

Came to see if anyone beat me to it. Of course they have. Lol

I was about to comment the exact same thing

I was about to comment the exact same thing

I actualy automaticly skipped that part. If it was not for you I would never have known XD


But the real question is: How would this affect airline logistics?

simple. better not mess with person whom coded it or the plane won’t land.

@Sven Kortjohn Thank you and love your attitude. I was asking "how" or "what specifically" can I pray for you for, not if I can. : )

@Vysair it would lead to the pilot turning the autopilot off LOL

@Zebina Mastero why you asking people if you can pray for them. Just do it. Jesus isn't going to come down and ask you if you had their permission. If you've ever eaten at Chick-fil-A you agreed to a TOS where you can pray for people without their permission.

@Jessi the Queen. Hoooo told you that? Long past are the days where a single bug can do something of that magnitude.  Software manufacturers and bug manufacturers have been in an arms race since the days you could whistle into a telephone and potentially cause havoc.<br>A single bug with one exploit definitely could not bring down an industry with multifaceted network security and capabilities but a bug that would cost over $10 million dollars and contain multiple zero days could make it all the way to hardware fail safes.  It would be devastating only to the unprepared and annoying to the majority of airlines.

@Jessi the Queen. Hoooo told you that? Long past are the days where a single bug can do something of that magnitude.  Software manufacturers and bug manufacturers have been in an arms race since the days you could whistle into a telephone and potentially cause havoc.
A single bug with one exploit definitely could not bring down an industry with multifaceted network security and capabilities but a bug that would cost over $10 million dollars and contain multiple zero days could make it all the way to hardware fail safes.  It would be devastating only to the unprepared and annoying to the majority of airlines.

@18:45 Sam addressed how it effect the airline logistics, A big one is coming!

They will be immune because of airplane  mode.

They will be immune because of airplane  mode.

No the real question is how this would affect F1 logistics

@JJ I you're new around here, aren't you?

@JJ I you're new around here, aren't you?

@AG you got it!! Prayers of beloved protection like linen white cloth wrapped around your family and you where ever you go. You will not be harmed. 🙏

i'd reckon not much. even commercial airplanes, for the most part, are analog. the biggest point of failure at that point is user error, say compromised flight instruments.

@Zebina Mastero for good health my family and I and future success

@AG Yes, of course I can. Is there anything specifically that you were looking to be prayed for?

A cyber 9/11. The good days for cyber security professionals are finally coming.

@Derkinator You don't need credentials to understand that an industry entirely built on electronics can be hacked and completely impacted.

Hack a plane and make them use Google maps to navigate.

aren't plane is autopilot? imagine what it could lead to

@Jessi the Queen. idk about that one and I feel you you lack credentials considering you just said the words cyber bug

@LeJosh Mont Air Force pilots are trained to navigate without GPS, so I’m not entirely sure that would happen, especially when commercial pilots are principally, if not mostly, military veterans.

Probably all commercial flights grounded.

Probably all commercial flights grounded.

@m s But there are techniques, such as those involving data analytics, that can be used to filter out suspicious traffic, even within the same IP range.

@Zebina Mastero can I boldly ask you to pray for me too

@Zebina Mastero can I boldly ask you to pray for me too

considering most airlines' systems run on big iron mainframes with poorly maintained software written decades ago, I'd say it would have a massive impact

You know someone is writing a script on that rn

You know someone is writing a script on that rn

Repent to Jesus Christ
“Consider it pure joy, my brothers and sisters, whenever you face trials of many kinds, because you know that the testing of your faith produces perseverance.”
James 1:2-3 NIV
K

General rule of thumb, everything is subject to attack, and almost everything is relatively vulnerable. We’re a few lines of code away from absolute disaster, and that’s not an understatement at all.

@Jessi the Queen. 7u7u777777uu7u77uuu7uuuuuu7u7u7uuuuu77u77u7u7u77u77uu77uuu

A modern airplane is just a self-driving router... the wrong software on the wrong machine means you could get a worm that travels the airplane network used to transfer plane-to-plane, and then have them all nose-dive at the same time.  I would love to think that this could not happen... but modern airliners already seem to do this on their own just by poor physical design.  Who knows what they are running on the networking and processing side of the equation.

This comment is only for wendover productions fans! 🤣

This comment is only for wendover productions fans! 🤣

Your comment was highlighted to me. I felt that I was suppose to ask if I could boldly pray for you for something through our Lord Jesus Christ? 🙏 Also felt the Lord Jesus Christ knocking personally on your heart today to let Him enter in as Lord and Savior. He favors you.

Airlines are crucial for the modern world to run so yes this is the real question

I'd be more worried about shipping ports. Disable shipping ports and you disable a nation. We've seen how fragile they are as is the last couple years.

Imagine a virus taking some radars offline. it could be catastrophic. Remember the pipeline shutdown? now imagine it was a power grid, or some banks. Even some hospitals had this issue.

It can turn airports into parking lots for planes.

It can turn airports into parking lots for planes.

there's a nice DefCon (a hacker conference) video on TCAS spoofing (air traffic control), it can already be done, by amateurs.

If the target is Air Traffic Control, you could stop airlines from getting filing flight plans and no flight plan, no clearance.

You could shut down instrument landing systems on a day with bad weather, the airport's operational minima will be increased and if the day is foggy enough, you've shut down the airport

I'm sure airline and airplane software vulnerabilities are highly sought after actually. Imagine having an airplane botnet.

cd 66 A single cyber bug can completely shutdown an entire country's airline industry in a matter of seconds.


"This new era was made possible" my brain finished the sentence "with skillshare" you've ruined me

I hate that advertising works this well on some people.

Never gonna do skillshare. I dont blame creators for taking their money at all. I blame them for ruining it like that.

Repent to Jesus Christ
“Consider it pure joy, my brothers and sisters, whenever you face trials of many kinds, because you know that the testing of your faith produces perseverance.”
James 1:2-3 NIV
L

Yes - same - my brain autocompleted it with "made possible by Skillshare" :D

Haha same here. Was just about to comment about it.

It happened and then i instantly seen this comment. You manipulated me

Nah, what ruined us is that Half as Interesting guy

Oh my god I thought the exact same thing


Stuxnet was a beautifully designed and engineered virus.   The story behind it is fascinating and I encourage everyone to read up about it.  Not to discount Sam's video.  He does a great job.

@Michael Flores Countdown to Zero Day is about Stuxnet, it's a great read and the audiobook is a good listen too.

There are several good documentaries on it.  The architects of Stuxnet thought of everything.  Incredibly tight, efficient code.

And they would have got away with it too if it wasnt for those pesky kids

We'll never know who put it there. Could've been less-than-friendly nations. Also classic Putin style to make people think 'The West' did something to his own allies. Such precise intel of how the facility works, could've well been from Western Epsionage, or acquired with entirely open, friendly-seeming tours by Putin's Hybrid Regime. Strange time to be alive.

Wonderful levels of technology compared to even 75 years ago. A massive increase in living standards worldwide overall. Much less war and violent crime on average. Many of us talking society matters using the magic of the Internet on a regular basis, like the Landed Gentry of previous times.

Yet occasionally truly terrifying with the entire world pinned between Nuclear West and Nuclear Putin + Nuclear Jinping. At least it's not boring I suppose!

@Mr. B. I sincerely hope you are ironic in your ideas

I’d love a deep dive read or video on Stuxnet

@Cadde Except he does explain the story behind it... not how to use it. That was the entire point of the video. If he were to explain exactly how to use it, it would be a series of videos, clearly.

So I agree with you... but the original comment states the "story behind" the virus, not the inner workings of it... hence my comment. Have a nice day :)

@Cadde Except he does explain the *story* behind it... not *how* to use it. That was the entire point of the video. If he were to explain exactly how to use it, it would be a series of videos, clearly.

So I agree with you... but the original comment states the "story behind" the virus, not the inner workings of it... hence my comment. Have a nice day :)

@Aurorae C i don't want all the credit for that 🙃

@Mr. B. Why yes, after reading those subjects I have lost so many neurons I would very much like to sue you

Probably very rare that you can refer to a weapon used in international warfare as beautiful.

@Manny yeah Zero Days is great, I highly recommend it as well!

There's a great documentary called Zero Days which talks about Stuxnet.

@Irun S  Tell this Vladolf.
He will not stop his wars and killings by people chanting "peace".
This is a harsh reality which I also had to learn to accept.

Just like how stealth bombers are beautifully designed and engineered I guess. It's weird to be so positive about a tool of destruction.

And it updated itself when it met a new variant.<br>Just 1 MB!

And it updated itself when it met a new variant.
Just 1 MB!

i also suggest to read about how COVID has been engineered, spreaded, who created it and why  :D nice readings

There’s a full length feature documentary on YouTube about it.

The real story is that there is probably another Stuxnet put there that hasnt been detected yet...

Even more interesting is the history behind the notorious Mirai botnet. Such a powerful tool just so a couple guys could run a protection racket off Minecraft server hosting.

Lucky for you - he explains it in the video.

Yeah, the payload, distribution of it and effects should be Infosec and Malware 101 -- it's sublime.

