Hackers Linked to China Breach U.S. Internet Providers

[00:00:00] [SPEAKER_01]: Exchanges, the Goldman Sachs podcast featuring exchanges on the forces driving the markets

[00:00:06] [SPEAKER_01]: and the economy.

[00:00:07] [SPEAKER_01]: Exchanges between the leading minds at Goldman Sachs.

[00:00:11] [SPEAKER_01]: New episodes every week.

[00:00:13] [SPEAKER_01]: Listen now.

[00:00:19] [SPEAKER_04]: Welcome to Tech News Briefing.

[00:00:20] [SPEAKER_04]: It's Friday, September 27th.

[00:00:23] [SPEAKER_04]: I'm Zoe Thomas for The Wall Street Journal.

[00:00:26] [SPEAKER_04]: Tech companies are paying huge sums for artificial intelligence technology and talent.

[00:00:32] [SPEAKER_04]: But Google's deal to rehire Noam Shazir stands out.

[00:00:37] [SPEAKER_04]: We'll tell you what's behind it and what it could mean for Google's AI ambitions.

[00:00:43] [SPEAKER_04]: And then...

[00:00:43] [SPEAKER_04]: China-linked hackers broke into a handful of U.S. internet service providers in recent

[00:00:49] [SPEAKER_04]: months, according to people familiar with the matter.

[00:00:51] [SPEAKER_04]: And it's just the latest intrusion by groups linked to Beijing.

[00:00:56] [SPEAKER_04]: Our reporter Robert McMillan will join us to explain what they were after and why it's

[00:01:01] [SPEAKER_04]: got U.S. officials so worried.

[00:01:06] [SPEAKER_04]: We're starting with Google's pricey reunion with Noam Shazir.

[00:01:11] [SPEAKER_04]: Shazir, one of Google's first few hundred employees, left the company in 2021 after

[00:01:16] [SPEAKER_04]: the search giant refused to release a chatbot he developed.

[00:01:20] [SPEAKER_04]: He founded an AI startup called Character AI, which allows users to create and interact

[00:01:26] [SPEAKER_04]: with chatbots that can provide practical advice or mimic celebrities like Elon Musk and fictional

[00:01:32] [SPEAKER_04]: characters like Percy Jackson.

[00:01:34] [SPEAKER_04]: Character was valued at $1 billion in 2023, but looking for more funding this year, the

[00:01:40] [SPEAKER_04]: startup reached a deal with Google.

[00:01:43] [SPEAKER_04]: According to people with knowledge of the deal, the tech giant wrote a check for about

[00:01:47] [SPEAKER_04]: $2.7 billion to license Character's technology.

[00:01:52] [SPEAKER_04]: And Shazir agreed to work for Google again.

[00:01:56] [SPEAKER_04]: Here to tell us more is our reporter Myles Krupa.

[00:01:59] [SPEAKER_04]: Myles, tell us about this deal and what exactly Google is paying for.

[00:02:04] [SPEAKER_01]: Yeah, so it's not the first deal like this since the AI boom.

[00:02:08] [SPEAKER_01]: Microsoft and Amazon have also done similar things where basically they go to one of these

[00:02:15] [SPEAKER_01]: AI companies that's independent, that's trying to build its own technology, and they say,

[00:02:21] [SPEAKER_01]: hey, you have some really talented people.

[00:02:24] [SPEAKER_01]: You've also clearly put a lot of work into the technology.

[00:02:26] [SPEAKER_01]: How about we license the technology and hire some of these talented executives?

[00:02:33] [SPEAKER_01]: It's sort of viewed in Silicon Valley as a way of acquiring the companies without acquiring

[00:02:39] [SPEAKER_01]: them because we're now in this environment where the FTC and the DOJ are cracking down

[00:02:45] [SPEAKER_01]: on big tech companies' acquisitions.

[00:02:48] [SPEAKER_01]: So, you know, effectively that's what Google did here with Gnome is Gnome wanted to do

[00:02:55] [SPEAKER_01]: more research.

[00:02:57] [SPEAKER_01]: He didn't want to stick with Character and see that company through its 10-year-plus

[00:03:02] [SPEAKER_01]: journey.

