1
00:00:13,480 --> 00:00:13,480
Imagine a town built around a single, deep well.

2
00:00:28,260 --> 00:00:32,359
Every morning, the people in this town walk to the well.

3
00:00:32,359 --> 00:00:34,659
They lower their buckets.

4
00:00:34,659 --> 00:00:36,979
They draw the water.

5
00:00:36,979 --> 00:00:38,939
They take it home.

6
00:00:38,939 --> 00:00:40,820
They drink it.

7
00:00:40,820 --> 00:00:43,700
They give it to their children.

8
00:00:43,700 --> 00:00:45,659
They don't test it.

9
00:00:45,659 --> 00:00:47,659
They don't question it.

10
00:00:47,659 --> 00:00:52,939
They just trust it because the water has always been clean.

11
00:00:52,939 --> 00:01:02,740
But what if one night someone crept to the well
and poured poison into the dark water below?

12
00:01:02,740 --> 00:01:05,620
The next morning the water looks the same.

13
00:01:05,620 --> 00:01:07,500
It smells the same.

14
00:01:07,500 --> 00:01:10,819
The bucket feels just as heavy in your hand.

15
00:01:10,819 --> 00:01:14,819
But everyone who draws from the well is compromised.

16
00:01:14,819 --> 00:01:19,260
And no one knows until it's too late.

17
00:01:19,260 --> 00:01:22,939
Every website is just a string of numbers.

18
00:01:22,939 --> 00:01:25,980
Human beings can't remember strings of numbers.

19
00:01:25,980 --> 00:01:29,780
So decades ago, engineers built a directory.

20
00:01:29,780 --> 00:01:33,219
You type a name, gives you an address.

21
00:01:33,219 --> 00:01:36,379
That directory is called DNS.

22
00:01:36,379 --> 00:01:41,700
It stands for Domain Name System.

23
00:01:41,700 --> 00:01:45,299
It is the well that we all draw from.

24
00:01:45,299 --> 00:01:53,299
Until a 29-year-old named Dan Kaminsky realized
that the well had no lid.

25
00:01:53,299 --> 00:01:55,140
I'm Daina Bouquin, and this is Lore in the Machine.

26
00:02:00,099 --> 00:02:04,939
Dan was the kind of person who broke things
just to see how they worked.

27
00:02:04,939 --> 00:02:10,780
When he was 11 years old growing up in San Francisco,
his mother got a phone call.

28
00:02:10,780 --> 00:02:14,740
It was a security administrator for the United States Military.

29
00:02:14,740 --> 00:02:20,060
Her son, the administrator, explained
had just hacked into their network.

30
00:02:20,060 --> 00:02:24,500
And they were going to cut off the family's internet access.

31
00:02:24,500 --> 00:02:26,460
Now his mother didn't panic.

32
00:02:26,460 --> 00:02:31,979
She told the government that she would take out an ad
in the San Francisco Chronicle to announce

33
00:02:31,979 --> 00:02:36,500
that an 11-year-old had defeated
the military's computer security.

34
00:02:36,500 --> 00:02:42,539
So they negotiated a three-day internet
timeout for the boy instead.

35
00:02:42,539 --> 00:02:44,180
Then Dan grew up.

36
00:02:44,180 --> 00:02:47,740
He became a professional security researcher.

37
00:02:47,740 --> 00:02:52,180
And in 2008, he was looking at the internet's directory.

38
00:02:52,180 --> 00:02:56,419
He noticed something that made his stomach drop.

39
00:02:56,419 --> 00:03:03,780
Not a simple bug, a structural weakness
baked into the very foundation of the internet,

40
00:03:03,780 --> 00:03:12,740
a vulnerability that would allow an attacker
to quietly slip false information into the central directory,

41
00:03:12,740 --> 00:03:19,860
to rewrite the map of the web, to redirect your email,
bypass your passwords.

42
00:03:19,860 --> 00:03:27,500
So that when you typed in the name of your bank,
the well would send you somewhere else entirely.

43
00:03:27,500 --> 00:03:31,379
We call this type of attack cache poisoning.

44
00:03:31,379 --> 00:03:37,539
It's a security vulnerability where attackers
can insert fraudulent entries into a cache,

45
00:03:37,539 --> 00:03:42,659
causing the system to return incorrect and malicious data.

46
00:03:42,659 --> 00:03:52,699
What Dan Kaminsky found was a specific type of cache
poisoning that we now call DNS poisoning or DNS spoofing.

47
00:03:52,699 --> 00:04:00,180
When Dan brought this to one of the original architects
of the system, the response was chilling.

48
00:04:00,180 --> 00:04:04,500
Everything in the digital universe
was going to have to get patched.

49
00:04:04,500 --> 00:04:12,740
The loneliness of knowing a secret that enormous.