GAGAGAGAGAGA!!! I want to cut my toenails... NEVER! I am the feet YouTuber. Thanks for being a fan, dear chr9s


3:29 For anyone interested: this is only partially true. A zero day IS a bug, but not every bug is a 0-day. A 0-day is a bug that the vendor of the product in question has known about since 0 days (so: they don’t know about it while it is already being exploited/found by someone else)

I believe you are wrong when you are saying that the vendor of the product in question has known about this since 0 days that not only doesn't sound right it would make more sense that they've known about this since day one. You couldn't know about something since 0 day. what is actually means is the vendor does not know that there's some lines of code that can be exploited in their software and when they find out about it eventually they have had 0 days to work on it to solve the problem. Lex fridman did a podcast with woman investigative journalist who has focussed her career on hackers and these types of issues. I don't expect you to take my word for it but if you search for Lex fridman zero-day exploit I'm sure this podcast will come up and there's Lex clips where it will be an explanation of what zero-day exploits actually are where the term comes from and everything else you would want to know about it. I don't mean to be rude by pointing out you are incorrect in your explanation of 0 days exploit just want everybody to know what it actually is. I personally would not have known had I not watch that podcast by Lex fridman<br>Nicole Perlroth is the name of the woman lex fridman interviews about cyber security and everything involved in hacking and th see who what why when where and how

I believe you are wrong when you are saying that the vendor of the product in question has known about this since 0 days that not only doesn't sound right it would make more sense that they've known about this since day one. You couldn't know about something since 0 day. what is actually means is the vendor does not know that there's some lines of code that can be exploited in their software and when they find out about it eventually they have had 0 days to work on it to solve the problem. Lex fridman did a podcast with woman investigative journalist who has focussed her career on hackers and these types of issues. I don't expect you to take my word for it but if you search for Lex fridman zero-day exploit I'm sure this podcast will come up and there's Lex clips where it will be an explanation of what zero-day exploits actually are where the term comes from and everything else you would want to know about it. I don't mean to be rude by pointing out you are incorrect in your explanation of 0 days exploit just want everybody to know what it actually is. I personally would not have known had I not watch that podcast by Lex fridman
Nicole Perlroth is the name of the woman lex fridman interviews about cyber security and everything involved in hacking and th see who what why when where and how

@ShinerCCC Not really, as then apple would know about the back door in their products, so it can’t be a 0-day. But you already said the term of what you just described: a back door

I thought a zeroday was a backdoor, like Apple has on iPhones so the US government can break in

Yeah. If the attacker is exploiting a known flaw or known bug, or is utilizing known software, basically if any part of the attack is done using a known factor, it's probably not a Zero-Day Event.

A lot of the confusion comes from the warez/hack/crack scene applying the warez scene terminology "zero day warez" to the hacker community (my previous comment).  That was fine when there was probably 50% to 30% overlap in the two communities (but falling), but as it fell further, it mostly just served to be confusing, counter-intuitive terminology.

@Daniel Kaschel No, that is a 0d exploit. There are tons of 0d's that exist all over the world, where the bug in question provides no path to exploitation.

@en0n - A zero day doesn't have to be in use to qualify as a zero day. It only has to be a vulnerability, known about by some party, that the vendor has not yet been made aware of. The real danger in a zero day vulnerability, is that an IT department cannot protect your company just by keeping everything up to date. Anything connected to the internet, or to an internal company network, could be critically vulnerable. Even thumb drives could infect an airgapped computer network, disconnected from the internet.

@Daniel Kaschel - Zero days imply code execution.

Thank you. Hearing the video's definition was a bit of a forehead slapper. A zero-day is an exploit that was discovered being actively exploited in the wild, without the hardware/software manufacturer being aware of it, so there is no fix available at that time. The alternative would be if the manufacturer was made aware before the exploit was found being used in the wild, and likely already has a patch available.

And the name comes from the warez scene (since there was significant overlap in the early to mid 80s), when "0-day warez" meant a game which was cracked on the day it was released.  You'd get "-1 day" sometimes due to time zone issues, but 0-day was the gold standard.

This is a much better explanation than the top comment rn. Better grammar too.

And of course it also has the fall into several categories of utility; a bug that causes the wrong shade of yellow to appear is (probably) not a zero day


Nothing like an existential crisis on a Tuesday's lunch break!

Two weeks later, and I'm watching this on a Tuesday lunch break. XD

It’s been a couple years of constant existential crisis. Fight or flight is the new baseline for a normal average relaxing day.

As a penetration tester - I live in fear

Repent to Jesus Christ
“Consider it pure joy, my brothers and sisters, whenever you face trials of many kinds, because you know that the testing of your faith produces perseverance.”
James 1:2-3 NIV
h

Or if you work in IT an early end to lunch break

This video makes it worth taking a break.

Solve it by getting chickens and putting potatoes in the ground.

On the back half of my lunch watching this, and I cannot agree more


Correction: zero day is a case when discovered vulnerability haven't been fixed yet. Not all software bugs are zero day. Only the ones that's discovered and used before software manufacturer produced a patch to fix it.

Since most software manufacturers are US companies, why don't they US government ask the developers how to ruin it

@Freedom Of Speech No thanks, but thanks for showing how bad your argument is. Who knows, maybe engineers will be able to make error-free objects sometime within your lifetime.<br>Spoiler alert: They won't. :^)

@Freedom Of Speech No thanks, but thanks for showing how bad your argument is. Who knows, maybe engineers will be able to make error-free objects sometime within your lifetime.
Spoiler alert: They won't. :^)

@Bane Cope, seethe and of course; dilate.

@Bane Cope, seethe and of course; dilate.

@Freedom Of Speech I know half a dozen very skilled programmers who, combined, have over 150 years of experience coding. Two have been coding since the early 80s. All of them work in teams of at least a dozen smart people. All of them have made bugs, and no one on their teams caught the bugs. I feel comfortable saying that you do not have any experience making software.
It is, quite simply, impossible to make bug-free non-trivial programs. And there are so many other components that could be wrong in a system. There could be bugs in the hardware. Or in the router. Or in anything. Nothing is bug-free.
"People like [me]" will not TAKE OVER the zeitgeist. The zeitgeist is "make good software, fix bugs ASAP when they show up". It has been that since the dawn of computing. YOU'RE the own trying to take over the zeitgeist - you're shouting on the sidelines saying "be perfect or you're a failure".

It's crazy that you think that engineering is perfect. Hey, can you tell me about the Arecibo Telescope collapse? What about the Fern Hollow Bridge collapse? Surfside condominium building collapse? The Obed Mountain coal mine spill?

@Bane No. It wasn't with engineering. It just takes extreme effort for a lifetime. We've done it before and we'll do it again. Unless people like you take over the zeitgeist.

@Freedom Of Speech It's fine to be a perfectionist. But anyone with any software engineering experience can tell you that making perfect software is essentially impossible. Making a perfect operating system that people will actually use - i.e., with support for Internet connections, 3rd-party applications, decent graphics, etc. - is completely impossible.

@Bane Ooga booga perfectionism is the only way to achieve glory over eternal suffering hooga chunga

@Freedom Of Speech Do you think Temple OS has no vulnerabilities? <br>There, no typos. Now answer the question instead of going "haha you made a typo, I win".

@Freedom Of Speech Do you think Temple OS has no vulnerabilities?
There, no typos. Now answer the question instead of going "haha you made a typo, I win".

@PleaseDontWatchThese Haha such a Microsoft thing to do - didn't like the clock starting when they're told about a bug because "MS fails to patch 30-day vulnerability" sounds bad, so they just made up their own definition and muddied the whole industry's terminology.

Oh Microsoft. Don't you ever change (jk please do).

@PleaseDontWatchThese The more you learn apparently, I've also always believed that zero-days were vulnerabilities that haven't been discovered by the devs yet, but a quick google search shows several sources saying otherwise. Kinda renders the "zero day" concept pointless if ALL vulnerabilities are zero-days.

@John Mackenzie Yeah, Microsoft adapted a different definition of zero day for some reason. People who work with security just know it's more of them thing. We all complained when they did that but arguing semantics didn't really matter for a nitch word

@Freedom Of Speech have you noticed how the AAA first games on any generation of games console are much less ambitious than the last ones?

You can try to say that's lazy game development, but the reality is it takes time and experience to optimise a game for a system, and then the system changes and the cycle starts again.

My point being it is basically impossible to write something so perfect that it's impossible to exploit, and even if it were possible OSs and hardware are continually changing creating new exploit opportunities that in term have to be fixed as they are found.  This does not mean companies like Microsoft shouldn't try to create secure software, it just means it's unrealistic to expect it to be perfect.

@Freedom Of Speech This is literally like saying "it is possible for a monkey to write an entire Shakespeare using a typewriter given enough time".

@Freedom Of Speech is = OS after auto switch, genius

@Freedom Of Speech is = OS after auto switch, genius

@bergonius "is have no" Idi utji angliskij.

@bergonius "is have no" Idi utji angliskij.

@helloFlorentin It lacks all input too then i presume?

Also, only christians would enjoy an OS without connectivity. ;)

@Cadde TempleOS is like a house without doors. It lacks networking so therefore no intruding possible 🙃

@Freedom Of Speech so you're seriously thinking temple is have no vulnerabilities?

@Freedom Of Speech so you're seriously thinking temple is have no vulnerabilities?

@Freedom Of Speech So somehow that makes you right?

Err?

@Freedom Of Speech So somehow that makes you right?

Err?

@Freedom Of Speech No i have not?<br>What about it?

@Freedom Of Speech No i have not?
What about it?

@Cadde Have you ever heard of Temple OS?

@Cadde Have you ever heard of Temple OS?

@Freedom Of Speech Please do!
Make an entire operating system from scratch without a single flaw, including hardware flaws mind you!

Programming is NOT like weaving a fabric.
Or it only becomes somewhat analogous when you start weaving a fabric in the 5th dimension!

There are so many vectors for "failure".

The user
The hardware
The connection
The data
The programmer

Every single one can be compromised or flawed.

