You found a bug
You are a hacker. You find a flaw in the iPhone. With it, you can take full control of any iPhone without a click from the owner. Nobody else knows about it yet. Who do you give it to?
Follow the price
Move the slider through the years. Watch the price of one top exploit. The bars use a log scale, so each step up is roughly ten times more money.
The exploit market. At first, companies such as iDefense paid a few hundred dollars per bug, and software makers called them extortionists. Then governments joined. A hacker named Charlie Miller sold an exploit to the US government and later wrote openly about the deal. That paper showed everyone that a market existed.
Brokers such as Vupen in France, and later Zerodium, made the market professional. They published price lists, and they sold to governments. The phone became the top target, because the phone holds a person's whole life.
Keep it or tell?
You are now a US spy agency. You hold six zero-days. For each one, decide. Keep it secret and use it to spy, or tell the software maker so it gets fixed for everyone. Then jump forward to 2016.
The Vulnerabilities Equities Process (VEP). On paper, the US government weighs each flaw. Does the spy value beat the risk to the public? The book argues that in practice, the agencies kept most of the valuable flaws, and almost nobody outside could check.
The Shadow Brokers. In 2016 a mystery group started to post NSA hacking tools online. Some still worked against unpatched systems. The agency's secret stock of flaws became everyone's stock.
The perfect sabotage
You are an engineer at an Iranian nuclear site. Your screen shows the uranium centrifuges. Press start. Then switch the view to see what the machines really do.
Stuxnet, part of a US–Israeli operation called Olympic Games. The worm used several zero-days to reach machines with no internet link. It changed the rotor speed, up to about 1,410 Hz and down to about 2 Hz, while it played normal readings back to the operators. Iran's engineers blamed parts and staff, not code.
In 2010 the worm escaped Iran and spread across the world, and researchers took it apart. The book treats this as a turning point. The US had shown that code can break physical things. Iran, Russia, China and North Korea took note, and started to build their own.
The boomerang
Follow one NSA tool from creation to disaster. Click each step, or use Next.
Blowback. A weapon that is code can be copied. Once it leaks, any attacker can re-use it, against anyone, including the country that built it. The book opens in Ukraine after NotPetya because it shows this pattern clearly.
Who lives in a glass house?
Pick a country. Compare its attack skill with how much of its life runs on networks. The scores are our rough illustration of the book's argument, not official data.
The glass house. The US has the best offence. But its banks, grid, hospitals, water plants and elections all run on software. A country such as North Korea has almost nothing to hit. So in a cyber fight, the strongest attacker can also be the biggest target. The book argues that the US spent on offence while it left its own defence weak.
The players
The book moves around the world. These are the main actors. Filter by type.
Timeline
Click an event to open it.
Strengthen the glass
The book ends with what to do. Most attacks do not need a $2 million zero-day. They use old, known flaws and weak passwords. Tick what you already do.
- Build software that is secure from the start, and hold vendors responsible for unsafe code.
- Disclose more zero-days so they get fixed. Make the keep-or-tell process more open.
- Protect the systems that people need to live: grids, hospitals, water, elections.
- Agree international rules, such as no attacks on civilian infrastructure, in the way that countries made rules for other weapons.
- Control who can sell exploits and spyware, and stop sales to governments that hunt journalists and activists.
- Make defence the first priority, ahead of offence.