[00:03:03] [SPEAKER_01]: And so Google came to Gnome and Character and they worked out a deal where Google's

[00:03:09] [SPEAKER_01]: paying Character about $2.7 billion and Gnome and about 30 other people agreed to join

[00:03:15] [SPEAKER_01]: Google.

[00:03:16] [SPEAKER_04]: What has Gnome Shazir said about his return?

[00:03:19] [SPEAKER_01]: He hasn't said much.

[00:03:20] [SPEAKER_01]: He released a statement when the deal was announced basically saying this deal sets up

[00:03:26] [SPEAKER_01]: Character to continue as an independent company.

[00:03:29] [SPEAKER_01]: What's been interesting is what people inside Google have been saying, and especially

[00:03:34] [SPEAKER_01]: people like Sergey Brin, who as far as we understand was instrumental in bringing Gnome

[00:03:39] [SPEAKER_01]: back to the company.

[00:03:41] [SPEAKER_01]: Sergey at a conference recently when asked about how Google is trying to sort of catch

[00:03:46] [SPEAKER_01]: up in this AI race, just sort of brought up without any prompting that by the way Gnome

[00:03:51] [SPEAKER_01]: is back at Google.

[00:03:52] [SPEAKER_01]: Which just shows how important they view him to their whole AI strategy.

[00:03:57] [SPEAKER_04]: Miles, put this deal into context for us relative to other AI deals right now.

[00:04:03] [SPEAKER_01]: Yeah, you know it's not uncommon for top AI talent to get employment contracts worth

[00:04:09] [SPEAKER_01]: potentially $10 million, $20 million when you include stock options.

[00:04:14] [SPEAKER_01]: And some of these other deals like Microsoft and Amazon's deals, we understand that they

[00:04:19] [SPEAKER_01]: paid licensing fees in the hundreds of millions of dollars.

[00:04:23] [SPEAKER_01]: This is $2.7 billion.

[00:04:25] [SPEAKER_01]: As part of that, Gnome himself is getting hundreds of millions of dollars from his stock

[00:04:31] [SPEAKER_01]: and character as we understand.

[00:04:33] [SPEAKER_01]: So the scale here is slightly different.

[00:04:35] [SPEAKER_01]: It really speaks to how important Google viewed Gnome and some of these people who were

[00:04:42] [SPEAKER_01]: coming over.

[00:04:43] [SPEAKER_04]: And do we know how Google's strategy might change now that he's returned?

[00:04:48] [SPEAKER_01]: Well, Gnome is obsessed with scaling up these large language models, making them bigger

[00:04:53] [SPEAKER_01]: and more capable.

[00:04:54] [SPEAKER_01]: And that's something that Google's been doing.

[00:04:56] [SPEAKER_01]: But Gnome, just from talking to people who know him, is particularly creative in sort of

[00:05:01] [SPEAKER_01]: the engineering work it takes to get these large language models to work in practice.

[00:05:07] [SPEAKER_01]: You know, it's sort of a delicate dance getting from zero to one, building these sorts of

[00:05:14] [SPEAKER_01]: technology systems from the ground up.

[00:05:16] [SPEAKER_01]: And Gnome is particularly good at that messy middle of getting from zero to one.

[00:05:21] [SPEAKER_04]: All right. That was our reporter, Miles Krupa.

[00:05:24] [SPEAKER_04]: Coming up, multiple hacking campaigns have broken into core U.S.

[00:05:29] [SPEAKER_04]: infrastructure. We'll tell you who officials say is behind the cyber attacks after the

[00:05:35] [SPEAKER_02]: break. AI may be the most important new computer technology ever, but AI needs a lot of

[00:05:45] [SPEAKER_02]: processing speed and that gets expensive fast.

[00:05:48] [SPEAKER_02]: Upgrade to the next generation of the cloud, Oracle Cloud Infrastructure or OCI.

[00:05:53] [SPEAKER_02]: OCI is the single platform for your infrastructure, database, application development and

[00:05:58] [SPEAKER_02]: AI needs. Do more and spend less like Uber, 8x8 and Databricks Mosaic.

[00:06:04] [SPEAKER_02]: Take a free test drive of OCI at oracle.com slash Wall Street.

[00:06:08] [SPEAKER_02]: Oracle.com slash Wall Street.

[00:06:10] [SPEAKER_04]: A hacking campaign linked to the Chinese government has broken into a handful of U.S.