@Merennulli You have it the other way around. Here's the definition on wikipedia :

"A zero-day is a computer-software vulnerability either unknown to those who should be interested in its mitigation (including the vendor of the target software) or known and without a patch to correct it. Until the vulnerability is mitigated, hackers can exploit it to adversely affect programs, data, additional computers or a network.[1] An exploit directed at a zero-day is called a zero-day exploit, or zero-day attack."

Here's the definition according to Microsoft:

"A zero-day vulnerability is a flaw in software for which no official patch or security update has been released. A software vendor may or may not be aware of the vulnerability, and no public information about this risk is available. Zero-day vulnerabilities often have high severity levels and are actively exploited."

Yes people sell the knowledge of the vulnerability, meaning the zero day. The exploit itself is the attack based on the vulnerability, which is rarely sold.

It's worth defining the difference between "vulnerability" and "exploit" here and how they fit into the context of a zero day - A "vulnerability" is the problem, and it's a vulnerability even if nobody has found it yet. Someone can discover that vulnerability and report it to you or sell it to some shady organization like a government, and it's still not a zero day.

An "exploit" is software or a technique designed to take advantage of a vulnerability. This is the zero day - the exploit itself, not the vulnerability.

To give a physical analogy, imagine your door lock could be picked if you just could reach a shrouded pin inside the lock, but nobody knows that yet. That's a vulnerability. Now let's say LockpickingLawyer figures out that vulnerability and tells the lock manufacturer and they don't bother to fix it. Maybe he even posts a video talking about it. It's still just a vulnerability.

Next imagine someone who isn't all that worried about the concept of private property also figures it out and bends a wire in the right shape to reach that pin, then begins breaking into houses with it. Now it's an "exploit", and since there is no fix for it, it's a zero day exploit.

To add another wrinkle, let's say someone else 3d prints an object that reaches the same pin in the lock and starts using it. That is the same vulnerability but a SECOND zero day exploit. Depending on how the lock manufacturer addresses the first zero day exploit, the second zero day exploit might still work.

@Freedom Of Speech Have you ever programmed anything? There's a million ways that things can go sideways that are damn near impossible to consider because they're just so out there. As a less dangerous example, people trying to hack the 3ds gaming handheld realized that by using the game Cubic Ninja's poorly designed level editor they could overwrite portions of the 3ds's code and gain access to portions of the system that were previously completely inaccessible. Needless to say, a company like Nintendo obviously cares a hell of a lot about locking down their systems to prevent things like piracy or malicious exploits, to the point engineering their hardware to fight them, since it can cut into profits in all kinds of ways. Do you really think that if making a truly 100% secure system was possible that Nintendo wouldn't be on top of that like white on rice?

Now keep in mind I'm not saying that Microsoft is a good company that deeply cares about its users, instead I'm saying that whether they care or not it's in the best interests of their profit margins that they fix as many dangerous bugs and exploits as possible since nobody's gonna wanna use an OS that leaks their credit card info every 5 seconds no matter how smart you are about avoiding viruses. The only way to ensure that you never have exploitable software is to never install anything, never transfer data in any direction through any method, and hide yourself and your computer in an underground bunker with 0 communication methods for all eternity (you gotta hide yourself too because social engineering is a thing).

@John Mackenzie isn’t that the definition of any vulnerability: one for which a patch hasn’t been released?  Once a patch is released it’s no longer a vulnerability.  What’s the differentiation of a zero day?

@Daniel Kaschel Here's Microsoft's definition at least : "A zero-day vulnerability is a flaw in software for which no official patch or security update has been released. A software vendor may or may not be aware of the vulnerability". The severity of a vulnerability itself doesn't change with the knowledge of it, but the market cost for the vulnerability does. I'm talking mere knowledge here, of course the severity being known also means that it will likely soon be patched, so it's worth less. Zero days can be easy to fix or not, their only requisite is that they can cause damage if exploited. It's what differentiates them from regular harmless bugs.

@John Mackenzie not necessarily saying you're wrong, but do you have a source? The severity of a vulnerability is greatly reduced once it is known, even before there is an official patch. I would have thought zero day vulnerabilities were those for which there could not be deployed mitigations (even if that just means air-gapping a server until a patch is available)

It sounds like it was incorrectly defined at first, but if you listen to his whole description of a zero day it is good. It's not really a correction. It could've maybe been presented a little bit more clearly though.

@Trae Hesket It is. Windows just doesn't care.

@Trae Hesket It is. Windows just doesn't care.

@ツNekko zero days is how many days people have been working on fixing the bug before someone exploits it

@Freedom Of Speech If that were even remotely feasible, then vulnerabilities wouldn't be common, especially in things like Windows, which are written by companies that can and do hire some of literally the best programmers in the world. programming software has become such a complicated Jenga-tower mess that no one can possibly cover every base.

Nothing should have to be "patched". Create one good fabric without holes.

Nothing should have to be "patched". Create one good fabric without holes.

@PleaseDontWatchThese I'm not sure why Youtube deleted my last comment, but I basically mentioned how you contradicted the original poster after agreeing with him, and how I had the same idea as you until I did a quick google search and found out that zero day apparently also includes vulnerabilities known to devs but that haven't been patched yet (or at least according to Wikipedia). By devs here I was talking about big players like Microsoft and Apple, they quickly fix major vulnerabilities in a matter of hours or days when brought to their attention, like when Apple patched the iOS vulnerability that Pegasus used as soon as it was brought to their attention.

On the opposite end of the spectrum you have N day exploits. With N denoting how many days there have been a patch for it that few have installed.
This is the reason you want to stay on top of updates to your software and even firmware.
If an exploit exists and nobody fixes it, it's still an exploit that can be used as an attack vector. And they can be just as damaging and people only get on top of fixing it when they have been affected by it.

@John Mackenzie zero days are always not know by the devs by definition. Devs don't always act fast and it's always been a topic in the security world when to publicly disclose exploits to force devs to act so zero days don't happen.

@ツNekko  It's a exploit in existing software that is activity being exploited that was not previously known. Sometimes exploits are know or reversed engined from patches and these are not zero days. If a bug is found and disclosed its also not a zero day.

Not trying to correct you or anything, but arent zero days vulnerabilities that have been discovered before the software is released?

Another correction, most zero day exploits are not known by the devs. Known zero day exploits are usually quickly fixed by devs when brought to their attention.

Thank you for pointing this out. Its confusing because people describe exploits/vulnerability as zero days in the media but its only describing the effect and not what it actually is. Its like calling a car a zoom. The zoom being the zero day and the car being the exploit.


The lesson is listen to your programmers when they tell you they need more time. ESPECIALLY if you work on something critical.

@Serveck nah it wasnt nocom lmao all that did was find location of players ingame

@Simon Burgess

I always wait a few weeks before updating so they can find and fix the bugs of the new software.

"ESPECIALLY" is a keyword here though. Not ONLY if you work on something critical. Even if you work on (for example) a video game and that game ends up becoming internationally popular and happens to have vulnerabilities in it, your harmless entertainment software could become the conduit for an attack, and by extension your players. Imagine the havoc that could be wrought if a serious security exploit was found in Minecraft for example. And that exploit lets the malicious code spread to IoT devices on the network. This is everybody's problem.

@Unixtreme Genius, copying them into a directory where almost no one opens in Explorer, ever, haha

When I was in high school I rigged the USB autorun at the beginning of the video to inject my own payload instead of the intended one.
From that moment on whenever a new USB key was inserted it would:
- Transfer all .txt .doc .xls and such document files to a hidden folder in C:\Windows\
- If the Label was a specific label (sort of like a password) it would instead copy all files in this hidden folder onto the USB drive.
- Self-replicate to the inserted USB key and make itself part of it's autorun.

I used this USB key to then turn in my class assignment to my teacher.
I think in like a week I could go around to any computer in the school, plug in my USB key with the right label, wait a few minutes, and a bunch of new documents would be in there, including:
- Future Assignments.
- Future tests.
- Other student's assignments/projects.
- Personal documents (that was dicey).
- Some people even had text files with their passwords.

Sorry I feel like a rambling boomer. The reason why I can disclose this is that it just prescribed so even if they found me out nothing could happen.

@Simon Burgess yeah, tell that to end users and product owners... "I ain't paying you for fixing working things, gimme features NOW!!!11111"...

And always have the most up to date software version


A few years ago when they started making fridges, stoves and other "smart" appliances I half joked that hooking your toaster doesn't do much more than making is possible for someone to burn you house down remotely.  <br>Not sure if it's a good thing that I was right.   Internet connection for 90% of devices is useless and pretty much just an extra thing to go wrong and a vulnerability.

A few years ago when they started making fridges, stoves and other "smart" appliances I half joked that hooking your toaster doesn't do much more than making is possible for someone to burn you house down remotely.
Not sure if it's a good thing that I was right.   Internet connection for 90% of devices is useless and pretty much just an extra thing to go wrong and a vulnerability.

@Wojtek Security is as strong as the weakest link, after all

I agree. The so-called "internet of things" is a stupid idea. Just like I would never cede the steering wheel of my car to a robot, I'd rather not have random household appliances attacking me. Imagine an angry roomba! 🤣

Like the smart fridge in Silicon Valley. 😂

There was an incident of a casino getting hacked because the fish tank thermometer wasn't up dated and allowed the hackers to get access to the network.

So since when could a fucking toaster burn down a house

@Nunya Business "Toaster need no Internet. Internet in toaster mean hacker can hack toaster. Hacker now sets house on fire. Don't give Internet to toaster."

