Nicole Perlroth

So you can see the immense value a single zero-day exploit would have for a spy agency. And indeed, there is an entire classified gray market for zero days, where hackers routinely sell their zero-day exploits to governments or brokers for hundreds of thousands, sometimes millions of dollars.

So you can see the immense value a single zero-day exploit would have for a spy agency. And indeed, there is an entire classified gray market for zero days, where hackers routinely sell their zero-day exploits to governments or brokers for hundreds of thousands, sometimes millions of dollars.

The going rate for that zero-day exploit I just described in your iPhone, right now, at this very minute, a Saudi broker's offering $3.5 million for it. And if it's really good, so good the target wouldn't have to so much as click to get infected, that same broker will pay you $9 million. And if this market sounds titillating, I get it.

The going rate for that zero-day exploit I just described in your iPhone, right now, at this very minute, a Saudi broker's offering $3.5 million for it. And if it's really good, so good the target wouldn't have to so much as click to get infected, that same broker will pay you $9 million. And if this market sounds titillating, I get it.

I spent seven years investigating the zero-day market for my book. This is how they tell me the world ends. You should read it. But for now, what you need to know is that before 2015, it was incredibly rare that you would find a zero-day in a Chinese APT attack. Google's Aurora hackers used a Microsoft zero day to break in, but that was an exception.

I spent seven years investigating the zero-day market for my book. This is how they tell me the world ends. You should read it. But for now, what you need to know is that before 2015, it was incredibly rare that you would find a zero-day in a Chinese APT attack. Google's Aurora hackers used a Microsoft zero day to break in, but that was an exception.

Finding and exploiting zero days is incredibly difficult. It can take months, years even, to hone a flawless zero day. And even if you can manage that, rarely would you actually use it. There's a saying in the intelligence world, you use it, you lose it. Nobody is willing to risk earning a multi-million dollar zero day when they can just as easily break in through a rudimentary phishing attack.

Finding and exploiting zero days is incredibly difficult. It can take months, years even, to hone a flawless zero day. And even if you can manage that, rarely would you actually use it. There's a saying in the intelligence world, you use it, you lose it. Nobody is willing to risk earning a multi-million dollar zero day when they can just as easily break in through a rudimentary phishing attack.

In fact, when my book came out in 2021, I got a ton of flack from industry critics who said, Nicole, why'd you focus so heavily on the zero-day market when the vast majority of these attacks start with phishing? And to be fair, they had a good point. But even I was surprised when that same year, a record number of zero-days cropped up, the most serious of them in Chinese cyber attacks.

In fact, when my book came out in 2021, I got a ton of flack from industry critics who said, Nicole, why'd you focus so heavily on the zero-day market when the vast majority of these attacks start with phishing? And to be fair, they had a good point. But even I was surprised when that same year, a record number of zero-days cropped up, the most serious of them in Chinese cyber attacks.

So there's clearly been a sea change here. But tell me what it looked like from your vantage point.

So there's clearly been a sea change here. But tell me what it looked like from your vantage point.

the top down. Really, in retrospect, what the CCP took from Washington's threats and the naming and shaming campaign wasn't to stop hacking, but to move it underground. And Zero Days offered the perfect cover. When nobody knows about the existence of your secret tunnel, you can move in and out as you please.

the top down. Really, in retrospect, what the CCP took from Washington's threats and the naming and shaming campaign wasn't to stop hacking, but to move it underground. And Zero Days offered the perfect cover. When nobody knows about the existence of your secret tunnel, you can move in and out as you please.

And part of the reason the CCP was suddenly so willing to burn so many zero days is that they had plenty of them to burn. And how they acquired their stash is just another window into the advantage authoritarians have in the digital realm. You see, here in the West, intelligence agencies have to develop zero days in-house or pay six, seven figures to procure them from hackers on the gray market.

And part of the reason the CCP was suddenly so willing to burn so many zero days is that they had plenty of them to burn. And how they acquired their stash is just another window into the advantage authoritarians have in the digital realm. You see, here in the West, intelligence agencies have to develop zero days in-house or pay six, seven figures to procure them from hackers on the gray market.

That's not the case in China, where the CCP can simply force hackers to turn them over for free. And that's exactly what happened. Beijing started hoarding its own zero days, eliminating any above or below ground market for them in China. Authorities abruptly shuttered China's best known platform for reporting zero days.

That's not the case in China, where the CCP can simply force hackers to turn them over for free. And that's exactly what happened. Beijing started hoarding its own zero days, eliminating any above or below ground market for them in China. Authorities abruptly shuttered China's best known platform for reporting zero days.

They arrested its founder and they started forcing China's hackers to turn over their best finds. Here's Jim Lewis, longtime liaison on All Things China.

They arrested its founder and they started forcing China's hackers to turn over their best finds. Here's Jim Lewis, longtime liaison on All Things China.