[00:06:21] [SPEAKER_04]: Internet service providers people familiar with the matter say.

[00:06:24] [SPEAKER_04]: The attack, which took place in recent months, hasn't been previously publicly disclosed, but U.S.

[00:06:30] [SPEAKER_04]: officials have spoken about two similar attacks they disrupted this year.

[00:06:35] [SPEAKER_04]: Here to tell us more is our reporter Robert McMillan.

[00:06:38] [SPEAKER_04]: Bob, this latest attack is being called Salt Typhoon by investigators.

[00:06:44] [SPEAKER_04]: And as I mentioned, it's not the first of its kind.

[00:06:46] [SPEAKER_04]: What are investigators particularly concerned about with this hacking campaign?

[00:06:51] [SPEAKER_00]: There have been a couple of typhoons actually over the last few years.

[00:06:55] [SPEAKER_00]: There's Volt Typhoon, which was an effort, you know, allegedly by the Chinese to build a botnet

[00:07:02] [SPEAKER_00]: largely on the back of consumer routers.

[00:07:04] [SPEAKER_00]: And then there was just last week, there was an announcement about Flax Typhoon, which was

[00:07:09] [SPEAKER_00]: another botnet, which is, you know, these are networks of infected computers built on

[00:07:14] [SPEAKER_00]: Internet of Things type devices.

[00:07:17] [SPEAKER_00]: Now we got Salt Typhoon and that looks like it's more at the sort of infrastructure level.

[00:07:25] [SPEAKER_00]: People are very concerned that this campaign may have gone into sort of the core routers that

[00:07:29] [SPEAKER_00]: are used to exchange information on the Internet.

[00:07:33] [SPEAKER_00]: And that's a very powerful position to be if you're a hacking adversary.

[00:07:39] [SPEAKER_00]: There are a lot of things you can do when you're in the center of the Internet that you

[00:07:43] [SPEAKER_00]: couldn't do otherwise.

[00:07:44] [SPEAKER_04]: Tell us a little bit more about how intrusions like this work.

[00:07:49] [SPEAKER_00]: We don't actually know how the Salt Typhoon intrusion began.

[00:07:53] [SPEAKER_00]: The details of what happened are still being worked out, quite honestly.

[00:07:57] [SPEAKER_00]: But increasingly over the last few years, the Chinese in particular, but hackers in

[00:08:03] [SPEAKER_00]: general, have increasingly leveraged just regular old credentials, you know, your

[00:08:10] [SPEAKER_00]: usernames and passwords.

[00:08:12] [SPEAKER_00]: In the olden days, everyone was looking for what's called a zero day, like a previously

[00:08:17] [SPEAKER_00]: unknown flaw that you can aim at a computer and that'll get you connected to it and get

[00:08:22] [SPEAKER_00]: you onto that computer.

[00:08:23] [SPEAKER_00]: The attacks of late have been, I guess, more pedestrian, you could call it.

[00:08:28] [SPEAKER_00]: They look for easy to guess usernames and passwords or they'll use password stealing

[00:08:32] [SPEAKER_00]: software and just steal a bunch of passwords and usernames and then go from there to try

[00:08:38] [SPEAKER_00]: and see if they can break into systems.

[00:08:40] [SPEAKER_04]: And you mentioned these other typhoons, Flax Typhoon and Vault Typhoon.

[00:08:44] [SPEAKER_04]: Do we know how this latest one, Salt Typhoon, compares to these earlier breaches?

[00:08:50] [SPEAKER_00]: Well, these typhoon names are, they're invented by Microsoft and they're basically,

[00:08:54] [SPEAKER_00]: typhoon means that they think it's from China.

[00:08:57] [SPEAKER_00]: With the Vault Typhoon campaign, there are a lot of concerns that that was about disrupting

[00:09:02] [SPEAKER_00]: infrastructure and maybe a pre-positioning cyber event before some kind of attack.

[00:09:07] [SPEAKER_00]: So if Taiwan got attacked, maybe the Vault Typhoon points of presence would be used to

[00:09:12] [SPEAKER_00]: make it difficult for Taiwan and its allies to communicate and to effectively mount a

[00:09:19] [SPEAKER_00]: response to an attack.

[00:09:20] [SPEAKER_00]: The Flax and the Salt Typhoon, people are worried that these are like more about

[00:09:27] [SPEAKER_00]: gathering information, intelligence collection.