Just a fun tidbit, IoT devices being hacked and causing mayhem is exactly the case in Detective Conan: Zero the Enforcer movie.

As the common adage goes: "The S in IoT stands for Security".

this is what the whole watch dogs series is about

What would a smart toaster do? Smart fridge is like a tablet taped to the fridge. Can mitigate some issues by having the microcontroller for the actual fridge components pay attention to what the tablet tells it to do.  Might suck for V1 users but V2 users will be fine :D

Agreed, these gimmicks make for easily exploitable home networks and homes for botnets.    Tech enthusiasts can't get enough smart devices, the tech knowledgable try to lock down and protect themselves, and the tech experts have a backup plan because they know they can't be truly safe from modern devices.

@Karl How many HIK Vision cameras or home AP's are still on their default settings/password?
How many were/are used for ddos over the years?

@Karl How many HIK Vision cameras or home AP's are _still_ on their default settings/password?
How many were/are used for ddos over the years?

@Nunya Business IoT devices are usually fairly insecure and almost never updated, making them easy targets for hackers.

Really not a concern for the average consumer, very few hackers are interested in burning down your kitchen with your smart toaster, but they can be recruited into botnets or used to more widely propagate malicious code.

Can you rephrase that in a way that makes sense?


I had gotten into ICS cybersecurity just a few years before this happened and I remember how game-changing it was at the time. Not in terms of its capability, as we knew hacks on this level had existed for several years at the nation-state organization/funding level, but game-changing in terms of getting everyone's attention. Hell, it's only due to ambiguous attribution and plausible deniability that real-world wars haven't been triggered yet. But that day will come when a hack causes such serious damage and the attribution so obvious that it will escalate into war. - I can assure you that everyone is in everyone else's systems and have been for a decade doing recon and quietly sitting in wait to be triggered. Better methods of detection and monitoring along with quantum encryption/networking can't come soon enough. - The best defence is accepting you WILL be taken down and only having a good mitigation/continuity plan will save our critical infrastructure from being taken down.

@User 2C47 I said mitigation and continuity are plans. When I was referring to defense, I meant it in the context of not a defense strategy but a defense against critical infrasture failing completely in terms of services being provided after an attack.

@Dedmen Miller - You could achieve this by including traces of language in the compiled program that are only in official use by a single nation-state. That includes Hebrew (Israel) and Farsi (Iran). It raises the cost of developing a virus, but a nation state could easily afford it.

There’s a sleeper worm that’s been napping since the March 5th, 2005 in a nuclear silo stateside.

"accepting you WILL be taken down" is a plan, not a defence. Airgapping is an example of defence.

@Christian I've been around in 'the industry' for some 4 decades now...

Anyway, the mere fact the MO of most ATPs is well known makes false flag operations resulting in mis-attribution more than just a theoretical possibility.

And such a thing happening wouldn't exactly be a first either.

So I disagree that reliable attribution is not difficult, at least when dealing with a serious and knowledgable attacker wanting to hide their tracks.

"with quantum encryption/networking can't come soon enough."<br>as the experts say: it's basically never the math, it's the implementation (how it's used) and any other code around it. So the encryption itself won't save anyone.

"with quantum encryption/networking can't come soon enough."
as the experts say: it's basically never the math, it's the implementation (how it's used) and any other code around it. So the encryption itself won't save anyone.

@Dedmen Miller To call it easy is to simplify it grossly. It is not "easy" to hide your origin to an extent that it is impossible for a well funded and well organized cyberforce to find recognizable markers. If anyone tells you anything else it's just pure fiction from a movie.

@Bart Van Leeuwen Well without going into the technical stuff to deep, the MO of most ATP:s are well known within the community of LE and CF. To attribute certain markers in order to recognize the origin of i.e. an attack is relatively easy.

Now, the western world have been really shitty and afraid of actually retaliating and thus we have multibillion theft and other types of espionage and attacks regularly from nations like CH, NK and RU. Not to mention all the APT:s and subgroups out there.

There are many aspects here that is mostly unknown to the public and it irks me when someone like wendower tries to explain something they clearly have little knowledge about.

Attribution is also a very dangerous topic, it's easy, especially for actors of this magnitude, to make it look like the author is some specific person or state.

The Swiss cheese defence: the only practical way of defence

@Christian they still have to be able to attribute the attack to a specific attacker.

And hrm, I'd say them being less dependent on high-tech connected infrastructure is the primary reason for less exposure.

Actually, Russia has a policy that more or less allows it to regard any cyberwarfare against the country as an act of war. This among other things makes Russia have a very small exposure towards cybercrime and cyberwarfare.

Yes, in fact much of this, including the mitigation required, was already well known in the 1980s, and the US DoD has an excellent series of books from that time systematically describing the enabling factors, the possible defences, and why any defence includes having a plan B, and how to make that plan B not fail in the same way.

Sure, the actual technology used as examples might be outdated in those, but it is still asking the right questions, and providing a good way to think about creating solutions.


As an information security professional I’m ecstatic that cyber has entered the public consciousness, thank you for this video

@Comrade20 like i said it's like sending a photo of a kid who robbed a gas station station talking about a treasury being siphoned

@PotatoChips23415 I got a picture of them one time in a video call he looked really familiar

@Plentus Have you ever heard of the term cyberpunk? Yes, that is from 1980.

as a bullshit detector professional i call bullshit

if you think cyber just entered the public consciousness, you must have missed the 80s.

I'm scared, there's this guy who was friends with my friend and told me he was with some hacking group from Belarus, like he started phishing people from 50 accounts, said he knew some kind of 'people' called Sandworm, possibly them


Wendover: "No one has officially accepted responsibility for creating Stuxnet."<br>US & Israel: (holding back giggles)

Wendover: "No one has officially accepted responsibility for creating Stuxnet."
US & Israel: (holding back giggles)

Ikr, as if the typical basement dwelling hacker would know how an underground uranium centrifuge in Iran works.

@Carlos Leon No one actually knows, but I'd bet money that the DoD had a few hands in it

@Carlos Leon CIA with collaboration with others in Israel.


Just something to consider: This was discovered like 10 years ago. Just imagine how much more powerful cyberweapons must exist nowadays. No one listened, so now we wallow inside the pit of insecurity.

@Mike Martin There's also the problem of widespread misplaced trust. Billions of people are happy to put their trust in operating systems and software they (and in fact most people) know nothing about the inner workings of, and they gladly send all their personal information through devices running said software.

Maybe not the general public, but the software development industry certainly has reacted to this.

More numerous I'd buy, but even without being a professional on any level I can tell that more powerful is questionable. All of this is dependent on the target software failing. Hacking isn't some video game where you invest skill points and suddenly you can use Google's search bar to find bank passwords, new holes in security I can believe, but autorun isn't gonna turn into autosprint just because you have two people typing on the same keyboard.

Oh yeah, I mean during the mid 2010's my own country of Denmark had our national public services and companies constantly bombarded by Russian cyberattacks until we started deploying a national hacking taskforce within the national defenses.

Idk who is nobody. I literally am studying cyber security in school rn and I do it in my day job as well.

@Some One hence it's still insufficient. Regarding open source, it's not a silver bullet. I have to admit that I'm an open source fanboy, but it does have issues. One of those issues would be that even an open source project that allows for the "many eyes principle" can still have vulnerabilities out there for many years, if there's nobody (aside from the devs themselves) to look at the project. In other words, popularity is key. And even then you have the issue of code quality. Examples would include sudo and openssl, which are very widely used. In both there were critical vulnerabilities for many years, and in both I'd argue that the code base was/is overengineered, overly complex, and overall just a lot of digital spaghetti. It is possible to replace them (sudo vs pkexec / doas, and openssl vs libressl / gnutls) but the problem still remains. Open source is of no value if the code is still essentially unreadable.

@Mike Its not only sth. companies have to implement but the state through its laws as well. Also Open Source can play a major role in finding and fixing bugs.

You could consider ransomware als Wannacry a cyber weapon. And that made quite some rounds in the recent years, and that wasn't even really targeted use, it was just thrown out like as shotgun shot.

They're only as powerful as your reliance on the internet.

Society absolutely needs to become more aware of how potent this can be, I won't argue with that. But the people to whom this should matter (development houses, governments, legislators etc) did catch up, albeit horribly late and still insufficiently.

Unless we become able to make software so simple and so rigourously reviewed that bugs and security vulnerabilities become a thing of the past however, software will never be completely secure from the get-go. Airlines are among the only industries that came close to achieving it, and they pour tremendous amounts of money into it, while moving their software stack extremely slowly for that purpose. Compared to that, when was the last time you've paid for an app? These industrial organizations and consumers are very, very different. And development is already extremely time- and money-consuming as-is. Most people don't seem to realize that.

The best we've been able to do so far is to make these software development houses realize that these vulnerabilities are a thing, and somewhat forced them into fixing those vulnerabilities (90-day responsible disclosure). And for them to realize that bounties are relevant when very powerful governments and black markets too got very interested. It is not perfect, but it's the best compromise between cost, effort, time and quality we have been able to come up with so far.

Not going to deny huge vulnerabilities still exist, but saying no one listened is ridiculous. Do you think companies and governments are going to put out announcements about the steps they've taken to secure their systems?

Tbh we have always been vulnerable, defenses and attacks develop day by day but one thing for sure is that the results will be the same, the only difference is perspective. A virus infecting 100mil devices decades ago would not be any different from a virus infecting 1bil devices today, its the same results, someone's property will get damaged.

