4 ms·
How do you slip something like this past a corporate security team? Stamos and @bcrypt never struck me as individuals that were "asleep at the wheel". Surely t
by Phlarp 10y ago
How do you slip something like this past a corporate security team? Stamos and @bcrypt never struck me as individuals that were "asleep at the wheel".
Surely there was evidence somewhere? If Stamos wasn't briefed as to the situation and a security engineer found the rootkit on their own how could they be bound by the terms of an NSL / gag order?
- tptacek 10y agoI don't know any more about this than you do; I'm learning about it from the same Reuters story. But according to the story, the decision to implant the backdoor wasn't discovered by Yahoo security; rather, the backdoor itself was discovered, weeks after it was deployed.
- Phlarp 10y agoSo is the speculation that Stamos' departure was related to this? The timing would seem suspicious otherwise. If so, one wonders if he would take a similar principled stance a second time at Facebook. Much harder to jump ship for greener pastures while already riding the biggest rocketship in town.
- tptacek 10y agoI do not believe Stamos would remain at Facebook after something like this. But we're not much more than acquaintances (we both worked at NCC, and were prior to that former business rivals or whatever you call two people with similar roles at competing firms). I like him. I just want to be clear that I'm not speculating about Stamos's motives.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- imglorp 10y agoIn a large pipelined, distributed architecture, there's probably dozens of consumers of the databases that all look rather similar: they do some queries and pack up some reports for internal consumption. Marketing, ab testing, user experience, etc. Yet another consumer sharing 99% of the same code might not stand out.
- jsjohnst 10y agoAt the risk of being downvoted for possibly being pedantic... Knowing Yahoo's mail architecture very intimately, your analogy here isn't very accurate unless you get very abstract with your usage of the words "database" and "queries".
- Bartweiss 10y agoThis seems like the more interesting question. Whether Mayer went around him willingly or by legal requirement is basically unanswerable, except to note that the email team chose to do the same. There's not much to say when we can't tell collusion from compulsion. The question of accidental discovery, by contrast, is a fascinating one. A gag order couldn't possibly compel someone who made the discovery on their own (for the simple reason that they wouldn't know about it to be compelled). So circumventing the security team, instead of simply including them in the NSL, raises an interesting discussion about the nature of the NSL and why the matter was kept from Stamos' team.
- snowwrestler 10y ago> A gag order couldn't possibly compel someone who made the discovery on their own (for the simple reason that they wouldn't know about it to be compelled). If the company was gagged, I don't see how it would matter whether company employees knew about it in advance or found it by accident. Either way, the company is still gagged. Also, while your comment makes common sense, national security restrictions don't have to make sense to be legal. For example there is information that is "born classified," meaning that even if it is independently developed, totally separate from the defense apparatus, it's still considered classified!
- ryanlol 10y agoThat particular employee may not be. Obvious solution is to have a page ran by some reasonably trustworthy organisation where people can report these breaches before passing them on to their superiors.
- tedunangst 10y agoAdd it to the spam filter? The security team probably reviews the spam filter code, but perhaps not the particular weights and measures it uses on a daily basis. So you set up a parallel filter for "arabic spam" that generally looks like regular filter, just tuned a little differently.
- wolf550e 10y agoThe feds had an API that allowed them to download the mail caught in the "Arabic spam filter". How do you hide that?
- tedunangst 10y agoPerhaps the ssh connection running 'tail -f spamlog' is what tipped off the security team.
- deleted 10y ago[deleted]
- fungi 10y ago> Yahoo execs deliberately bypassed review from the security team when installing the backdoor. In fact, when members of the security team found it within weeks of its installation, they immediately assumed it had been installed by malicious hackers, rather than Yahoo’s own mail team. (This says something about what the backdoor code may have looked like.) https://diracdeltas.github.io/blog/surveillance/ https://diracdeltas.github.io/blog/surveillance/