[00:09:31] [SPEAKER_00]: So slight difference between the two there.

[00:09:33] [SPEAKER_04]: Do we know any more about who might be behind this specific attack, Salt Typhoon?

[00:09:38] [SPEAKER_00]: People think this attack is out of China and related to intelligence collection.

[00:09:43] [SPEAKER_00]: And the organization within China that would be most likely to be behind that would be

[00:09:47] [SPEAKER_00]: the Chinese Ministry of State Security, which has a sort of a hacking operation that's

[00:09:53] [SPEAKER_00]: called APT40 that's been linked to all kinds of cyber espionage activity for years now.

[00:09:59] [SPEAKER_04]: And what has China said about these attacks?

[00:10:02] [SPEAKER_00]: The spokesman for the Chinese embassy in Washington said that U.S.

[00:10:07] [SPEAKER_00]: spy agencies and cybersecurity firms are, quote, secretly collaborating to piece together

[00:10:12] [SPEAKER_00]: false evidence blaming the Chinese government for cyber attacks against the U.S.

[00:10:16] [SPEAKER_00]: China routinely denies these kinds of allegations.

[00:10:20] [SPEAKER_04]: All right, China has denied it, but what does the U.S.

[00:10:22] [SPEAKER_04]: say China's motivation is for backing these kinds of hacks?

[00:10:26] [SPEAKER_00]: Traditionally, China has been accused of just stealing intellectual property.

[00:10:31] [SPEAKER_00]: That was like the first big wave of China hacks where people breaking into U.S.

[00:10:37] [SPEAKER_00]: corporations, stealing IP that allowed Chinese competitors to clone products that were

[00:10:44] [SPEAKER_00]: made in the United States and get a leg up competitively.

[00:10:47] [SPEAKER_00]: Lately, there have been these concerns about China pre-positioning itself for kinetic

[00:10:54] [SPEAKER_00]: cyber attacks. So being in a place where it could disrupt water or telecommunications or

[00:11:01] [SPEAKER_00]: even energy or infrastructure so that if there was some kind of war, that they would be

[00:11:07] [SPEAKER_00]: in a good position to slow us down, like make it hard for us to respond to anything.

[00:11:13] [SPEAKER_00]: This salt typhoon attack is thought to be connected to intelligence collection.

[00:11:19] [SPEAKER_04]: How big of a threat have top officials within the Biden administration said this is?

[00:11:23] [SPEAKER_00]: The U.S. government has described some of these Chinese hacking operations as potentially

[00:11:28] [SPEAKER_00]: life threatening.

[00:11:30] [SPEAKER_00]: So we're not in cyber war here, but in terms of the language coming from U.S.

[00:11:36] [SPEAKER_00]: officials, it's pretty frightening.

[00:11:38] [SPEAKER_04]: That was our reporter Robert McMillan.

[00:11:40] [SPEAKER_04]: And that's it for tech news briefing.

[00:11:42] [SPEAKER_04]: Today's show was produced by Julie Chang.

[00:11:45] [SPEAKER_04]: I'm your host, Zoe Thomas.

[00:11:47] [SPEAKER_04]: We had additional support this week from Trina Menino.

[00:11:50] [SPEAKER_04]: Jessica Fenton and Michael LaValle wrote our theme music.

[00:11:52] [SPEAKER_04]: Our supervising producer is Catherine Millsop.

[00:11:56] [SPEAKER_04]: Our development producer is Aisha Al-Muslim.

[00:11:58] [SPEAKER_04]: Scott Salloway and Chris Dinsley are our deputy editors.

[00:12:02] [SPEAKER_04]: And Felana Patterson is The Wall Street Journal's head of news audio.

[00:12:05] [SPEAKER_04]: We'll be back this afternoon with TNB Tech Minute.

[00:12:09] [SPEAKER_04]: Thanks for listening.

[00:12:15] [SPEAKER_03]: It takes more than just AI to prepare your business for the future.

[00:12:20] [SPEAKER_03]: Your people need the skills to unleash its potential.

[00:12:23] [SPEAKER_03]: GILD's learning and skilling solutions prepare your workforce for business

[00:12:27] [SPEAKER_03]: transformation. Find out how at GILD.com.