Not just in the vulnerabilities but in the implementation and discretion of the objectives it is the nature of cyber warfare to evolving faster than the nasty little bug eaters. Zero day exploits suck.

Modern cyber warfare also targets public opinion and psyche.

Plenty of people listened. There's just not a lot we can do to patch 0-days that, by definition, we don't know about yet


i’ve been a part of the cyber security industry for over a decade, it’s crazy to see how much it’s changed!

What nobody talks about is how, probably Israel, killed some of the engineers from the nuclear plant who were trying to clean it up where killed on the streets in the city.<br>And how the security expert from Microsoft had an unfortunate accident before his big talk about Stuxnet at a security conference. Probably that last one was purely an accident and coincidence. But the dead Iranians clearly aren't. It does indicate that working in IT Operations and Security has become a more dangerous job than it used to be. And as XKCD 538 indicates the weakest link at some point might end up being us.

What nobody talks about is how, probably Israel, killed some of the engineers from the nuclear plant who were trying to clean it up where killed on the streets in the city.
And how the security expert from Microsoft had an unfortunate accident before his big talk about Stuxnet at a security conference. Probably that last one was purely an accident and coincidence. But the dead Iranians clearly aren't. It does indicate that working in IT Operations and Security has become a more dangerous job than it used to be. And as XKCD 538 indicates the weakest link at some point might end up being us.

What surprises me at times is how long it really took for those things to happen. I agree that something like stuxnet happening was huge, but first of all because it became public, and people started to think about it, and take some things people in the security industry have been saying for a long time now, a lot more serious.

But.. imo, this being possible wasn't news, and shouldn't have been news for decades now.

also I am impressed by how well you explained stuxnet. For a guy who is likely not a computer scientist or a security engineer, it was a near perfect presentation. My hat is off to you!


The best way I've found to fully understand Stuxnet was listening to the Darknet Diaries podcast. It goes into a lot more detail and shows how amazing the whole Stuxnet operation was

@Danger Ranger Dan he's literally uploaded the podcast episode onto YouTube in the last couple of days! Search for Jack Rhysider and it'll be his most recent upload, it's a great story 👍🏻

thanks for the recommendation I'll look it up!

I really like the analysis of Stuxnet called "To kill a centrifuge" by Ralph Langner as it explains lots of technical details about Stuxnet and centrifuges in question. Also the virus portrayed in this video is actually a second less sneaky version of Stuxnet, the first one was much more sneaky and destructive, but much less exciting as it had no 0-days nor any way to spread via local network.

@Daniel Hess there's definitely hacks going on right now that are way crazier than Stuxnet, but they're that good we don't know about them yet, because the victim doesn't even know about them 👀

Stuxnet’s dev artifacts date it to at least 2005. Imagine how potent current-gen cyber weapons are, <b>17 years</b> later…

Stuxnet’s dev artifacts date it to at least 2005. Imagine how potent current-gen cyber weapons are, *17 years* later…


When it comes to cyberwarfare, every nation with sense operates on a policy of 'Those in the know aren't talking, and only those who are not in the know are talking.' I once chatted with one of their ex-security guys and apparently Fort Meade is so insanely paranoid when it comes to security, they immediately began renovations on their headquarters when some college discovered a way to get wireless data through the massive Faraday cage already cladding those buildings. These are the same guys that encase every wire coming into Fort Meade inside sensor-lined concrete.

say "By this channels sponsor, Wix" I know the sponsor is not wix, and I have no idea why that popped into my head, but it did.


As  someone who works with PLCs its nice to see them actually mentioned. I wasn't aware that Stuxnet hit the PLC's themselves I thought it crippled the SCADA system. I guess that shows how PLC's tend slide into the background in the media. The only comment is you used a modern Logo PLC (more akin to home automation or tiny single function machine) instead of the S7-300 more akin to massive machines and entire factories.

@Steam & Tech controllogix can have passwords but they’re use is frowned upon unless it’s a safety program or pharma.

@Preston Siegfried Yeah I'm haven't seen any passwords on AB plcs either. I know siemens have added them now.

Yeah, controllogix 5000 don't have any credential requirements (or even an option to set any as far as I've seen), just need the ip and you can mess some thing up badly

PLC security is a joke and mostly relies on being on an isolated network. That obviously isn’t enough if someone really wants access to your stuff as stuxnet proved.  Makes you think twice every time you swap a usb flash drive between a business and process computer.


I learnt about day-zero exploits in my cyber security course. They are dangerous. And it is interesting to see them being used in this Ukrainian-russian war. Both Ukraine and Russia have been victim of these exploits because of the war.


Very well presented. I think you should have made more clear how enormous 1MB is in this scenario. People take pictures or videos of hundreds of MBs or even GBs all the time. <br>But this is just code and 1MB of just code for one single purpose is crazy.

Very well presented. I think you should have made more clear how enormous 1MB is in this scenario. People take pictures or videos of hundreds of MBs or even GBs all the time.
But this is just code and 1MB of just code for one single purpose is crazy.


This representation is somewhat inaccurate: Exploits, big and small are found all the time and are patched all the time.  They're not nukes, you can't just sit on one for years because it may either get discovered and patched or rendered pointless by some other update or just a new software/OS/etc.  They're also typically already out and about (ex: Meltdown) and, if big enough, get a ton of attention and very fast reaction to it.  The log4j fix is an example of this.  That doesn't mean they can't do a ton of damage, it's just that more often they're just happening all the time, and the vulnerabilities are just getting patched all the time.  Organizations that are bad at security and keeping up with this, government or otherwise, are obviously the easiest targets.

@Sovrim Terraquian true, though that bug was exploited primarily cause the patch sucked and people weren't updating their unix servers. I guess the point I'm making is banking for a long time on no one discovering the discovery that you bought and hired a team of people to implement maliciously sounds like a stupid idea. It's like finding a $100 bill on a crowded street. You better hope no one else saw it. But as I said, I concede that sometimes exploits exist for literal decades, so a fair example for sure.

As a counterexample, the Shellshock bug had existed since 1989 and wasn't identified until 2014. It is certainly conceivable that, even in the absence of conspiracy theories about government/corporate partnerships, a devastating bug could go unnoticed for decades.


The book referenced,  "This is How They Tell Me The World Ends", is an amazing deep dive into this subject, and the beginning and ending sections dealing with the author's time in Ukraine were disturbingly prescient.


I'm a programmer and a hobby hacker. I expected some flaws since no one can make accurate cyber security videos. However, you did a really good job. Thoroughly enjoyed this one, thanks!

Not really, a lot of the info in this video is half-true, and he doesn't seem to know what a lot of the terms (such as zero-day and remote execution) mean

@Jake Stavinsky Their hobby is hacking and learning about hacking


I remember watching more information about this unfold while in IT class.
It's amazing how simple payload concept was.  Security Now podcast was a stream of weekly updates for a while there.
This video is an excellent piece of coverage pulling it all together.


"This new era was made possible and perhaps more importantly profitable"

I have absolutely no idea why, but I was genuinely expecting (for just a second) that he was going to say "By this channels sponsor, Wix"
I know the sponsor is not wix, and I have no idea why that popped into my head, but it did.

For me it was both Squarespace and Cloudflare, simultaneously.


The common theory I've heard is that to at least some degree, Stuxnet wanted to be found eventually, after causing significant damage - the US wanted to show off their capabilities, and this is just about the only way you can.  You can't exactly have a military parade with a bunch of soldiers holding up USB drives.

@Gave2Haze Pfft, Israel was the one who wanted to just airstrike the nuclear facilities directly.  They have no restraint when it comes to assuaging their own paranoia.

You'd think israel would hold them back, being the one country that doesn't show off

I got the feeling that this is like a new cold war.

No, just no. When you have a capability like that you keep your lips zipped and you keep using it.

That would be very on brand for the US as well. Meanwhile, China likely has access to every phone, laptop, and game console in the US and is just sitting on that... For now

Trust me, Iran will hold a millitary parade with soldiers holding laptops (made in the US) or some USB drives.

@LordDarias At least nukes have MAD. If you get cyberattacked, assume it's the US or Russia or whatever, and launch a counterattack, then you just look like an asshole because the origins of these attacks are fairly difficult to prove.

@Calvin_Coolage a fitting metaphor, seeing as the US opened the floodgates to a new scary dimension of warfare, much like Hiroshima

Makes sense, kinda like the motivation behind the use of the atomic bombs.


I remember first hearing about Stuxnet in a podcast years ago and it was kind of the first time I questioned the ethics of a nation's government to inflict damage on another with that sheer lack of accountability. Of course since then read about tons of other incidents that reinforced that idea, so its stuck (no, no pun here) with me as a poignant example of this issue.


With proper security monitoring zero days are not that scary. RCE would be detected and countered as it happened and the spread would be minimized.
The problem is many corporations spend money on cyber security insurance because it's cheaper than proper security.
Just like having the CEO pop their golden parachute and take the blame for something bad the company did cyber insurance lets the corporation save money until things go bad and then they get a big payout. The only ones harmed are the customers.

Yet another instance where putting profit over everything is costing average people.
We need more stakeholders in business, and less shareholders.

I doubt most security monitoring would detect or prevent a RCE 0day.


Your consistency and quality of content never disappoints ♥

@bababababababa I dont care doggo is a bot

@alwinsluke why are you subscribing to an obvious bot 😂


As a Senior Information Security Engineer, I was very intrigued to see what would be covered in this video.

I'm pleased to report that it's largely very accurate, and I look forward to seeing more!

