5 ms·

Rise of Darknet Stokes Fear of the Insider

79 points by snowy 10y ago

willvarfar 10y ago
Hard not to imagine a "buy our services!" hidden message in this piece; it's really aimed at budget spenders and not techies.
- thedudemabry 10y ago
  "More serious and expensive offerings apply machine learning to internal human resources (HR) records, and work to discover and infiltrate online crime rings." Their first offering sounds pretty unlikely to yield results and the second seems ethically dubious to undertake for a single client.
  - Bartweiss 10y ago
    If they could turn basic HR records into a detailed threat assessment, they'd be selling that ML breakthrough to everyone in the world rather than pitching online scare stories. I'm betting "apply machine learning to internal... records" looks more like listing the employees with disciplinary records and going "revoke network access from these people".
- Bartweiss 10y ago
  The whole tone of the thing was definitely "Your employees hate you, the darknet is scary, you don't understand technology so pay us!" Like, I get that "disgruntled employee" is less dangerous than "disgruntled employee with expert guidance", but using Tor is already evidence of sophistication. There was nothing stopping these people from going to the library and posting on a normal internet forum, even ten years ago. Similarly, people stealing all your user information in a movie-style hacker coup is just not that common. Someone flipping a circuit breaker and costing you a bunch of revenue is infinitely more likely, but that's not the headline here because there's no expensive consulting fix for that.
ocschwar 10y ago
Seems overly paranoid. The only people who can gain from the leakage of proprietary data from their competitors also have a lot to lose if they make use of such data and get caught at it.
- jmcgough 10y ago
  This is almost never about proprietary information. Typically it's accessing and selling user/cc info, infecting users, or defrauding the company (rebate scams for fake items).
- Aelinsaar 10y ago
  That's true, but people do stupid and shortsighted things all of the time. Once that data is out, the impact on the source of the leak is going to be cold comfort.
ogn3rd 10y ago
This really highlights poor working conditions. Stop treating your employees like their the stuff stuck on the bottom of your shoe and just maybe they'll stop looking for ways to get even. It's also why Glassdoor exists.
- pyre 10y ago
  On the other hand, there are sub-par workers that have a higher than reality view of their skills who also get disgruntled that they are not treated like rockstars.
nickpsecurity 10y ago
In case any are interested, the original model and experiment for a leakers' market was Tim May's BlackNet as described here: http://osaka.law.miami.edu/~froomkin/articles/tcmay.htm http://osaka.law.miami.edu/~froomkin/articles/tcmay.htm Good news he only received a few offers despite all the privacy tech involved. I wonder what the number would be today. Wikileaks shows it could be significant.
maxander 10y ago
Or maybe, just maybe, you should wonder why your company is full of disgruntled employees in the first place. Perhaps even listen to their complaints, if you're really feeling like a radical egalitarian or something.
- grb423 10y ago
  I think even HeavenCo would have one disgruntled employee. And all it takes is one. This is chilling.
  - Aelinsaar 10y ago
    When it's just one though, they stand out and good management can spot them before a crisis (usually). The issue arises when you have a sea of disgruntlement, and you have to pick out the one or two who are pathological.
  - devonkim 10y ago
    If we want to invoke scripture liberally, we can say that Satan was a disgruntled employee that was fired for insubordination and founded his own company starting a War for Souls. I think there's a book where the setting is that Hell is structured like a corporation.
- calibraxis 10y ago
  Maybe not steal from your employees either! (Wage theft is common.)
  - orbitingpluto 10y ago
    And maybe not discipline your employees for refusing to commit wage theft on your behalf?
- zeveb 10y ago
  > Or maybe, just maybe, you should wonder why your company is full of disgruntled employees in the first place. Presumably because one hired human beings rather than robots. People do get disgruntled because they are mistreated, but that's because they perceive that they are mistreated. I imagine that we've all worked with people who perceive slights when there are none. I don't know a good way to detect these hires: generally in the interview people do a decent job of hiding this attitude. Heck, some folks can even make it through a probationary period without showing their true colours!
Havoc 10y ago
Seems to be down. Mirror anyone?
hackuser 10y ago
To a degree these worried companies seem to be overreacting: * Disgruntled insiders always have been a security threat, and usually the biggest threat. * If the seller is operating on open markets, even anonymously, the company has much more visibility into what's happening than before, when the transactions were more private (I assume). The markets must have sufficient liquidity (i.e., buyers) for the seller to succeed, so I would guess that only reasonably well-known darknet markets would be used. Just monitor those markets and you know what is being sold and in many cases can narrow down who the seller is or even catch them and the buyer. * Fear of a sociopathic 'lone wolf' is often exaggerated. Consider the similar reaction to terrorist attacks: People think, 'anyone could buy a gun and shoot up a crowded place', but that's not how it works. Physically, anyone could do it - anyone could drive their car into a crowd, an opportunity that arises billions of times per day - but people don't do it. The evidence is overwhelming: Human behavior is much safer than we fear. * I suspect some is an overreaction to an unfamiliar new tech with a scary name: The Darknet.
- drvdevd 10y ago
  Interesting take. When I first read this article I admit to buying in to the sensationalism a bit -- but I'll have to agree with you that The Darknet really hasn't changed this situation significantly, rather it's just introduced a more convenient route for would be malicious insiders. Also, from another perspective (as you explain), it's actually made it easier to catch such insiders, due to the open nature of these markets (regardless of the fact that they're 'Dark' or believed to be anonymous).