50
00:04:12,740 --> 00:04:20,060
You are holding a match, standing in a room,
drenched in gasoline, and you cannot tell anyone

51
00:04:20,060 --> 00:04:23,180
why you're afraid to move.

52
00:04:23,180 --> 00:04:25,180
Dan couldn't go public.

53
00:04:25,180 --> 00:04:30,019
If he did, the bad guys would figure it out
before the good guys could fix it.

54
00:04:30,019 --> 00:04:34,779
Instead, he convened a secret meeting.

55
00:04:34,779 --> 00:04:43,339
Picture a windowless conference room
at Microsoft headquarters, 16 people sitting around a table,

56
00:04:43,339 --> 00:04:50,060
executives and engineers from the biggest tech companies
on earth, fierce competitors who had no reason

57
00:04:50,060 --> 00:04:51,939
to trust each other.

58
00:04:51,939 --> 00:05:00,259
And Dan Kaminsky, the kid who once got a three-day time
out from the military, walks to the front of the room.

59
00:05:00,259 --> 00:05:02,660
He opens his laptop.

60
00:05:02,660 --> 00:05:05,579
He connects it to a projector.

61
00:05:05,579 --> 00:05:09,339
And in about 10 seconds, he breaks the internet.

62
00:05:09,339 --> 00:05:16,860
He compromises a server running the software
that controls 80% of global web traffic.

63
00:05:16,860 --> 00:05:24,579
He looks at the people in the room and tells them
he is giving a presentation at a hacker convention in August.

64
00:05:24,579 --> 00:05:27,420
They have until then to fix it.

65
00:05:27,420 --> 00:05:29,980
And the crazy thing is they did.

66
00:05:29,980 --> 00:05:35,980
Competitors worked in absolute secrecy
to build a synchronized global patch.

67
00:05:35,980 --> 00:05:40,019
On July 8, 2008, the patch went out.

68
00:05:40,019 --> 00:05:42,699
The well was locked down.

69
00:05:42,699 --> 00:05:46,339
The world had no idea it was ever in danger.

70
00:05:46,339 --> 00:05:46,339
A few weeks later, Dan gave his presentation at Black Hat.

71
00:05:50,939 --> 00:05:52,980
He wore a sharp suit.

72
00:05:52,980 --> 00:05:59,579
And as someone who always wore sandals,
he had promised his mother he'd wear closed-toed shoes.

73
00:05:59,579 --> 00:06:02,620
He wore roller skates.

74
00:06:02,620 --> 00:06:08,500
A reporter asked him later why he didn't use the flaw
to steal millions of dollars.

75
00:06:08,500 --> 00:06:10,779
Dan said it would have been morally wrong.

76
00:06:10,779 --> 00:06:15,779
And besides, he said, he didn't want
his mother to have to visit him in prison.

77
00:06:15,779 --> 00:06:19,779
His mom, Trudy, was a legend in her own right.

78
00:06:19,779 --> 00:06:23,339
She would show up to these hacker conventions
carrying homemade cookies.

79
00:06:26,860 --> 00:06:34,899
Dan Kaminsky passed away in 2021 at the age of 42
from diabetic ketoacidosis.

80
00:06:34,899 --> 00:06:41,060
When the tributes poured in, people didn't just talk
about the time he saved the digital universe.

81
00:06:41,060 --> 00:06:44,420
They talked about his staggering empathy.

82
00:06:44,420 --> 00:06:47,819
He bought plane tickets for heartbroken friends.

83
00:06:47,819 --> 00:06:51,060
He built apps for the color blind.

84
00:06:51,060 --> 00:06:58,579
He used to say that the internet was never designed
for any of this, just to move pictures of cats.

85
00:06:58,579 --> 00:07:04,379
Nobody planned for humanity to drop trillions of dollars
into it, but we did.

86
00:07:04,379 --> 00:07:12,660
And when people asked what we were supposed to do
about that terrible reality, his answer was simple.

87
00:07:12,660 --> 00:07:16,860
Some of us got to go out and fix it.

88
00:07:16,860 --> 00:07:19,220
Dan didn't just prevent an attack.

89
00:07:19,220 --> 00:07:26,139
He forced the architects of the web
to build a heavy cryptographic lid for the well.

90
00:07:26,139 --> 00:07:33,939
A lock, so vital, that's securing it
would eventually require an elaborate physical ritual.

91
00:07:33,939 --> 00:07:35,819
But that's a story for another day.

92
00:07:38,339 --> 00:07:42,379
Sometimes soon, you will open your browser.

93
00:07:42,379 --> 00:07:48,100
You will drop your bucket into the deep, dark water
of the internet.

94
00:07:48,100 --> 00:07:51,779
And it will be clean.

95
00:07:51,779 --> 00:07:53,540
I'm Daina Bouquin
, and this is Lore in the Machine.