If you want to know more about this topic / Stuxnet (and I mean almost mind-numbing levels of details), read or listen to Countdown to Zero Day. Other great cybersecurity books I've recently listened to are (1) Sandworm which is about Russia's terrifying cyberwarfare capabilities and attacks and (2) The Cuckoo's Egg which is the story of the first proper Incident Response and the methodology borne out of that.

Practically the entire industry thought that the next major war would have a HEAVY cybersecurity element, but it's been (morbidly) interesting to see that seemingly no such thing has come of the Ukraine war yet. It seems that, in most cases, "cyberweapons" will be relegated to intelligence gathering and "under the radar" attacks.

From my (admittedly incredibly distant) perspective it looks like disinformation is the most visible weapon currently in use lately.

On one hand that's a minor relief on the network side, but on the other it's really annoying seeing less discriminating contacts willfully spread easily-disproven nonsense. That's a whole can other can of worms though, and neither this video nor this comment are part of that problem.


As a PLC programmer I can honestly say you should do many more videos on PLCs and other ICS devices ❤


I'd highly recommend reading the book "Countdown to Zero Day" by Kim Zetter if you're interested in the StuxNet story - it details the full timeline in great detail. If you're at all interested in CyberSecurity you'll definitely enjoy it.


If you enjoyed this - Countdown to Zeroday: Stuxnet is an amazing book that dissects how the virus works and potential ways it was delivered.


18:45 I'm no expert, but I'm almost certain that a lot of people around the world already have experience with wars that they can't simply ignore by turning off the TV.

18:45 I'm no expert, but I'm _almost_ certain that a lot of people around the world already have experience with wars that they can't simply ignore by turning off the TV.

But the point is that a lot of people CAN ignore entire major wars by turning off the TV. Or if they live in Russia, by the TV turning them off.


2:16 I actually thought you were going to say "this new era was made possible by Curiosity Stream / Nebula / Brilliant / etc" lol

...Squarespace, Cloudflare, Nord or Express VPN...


Hands down my favorite cyber security story ever. Love that the virus only targets a very specific centrifuge setup.


What stopped white hat hackers from selling the exploit, and then immediately delivering them to the software developer to be fixed?

Why hasn't this business model changed to some sort of subscription, where security companies would buy an exploit, and then pay some daily/weekly/monthly fee until the bug was patched by the developer (this way, encouraging the bug to be kept low profile)?

@BigManRufus unfortunately it makes a lot of sense. :/

White hats are not nearly as common as you might notice, because of a combination of things, but here's something pertinent:
When a bug gets reported, it usually comes after the reporter has abused it for a while and got bored or feels bad about it. So most of the time, reporting bugs can get you extreme suspicion and or bans/punishment. This alone demotivates a majority of regular  (ie. non corporate employed) white hats.

But other than this, generally, cybersecurity firms are hired in the process of creating new infrastructure. The problem is software devs LOVE to reuse old shit, so basically unless you're making a whole new internet, bugs from a billion other places will be incorporated. The internet is a lot like building a house and your house building tech only gets better the further in you've gotten. By the time you're installing solar panels, people are starting to realize the foundation is made of packed dirt.


As someone who works in cybersecurity, I can say this was a brilliant video for bringing awareness to the massive concerns that nations, companies and, individuals face in this regard.


thanks for all the work you and your team put into the products you guys create, they are always made with care and even on HAI made with wittiness.


Wendover is still one of the best informative youtube channels. Amazing work, brother!


To be fair, it was already "here" in 2011 - yes eleven years ago. But due to it being ignored and labeled as a "non-issue" (with victims i.e. companies/govs always denying they got hacked/whatever) it hardly received any publicity. It needed an actual war with a large nation for "Cyberwarfare" to finally receive some actual recognition.


A zero-day isn’t just a bug, it’s specifically an exploit that has yet been undiscovered (eg “it’s been zero days since our staff was made aware of etc”). This is usually a monumental discovery, because it means this exploit may have been around for a long time undetected, and none of the programmers have any idea how much damage has been done in that time. Not every bug is a zero day, because not every bug is an exploitable issue unknown to developers.


I worry about the electrical grid. It’s an incredibly expensive, incredibly important piece of infrastructure that everyone takes for granted. A stuxnet-like exploit applied to the grid can cause damage on the order of billions of dollars, and hamstring entire nations for years.


One of the best and most sensible YouTube channels! Amazing content. And the narrator is awesome too!


It's a shame you only mentioned ransomware a little at the end. Without the huge market for zero day exploits created by aggressive state cyberwarware ransomware wouldn't be so big now. Some of the organizations doing it have become scarily big, powerful and wealthy. Governments need to band together against them and IT security needs to improve massively. Governments must stop fighting against encryption and safe communication protocols.


As someone big into technology, this was truely a gift given to us from Wendover Productions


The amazing part was not so much about the worm spreading over a usb stick. That kind of stuff was done in the 80s with floppies. And its ability to use zero days was also not too special as all exploits found in the wiled are zero days. It was its stealth and really specific targeting to attacked a complicated air gaped machine was what got everyone's attention.


Wow, it is hard to believe the Shadow Brokers' leak was already five years ago! That was a big one. The ransomware campaigns that followed it were unprecedented in scale and simplicity.


When he said "This new era was made possible..." I thought he was gonna say "by Nord VPN"


i do have to nitpick a bit: not every vulnerability is a zero day. the zero refers to the number of days a defender has to patch it, so until an issue is actually found and used by an attacker it's just a generic vulnerability.


Why is it called zero days?<br>The term "zero-day" refers to the fact that the vendor or developer has only just learned of the flaw – which means they have “zero days” to fix it. A zero-day attack takes place when hackers exploit the flaw before developers have a chance to address it. Zero-day is sometimes written as 0-day.

Why is it called zero days?
The term "zero-day" refers to the fact that the vendor or developer has only just learned of the flaw – which means they have “zero days” to fix it. A zero-day attack takes place when hackers exploit the flaw before developers have a chance to address it. Zero-day is sometimes written as 0-day.


Stuxnet was signed with private keys that could only have been stolen by some very sophisticated hackers.


Impressive video for a discovery of a channel. I was so impressed by not only the content but the editing, and the referral price offer for CS+Nebula was so good that I couldn't resist!


I have never understood how hackers in movies are able to break into secure systems with a few keystrokes.

@User 2C47 but they have to access the system in order to even get the worm inside.

If it's in a tactical situation, they likely use a script prepared beforehand that tells their worm to execute its payload.


One interesting bit that wasn't covered: it's mentioned in the video that stuxnet got onto the research facility's hardware due to a spy or mole. That may not even have been the case: it's theorized that instead, whoever was trying to deploy the virus did so to either the Siemens controllers or something that would be connected to them, at the source. That is, these machines were infected with stuxnet en masse in their countries of manufacture in the hope that at least some of them would make their way to Iran. And it worked. It's possible that this is also what led to its discovery by the western public: enough of the infected machines made it to western countries that a user who happened to be operating one such machine stumbled on it.

What if a single contaminated USB drive found its way into the factory where those machines were being built, and commanded the system that installed their firmware to include a bit of malicious code within it? The factory would not have had the same level of security as the enrichment facility, so it could've been easier to slip in an imposter or bribe a rogue employee...

That's interesting; it essentially means the attack targeted civilians. I'm sure there'll be some international law laid out to limit that.


As someone who has had an attack that infected my network at home I can say its quite the nightmare.  So bad I went to school to retrain into IT because I saw what this could do.


On minute 11, I swear I got goose bumps. Great story, magnificently told. Great job guys!


This is by far one of my favorite stories.  Anyone who wants a more in depth dive, read "Countdown to Zero Day:," it's an incredible retelling and well researched record of the story of Stuxnet / Olympic Games


Stux was fun. Came from Utah, was propagated by a 'lost' usb thumb drive, exploited not only the zero days but also DMA capabilities of usb, so it could make the air gap jump. That's how it got onto the gapped control machines that ran Iran's centerfuges. And the payload was brilliant--make the uranium enrichment *unreliable*, not completely broken.

Absolutely brilliant spycraft.


So interesting! I only had a very rudimentary knowledge of how this whole thing works, and it's so cool to learn how it started and the sort of 'logistics' behind it.

i want to know, at the moment, i'm scared, a friend of a friend i know has been hanging out with this man part of a Cyberunit known for phishing, hacking, vulnerable information, possibly Sandworm


I’m really digging these Lemmino style documentaries Wendover is pushing out.  Really good job guys!


When everything is interconnected digitally and with electricity, a simple hack can destroy the entire world. It's seriously worrying.


It's amazing how far technology has come. As with many things, if you don't keep up with it you get left behind.

I remember thinking awhile ago how much I knew. But in the blink of an eye I'm old news and outdated.

Trust the fact that the alphabet boys are keeping up with this advancement. I'm always curious how much thought goes into these trends. Such sophistication and plotting goes into these attacks. Specifically to lay in wait.

The newest version I saw was talking about storing itself in the bios of a machine. That gives me worries at night for sure if I was a network manager.


It kinda terrifies me that my university labs have PC's still running windows XP. They're obviously not connected to the network at all, but imagine what one guy with a long cat5 cable and a few minutes could do to the whole university network.

The problem is not that they are not willing to upgrade but rather that Software Companies are either to lazy or that the Software that they build are from the 80is or 90is. Everyone who has a little unterstanding how  OS works knows what works on a Win10 does not mean it is going to work on older Versions. A good solution would be to switch those Softwares on Linux but I guess the American Lobby would have a small problem with that and on the other hand to convert the whole Software on a different Kernel and Operation System would take ages.

I don't know the mechanism, but my university suffered a devastating cyber attack. All the systems shut down, and more than a month later, some of them are still down.


