4 ms·

> lets an NSA/software company "double-employee" add it without the company knowing. I always wondered how that works. I am a full time employee at software co

by rdtsc 10y ago

> lets an NSA/software company "double-employee" add it without the company knowing. I always wondered how that works. I am a full time employee at software company. Cannot imagine having extra time to report to another employer (NSA) and deal with their red tape and crap as well. Or does NSA show up at their doorstep with a bag full of cash - "Here you go, have this, and install a backdoor in your company's software. And we never met <wink>, <wink>" That sounds good on paper so to speak, I just have a hard time imagining a realistic scenario. Now finding 0-days and hoarding them, I can see that.

toyg 10y ago
You assume the mole is an MS employee first and an NSA op second. Traditionally, the opposite is true: if you want to infiltrate a somewhat friendly entity, you do it by engineering the hire of trusted individuals. This is more secure, since there is no risk that one of the guys will get cold feet and blow the whistle. So you monitor universities and you make contact with some of the brightest sparks. You promise them a good job in exchange for the possibility that, one day, they might have to act For The Good of The Country; and in the meantime they'll even be In The Know, which will place them above their peers - excitement! Ambition! Then you lobby a few higher-ups you're friend with, to hire these guys in this or that group. They are top-notch talent, immaculate credentials, so the hire is a slam dunk. They go about their business, being good kernel devs or whatnot, and every few months you give them a quick call to catch up - there is no need for extensive briefing, nobody really cares about the going-ons of Team Kernel A356. When "the favour" is required, the guy is comfortable in his position and doesn't want to leave it, so there is no chance he'll say no.

4 ms·

> lets an NSA/software company "double-employee" add it without the company knowing. I always wondered how that works. I am a full time employee at software co

by rdtsc 10y ago

toyg 10y ago
You assume the mole is an MS employee first and an NSA op second. Traditionally, the opposite is true: if you want to infiltrate a somewhat friendly entity, you do it by engineering the hire of trusted individuals. This is more secure, since there is no risk that one of the guys will get cold feet and blow the whistle. So you monitor universities and you make contact with some of the brightest sparks. You promise them a good job in exchange for the possibility that, one day, they might have to act For The Good of The Country; and in the meantime they'll even be In The Know, which will place them above their peers - excitement! Ambition! Then you lobby a few higher-ups you're friend with, to hire these guys in this or that group. They are top-notch talent, immaculate credentials, so the hire is a slam dunk. They go about their business, being good kernel devs or whatnot, and every few months you give them a quick call to catch up - there is no need for extensive briefing, nobody really cares about the going-ons of Team Kernel A356. When "the favour" is required, the guy is comfortable in his position and doesn't want to leave it, so there is no chance he'll say no.