79 points by snowy 10y ago

Hard not to imagine a "buy our services!" hidden message in this piece; it's really aimed at budget spenders and not techies.

thedudemabry 10y ago
"More serious and expensive offerings apply machine learning to internal human resources (HR) records, and work to discover and infiltrate online crime rings." Their first offering sounds pretty unlikely to yield results and the second seems ethically dubious to undertake for a single client.
- Bartweiss 10y ago
  If they could turn basic HR records into a detailed threat assessment, they'd be selling that ML breakthrough to everyone in the world rather than pitching online scare stories. I'm betting "apply machine learning to internal... records" looks more like listing the employees with disciplinary records and going "revoke network access from these people".
Bartweiss 10y ago
The whole tone of the thing was definitely "Your employees hate you, the darknet is scary, you don't understand technology so pay us!" Like, I get that "disgruntled employee" is less dangerous than "disgruntled employee with expert guidance", but using Tor is already evidence of sophistication. There was nothing stopping these people from going to the library and posting on a normal internet forum, even ten years ago. Similarly, people stealing all your user information in a movie-style hacker coup is just not that common. Someone flipping a circuit breaker and costing you a bunch of revenue is infinitely more likely, but that's not the headline here because there's no expensive consulting fix for that.

ocschwar 10y ago

Seems overly paranoid. The only people who can gain from the leakage of proprietary data from their competitors also have a lot to lose if they make use of such data and get caught at it.

jmcgough 10y ago
This is almost never about proprietary information. Typically it's accessing and selling user/cc info, infecting users, or defrauding the company (rebate scams for fake items).
Aelinsaar 10y ago
That's true, but people do stupid and shortsighted things all of the time. Once that data is out, the impact on the source of the leak is going to be cold comfort.

ogn3rd 10y ago

This really highlights poor working conditions. Stop treating your employees like their the stuff stuck on the bottom of your shoe and just maybe they'll stop looking for ways to get even. It's also why Glassdoor exists.

pyre 10y ago
On the other hand, there are sub-par workers that have a higher than reality view of their skills who also get disgruntled that they are not treated like rockstars.

nickpsecurity 10y ago

In case any are interested, the original model and experiment for a leakers' market was Tim May's BlackNet as described here: http://osaka.law.miami.edu/~froomkin/articles/tcmay.htm http://osaka.law.miami.edu/~froomkin/articles/tcmay.htm Good news he only received a few offers despite all the privacy tech involved. I wonder what the number would be today. Wikileaks shows it could be significant.

maxander 10y ago

Or maybe, just maybe, you should wonder why your company is full of disgruntled employees in the first place. Perhaps even listen to their complaints, if you're really feeling like a radical egalitarian or something.

grb423 10y ago
I think even HeavenCo would have one disgruntled employee. And all it takes is one. This is chilling.
- Aelinsaar 10y ago
  When it's just one though, they stand out and good management can spot them before a crisis (usually). The issue arises when you have a sea of disgruntlement, and you have to pick out the one or two who are pathological.
- devonkim 10y ago
  If we want to invoke scripture liberally, we can say that Satan was a disgruntled employee that was fired for insubordination and founded his own company starting a War for Souls. I think there's a book where the setting is that Hell is structured like a corporation.
calibraxis 10y ago
Maybe not steal from your employees either! (Wage theft is common.)
- orbitingpluto 10y ago
  And maybe not discipline your employees for refusing to commit wage theft on your behalf?
zeveb 10y ago
> Or maybe, just maybe, you should wonder why your company is full of disgruntled employees in the first place. Presumably because one hired human beings rather than robots. People do get disgruntled because they are mistreated, but that's because they perceive that they are mistreated. I imagine that we've all worked with people who perceive slights when there are none. I don't know a good way to detect these hires: generally in the interview people do a decent job of hiding this attitude. Heck, some folks can even make it through a probationary period without showing their true colours!

Havoc 10y ago

Seems to be down. Mirror anyone?

hackuser 10y ago

To a degree these worried companies seem to be overreacting: * Disgruntled insiders always have been a security threat, and usually the biggest threat. * If the seller is operating on open markets, even anonymously, the company has much more visibility into what's happening than before, when the transactions were more private (I assume). The markets must have sufficient liquidity (i.e., buyers) for the seller to succeed, so I would guess that only reasonably well-known darknet markets would be used. Just monitor those markets and you know what is being sold and in many cases can narrow down who the seller is or even catch them and the buyer. * Fear of a sociopathic 'lone wolf' is often exaggerated. Consider the similar reaction to terrorist attacks: People think, 'anyone could buy a gun and shoot up a crowded place', but that's not how it works. Physically, anyone could do it - anyone could drive their car into a crowd, an opportunity that arises billions of times per day - but people don't do it. The evidence is overwhelming: Human behavior is much safer than we fear. * I suspect some is an overreaction to an unfamiliar new tech with a scary name: The Darknet.

drvdevd 10y ago
Interesting take. When I first read this article I admit to buying in to the sensationalism a bit -- but I'll have to agree with you that The Darknet really hasn't changed this situation significantly, rather it's just introduced a more convenient route for would be malicious insiders. Also, from another perspective (as you explain), it's actually made it easier to catch such insiders, due to the open nature of these markets (regardless of the fact that they're 'Dark' or believed to be anonymous).