Whether you think this is good or bad, it is still amazing.


Imagine everyone just getting along and doing things to help everyone improve..quick! Someone write a song about that!


Ok but like this is something I hadn't realized until Sam said it outright: a weapon that cannot be revealed before it becomes useless, is a weapon we cannot shield against. The idea, the prospect of our there being a weapon so destructive, so devastating, so catastrophically armageddon that's just laying dormant, truly is something chilling. We're exposed, there could be a sniper looking at us right now, aligning their crosshair to our frown 24/7 and we have literally, literally no way of knowing if that sniper even exists, let alone which is his rifle, what's their ammunition, or his position.

This is a war of warnings, a war that will only end the very second a country calls a bluff to another country that was not bluffing.

Ok but like this is something I hadn't realized until Sam said it outright: a weapon that cannot be revealed before it becomes useless, is a weapon we cannot shield against. The idea, the prospect of our there being a weapon so destructive, so devastating, so catastrophically armageddon that's just laying dormant, truly is something chilling. We're exposed, there could be a sniper looking at us right now, aligning their crosshair to our frown 24/7 and we have literally, *literally* no way of knowing if that sniper even exists, let alone which is his rifle, what's their ammunition, or his position.

This is a war of warnings, a war that will only end the very second a country calls a bluff to another country that was not bluffing.


The research for this video must’ve been huge, amazing work


what i would like to add is that Siemens PLCs have a pretty huge market share, especially in and around europe. Most other companies have special usecases, but what i have seen Siemens stuff is used often because a lot of people know how to use it, get a good price and know how to program it.


I wonder if there have been cases of developers purposely leaving in exploits then selling them and patching them as soon as they get the money. I guess any company big enough for exploits to be valuable is too rich to care about the bounty


I can really recommend the book Zero day. It's about stuxnet and really interesting. But I do think that cyberwarfare is a lot more diverse than this.


"Wars will no longer be fought in far-off lands that can be ignored simply by turing off the TV."

Rather America-centric view, considering what is happening in Ukraine in this very moment.

As long as cyberweapons cannnot control strategic resources or locations (water, oil, power plants, food, warehouses, defensive positions etc.), a conventional warfare will still be a thing. Cyberweapons will nautrally be part of arsenal of any modern army, but the quote above sounds like an overstatement.


3:12 that is a very weird way to explain what zero-day exploits are.  not sure why you would go so far to avoid actually tying the name to the core concept directly.  have a feeling a lot of people walked away with some weird idea of what they are.

Yeah, 0-day-exploit = the manufacturer has had 0 days to look at the exploit, therefore hasn't been able to fix it.

@Calvin_Coolage yup.  one defenders have had no time to set up defenses for when it's used.

A zero-day is literally just an undiscovered exploit in software corrrect?


Perfect timing! I just finished This Is How They Tell Me The World Ends by Nicole Perlroth last night. It's a great book on cyberwarfare if anyone's interested.


If you find any of this interesting I completely recommend the podcast Darknet Diaries, it has a whole sub series about stuxnet, as well as attacks such as notPetya and others. It's a very well produced show made by someone who is very very good at research and knows the industry in and out. Jack Rhysider is a beast


Incredibly well written script, both yours, Wendover and the one used in stuxnet, ok sure technically it was a compiled payload, but you get what i mean.

ʂɋuïrŁỾ ŵҺÍƦƪƴ


I wonder if cyberwarfare like this will ever have any kind of 'rules' and treaties for it like nukes do

Unlikely. People, countries can just say they didn't do it.


Glad this video is back up after the fake copyright claim


Incredible video as always Sam and team! 👏


Fantastic job on explaining Stuxnet!!<br>Love it!

Fantastic job on explaining Stuxnet!!
Love it!


Wow! That was depressing....and informative at the same time!


Even thought I was familiar with the story, the presentation was riveting and entertaining


dude!  been a fan of your work since you began ... and this is one of your best (and im in IT/cyber)   nice work!


One of the most intriguing, alarming, and entertaining infotainment videos I have ever seen!


All your video’s are great, but this one was excellent 👌


Cyberwarfare/espionage could be a really cool premise for a strategy based videogame.


Humans for 10,000 years:
Step 1: develop something to bring man kind forward in its development and to improve the lives and welfare of the whole world.
Step 2: develop a way to defend against it as someone has turned it into a weapon.
Repeat....

Why be an innovator when you can be a parasite who destroys well-meaning things, right?

@monkeyboy600 yes, most nuclear power plants run on enriched uranium.

Do you think a Uranium enrichment plant is well-meaning?


Fantastic work.  Terrifying,  but not unexpected.


I like this video, but the Shadow Brokers only released a very small part of the tools they had access to, but was only able to release a handful out of 100's.


I learned about stuxnet 5 hours ago from a podcast recorded over a month ago. I clicked the thumbnail to this video curious how some cyberwarfare happens so that I could maybe understand more about stuxnet. But I was not prepared. Thanks for double breaking my brain, good work.


Walked into this video thinking "My country (Iran) has been in a cyberwar for years now, I wonder if this video will mention anything about it" and found out that at least one of my two computers is infected because of it.

Hmm, I /wonder/ who could be behind this


I love all the stock footage. It's absolutely hilarious to look at.


I believe we can no longer ignore that we live(d) in a very special frontier of the internet, but that going forward the human species will probably not be able to use this technology like we do for to much longer; between cyber attacks, increasingly likely solar flares destroying infrastructure, the climate and migrant crisis’ etc.


2:18 "This new era [of cyberwarfare] was made possible, and perhaps more importantly, made profitable by-" I really thought that was gonna be the most unlikely ad transition I've ever heard.


3:30 maybe this is a bit philosophical and pedantic (a la "a tree falls down in the woods"), but I think your definition of zero day is a bit unusual. I don't think zero day means "all vulnerabilities that exist in a technology" it means "any vulnerability which has been discovered by a researcher." Since most people only learn of a zero day exploit once it has been used in an attack and researchers have noticed and named it, "zero day" has come to mean "new attack pattern that just made its debut." This better suits the etymological origin anyway. "It has been 0 days since [disastrous thing happened]."

3:30 maybe this is a bit philosophical and pedantic (a la "a tree falls down in the woods"), but I think your definition of zero day is a bit unusual. I don't think zero day means "all vulnerabilities that exist in a technology" it means "any vulnerability *which has been discovered* by a researcher." Since most people only learn of a zero day exploit once it has been used in an attack and researchers have noticed and named it, "zero day" has come to mean "new attack pattern that just made its debut." This better suits the etymological origin anyway. "It has been 0 days since [disastrous thing happened]."

More accurately it's "any vulnerability which is unknown to the developers" - the idea being that once the vulnerability is known, its value starts to diminish over time ('n'-day vulnerabilities).

A 1-day vulnerability might still be missing an official patch, widely unknown, and as such invaluable in the right hands.

A 7-day vulnerability's probably patched, worthless vs. security-conscious targets, but valuable for other uses. Depending on the software in question there could be a vast quantity of old installations runninng.

A 500-day vulnerability is pretty much worthless. (Well... I say that, but if I recall correctly the ransomware attacks that devastated some public health systems a few years back were using ancient exploits... the hackers had made it on the cheap, and were just kinda shotgunning it around hoping to hit something. Turned out a bunch of hospitals still had their entire networks running Windows XP hahaha)


I just finished This is How They Tell Me the World Ends a couple weeks ago. Absolutely worth the read.


Wendover is dropping so really good videos!


FYI, the reason those centrifuges are so fickle ( said around 9:47) is because of the precise balancing and precision you need on the bearings to separate Uranium 235 from 238. They need an air layer in the bearings (because mechanical bearings with an oil layer can't go to high enough RPM and aren't precise enough) I.E. gas or magnetic bearings to work correctly which need final tuning to make the system run correctly. It would be incredibly easy to just change 1 or 2 parameters that would make a mag bearing system rotate out of orbit and they can literally tear themselves apart if you wanted it to. Stuxnet running at bad RPM ranges likely caused the motors and bearing stators to run at bad efficiency (creating a lot more heat) which can "cook" your mag bearings, motor, and stator by basically annealing the laminar sheets of steel and changes their characteristics (which also removes their magnetism and makes them run horribly). This would likely do this to the motor stator and rotors as well.


8:53 the claim that 58% of computers in Iran were infected is inaccurate. 58% of infected computers were found in Iran, which is a very different thing.

@巫女みこメガネ ok, you have excellent English my guy

@Navyseal168 the same as this video: the Wikipedia article on Stuxnet. The article has a table listing affected countries, and "Share of infected computers" for each country. The creator of this video misinterpreted this as "amount of computers infected from the total amount of computers in that country", when in actuality, the table lists "amount of computers in that country from the total amount of known infected computers".


But the real question is: How would this affect airline logistics?


I enjoyed the difference in content, this should somehow be extended into multiple related videos


It was very very interesting ,I enjoyed a lot . I shall repeat watching this video over and over again. Thank you.


Basically "I have no mouth, but I must scream" is closer to reality now.


A lot of this is focused on Western and Russian cyber but you completely ignored the frets and depth of Chinese government sponsored cyber attacks for corporate espionage. The Iran incident did not open Pandora's box it was already happening.


My biggest takeaway from this video: Don't use Windows for mission critical systems. 😆


As a D.C. native, I smiled when I saw the stock footage of my hometown in the video.  Great work!!


Great video and coverage of a complex and engrossing topic. The 2016 documentary zero days is also a very interesting watch on the stuxnet.


While I could be a smart ass and say that this is expected due to running Windows.
I will say that while nothing is infallible, you do increase the cost vs risk factor drastically by making the government actors have to fight Linux or even harder, BSD.
Of course at that point their next step is to say "sod it" and they start fudging with hardware in transit (The Cisco switch firmware switchout a while back) to get around it.

But I still think the faster you throw the Windows machines in the bin, the harder you are going to make it for them.


BTW PLCs have capability to be configured in such a way that  USB cannot to be inserted in the host (similar PCs)<br>Some PLCs have/had keys that disable write capabilities unto the system (the older the model the higher the chance this is true)

BTW PLCs have capability to be configured in such a way that  USB cannot to be inserted in the host (similar PCs)
Some PLCs have/had keys that disable write capabilities unto the system (the older the model the higher the chance this is true)


Thank you for making me weeping in my own room out of fear on a Tuesday afternoon. Thank you.


The so called "Trusted Computing" chip is one big backdoor integrated into most mainboards... Microsoft is not really hiding the fact that their goal is to be able to remotely control/shut off every machine in the world, and most companies are switching to their "cloud platform" to make it even easier to accomplish.


What's also worrying is that the world is connected by dozens of mutual defence and arms treaties all based on conventional warfare. However, how cyberwarfare fits in. If a Russian cyberattack begins shutting down Polish electrical grids or knocking Romanian airports down, is that enough to declare Article 5? Could a World War start because of the legal unknowns of this new era? This whole new dimension of warfare could have some powerful consequences and runaway effects.<br>Remember, WWI started because of the assassination of a regional power by a minor nation-state. It only takes one small mistake to bring the whole world in.

What's also worrying is that the world is connected by dozens of mutual defence and arms treaties all based on conventional warfare. However, how cyberwarfare fits in. If a Russian cyberattack begins shutting down Polish electrical grids or knocking Romanian airports down, is that enough to declare Article 5? Could a World War start because of the legal unknowns of this new era? This whole new dimension of warfare could have some powerful consequences and runaway effects.
Remember, WWI started because of the assassination of a regional power by a minor nation-state. It only takes one small mistake to bring the whole world in.


Zero Day doesn’t refer to the software flaw itself, it refers to the small window of time between when it is discovered and when it it publicly announced. This is when it’s most valuable, because it can basically be exploited at will, because no one even know s to look out for it yet. So any flaw, no matter how major or minor, can be called a Zero Day during this limited timeframe. It doesn’t depend on complexity, just how widely known is it.


I think you misunderstood the concept of zero-day.

Zero-day usually refers to the day a software is patched and by looking at modifications people can narrow the search space for vulnerabilities.


I love how the idiots who wanted to destroy that nuclear program decided the best idea was to cause a radiological spill, because you know, that can't possibly do anywhere near the most harm.


I knew what this is about from the first 30 seconds of the video and still enjoyed it. Great job.


Holy shit! One thing I could see happening is if infrastructure gets shut down, we're gonna see just how closely you can work with your neighbors.


The timing on this release is perfect, given we have CCDCOE operation Locked Shields 2022 going on right now!


I don’t think you’re giving developers enough credit. It’s not so easy to develop such widespread devastating viruses as you’re saying at the end there. Not with modern security practices. Finding 4 zero days that can work together in the modern day is basically impossible.


Stuxnet! I’ve always found this intriguing, I wish you had gone into a bit more detail about Stuxnet but it was still a great video!


This is probably the best structured, narrated and researched video i have ever seen on anything. Just free for everyone. Thank you very much Wendover. You are amazing.


I was caught In the middle of a railroad track (thunder)

I looked 'round And I knew there was no turning back (thunder)

My mind raced And I thought, what could I do? (Thunder)

And I knew There was no help, no help from you (thunder)

Sound of the drums Beating in my heart

The thunder of guns Tore me apart

You've been... Thunderstruck!
:D


Haven’t been so early on a Wendover video! Getting some popcorn, and staring it! Cheers from Japan!

@Florian Schneider still to early t9 sleep! Lol

@Florian Schneider Imagine asking why are they still awake like is that against the law?

isn't it about one o'clock in the morning in Japan? What are you still doing here?


Thanks, love your content, thanks also for the referral of RealLifeLore I finally signed up for Curiosity Stream annual bundle. I might buy some shares tomorrow, Be an owner, not just a consumer, right? Thanks.


Hacker: Hey, we found some bugs you might want to know about.
Big tech: We sue.

Later:

Hacker: I'ma post bugs on the forums cuz I don't want to be sued.
Security company: Yoink!

Also Security company: Hey, we found some bugs you might want to know about.
Big tech: We buy.

Hacker: Hey, we found some bugs you might want to know about.
Big tech: We sue.

Later:

Hacker: I'ma post bugs on the forums cuz I don't want to be sued.
Security company: _Yoink!_

Also Security company: Hey, we found some bugs you might want to know about.
Big tech: We buy.


3:13 "While the math behind encryption may be infallible..." camera pans to someone wearing the ugliest footwear ever known to mankind "...people are NOT" Video editor is awesome, give the dude a raise!

3:13 _"While the math behind encryption may be infallible..."_ camera pans to someone wearing the ugliest footwear ever known to mankind _"...people are NOT"_ Video editor is awesome, give the dude a raise!


I strongly recommend ‘This is How They Tell Me the World Ends: The Cyber-Weapons Arms Race’ by Nicole Perlroth


The scariest thing about cyberwarfare is that, unlike conventional warfare, there is no consistent way to attribute a cyberattack to a specific nation-state. This gives countries a bit of plausible deniability that locks up the traditional mechanisms of international law and the law of war.


Hell yeah. I love watching a video about why my laptop just self destructed.


I’m still determined to have a good day even when having just taken in some extremely troubling information


It’s interesting how US cyber warfare seems to be less active, but at the same time more advanced


This has got to be up there with the best videos you've evert made! Fucking insane and glued till the end


It used to be that zero-day vulnerabilites were immediately disclosed as the bad guys had them, and the more people who knew about them, the better they could change the security posture. However, the banks and Apple didn't like not having "advanced notice", so they changed to the current model, where severe bug may be unpublished for a period of time while the vendor makes corrections, rather than launching into a 90-day sprint to solve a Heartbleed bug.


During a hot war, the more direct tools (missiles, special forces, good ol' amroured columns) are still producing results faster.


Disrupting a country's development of nukes wasn't all that bad though, considering the alternative was an invasion to stop their nuclear program, or let another unhinged power gaining access to nuclear weapons.


All I have to say is you're so good. Keep making greats videos.


You have a major error at 1:35.  The correct statement is, "60% of all computers with Stuxnet were located in Iran", NOT "60% of all of Iran's computers were infected".


Strange. You can tell by the end product of the centrifugation process if something changed. Also, a worker who's been there for a few years can even hear, if a centrifuge is not running properly.


It could be scary to launch your own nukes. What if a hacker swapped out the "launch" command with the "detonate" command.


2:17 don't tell me you weren't expecting the sentence to go "This new era was made possible by Skillshare"


I remember simply putting an empty read only autorun.inf file on USB drives was enough to prevent the spread of these widespread viruses on Windows XP. Thankfully this stupid auto run 'feature' was removed from later versions of Windows for USB drives.


This makes me feel like internet security is a pointless endeavor for the average citizen. Not meaning basic security practices like changing password often but all these other security tools being sold to us these days.


You guys finally made a Stuxnet video!!! 😍😍 every software geek is overjoyed rn


I love Wendover. That's all I have can say.


"This new era was made possible" my brain finished the sentence "with skillshare" you've ruined me


The book called Countdown to Zero Day by Kim Zetter goes very in depth about this. One of my favorite books


Is definitive, Sam has a jornalist training, the way he narrates any topic is very engaging.


It's looking more and more like worthless hype with every passing day. Cybersecurity is easily winning. Face it, human conflict is about aggression, which is bad. Isn't there something better than being fascinated with it?


Fun fact: the hex numbers in the thumbnail spell out "WENDOVER" when converted to ASCII


Thanks for this great deep dive, there is nothing about Stuxnet that doesn't intrigue me.


that stuxnet virus is insane, that's like straight out of mr.robot


Its important to remember that every age in human history has had its own unique challenges. A couple hundred years from now we'll be laughing about how trivial cyber security is as we focus on the next big problem to deal with, and the one after that, and the one after that.

@Fred Riddles Depends on whether the world is still under the rule of a handful of rich industrialists or whether workers have sorted their shit out and taken control by then.

@DDM Acc My point is that conflict is a natural part of human existence. People like to hype up cyber threats like they are this big and scary thing, and they can be, but this is the price we pay for living in the 21st century and enjoying all its luxuries. You can either make peace with this fact or waste your time wishing you were back in the dark ages where cyber security wasn't an issue, but the internet didn't exist and we didn't have programs to deal with complex computational issues.

New problems will always be springing up while old problems continually die. Cyber security is the newest of problems, we just have to keep a cool head and work towards a solution while enjoying what we have now.

I dont think it will ever be trivial. People dont want to be spied on


i gotta say this somewhere now.
ALL THE TIME i hear about curiosity stream and Nebula and id LOVE to go there but I just cant.
Not everyone has a credit card. Its so taunting to hear it and want it but needing a stupid credit card in the middle.
Same goes for gift cards. You cant get them without credit card. Which century is this?


Reading This Is How They Tell Me The World Ends right now! Great recap! If you’re interested in more, that’s the place to go. Almost exactly that.


It works by one dude saying “I’m gonna get into the system” and another dude saying “no you won’t”