6 ms·

What other tech companies have in house spies. NordVPN? Wikipedia? Facebook? Gmail?

x220 7y ago
Every company that collaborates with the NSA (including Microsoft, Google, Facebook, Apple, and Dropbox) has in house spies. We don't like to think about it this way because the spies are on "our side".
retrovm 7y ago
It seems like there is an inverse relationship between sophistication and risk. If everything is full-custom then it may be quite easy to integrate auditing tools for who accessed user data. If an org uses mostly off-the-shelf software then it's pretty much impossible to audit e.g. who connected to what mysql server and ran which queries. So I'd be a lot more worried about a Twitter (fairly unsophisticated deployments of standard software stacks), moderately worried about Facebook (hacks upon the usual stack) and not very worried about Google (literally everything written in-house).
- NullPrefix 7y ago
  >who connected to what mysql server and ran which queries I'm pretty sure that is not really a hard task
  - vast 7y ago
    It is quite common that sql servers run just with a few accounts. Helpful audit logs on critical systems have a high cost. So technically it is not hard but practically it is.
    - mc32 7y ago
      True but they can have systems which execute on the behalf of an authenticated user and pass that to the SQL server but the system in the middle would have logs of that query and by whom. Now, to be fair, there are usually holes that allow direct access as well.
  - moksly 7y ago
    I work in the public sector where we take these things fairly seriously, but it doesn’t really matter when the auditors are drowned in the vast amount of data. We have 300 IT systems with 8000 users that take care of 700000 citizens. There is an ungodly amount of information on who accessed what and when. Data security, even post GDPR is a total illusion. We’re working to build better access control, by indexing data and mapping user rights to job functions, but even then things are going to get lost in the audits.
- lonelappde 7y ago
  Why would you think that MySQL is harder to get logs from than some custom in house database?
- celim307 7y ago
  Yo...middleware is a thing.
- xienze 7y ago
  > who connected to what mysql server and ran which queries. Let’s say I’m a foreign spy who happens to be the company’s DBA. Audit logs don’t really help you there since it’s not particularly noteworthy that I was in the DB.
  - retrovm 7y ago
    That's exactly my point. In a company like Twitter there is some person or probably many people who are "the dba" and accessing a mysql directly or even using tools to access the underlying storage is an event of no discernible consequence. By contrast in a Google-style stack there is no person who is "the DBA", making it far easier to audit. A Gmail admin might need to unwrap the encryption keys that protect your attachments to, for example, diagnose a message-of-death that is crashing their backends, but that event would be so rare as to be easily audited, and it would tie a specific actor to a specific victim. Also I would say a custom auditing stack is way more resilient to things like just deleting the logs off the server, restarting the server without auditing, and whatnot.
- busterarm 7y ago
  The data scientists at Facebook have pretty much free reign to pull down whatever data they feel they need and often do. As much as there's talk about how much of a no-no that is there, it doesn't seem like anyone is really looking. You should be a lot more worried about Facebook. This pretty much applied to US government warrantless wiretaps as well come to think of it. Unfettered access isn't so hot if you like your privacy.
  - retrovm 7y ago
    That's a different problem though. The fact that Facebook employees access your private data is not because of insider risk being taken unseriously. It's because looking at and distributing your private data is a core function for that company. They don't consider it a flaw.
xienze 7y ago
I’d wager every single one of them.
- lonelappde 7y ago
  If even 1 in 10000 people were spies...
empath75 7y ago
All of them. I imagine if you’re a high value target that can be blackmailed, some intelligence service knows all about you.
- mirimir 7y ago
  These guys weren't blackmailed. They were just bribed.
  - catalogia 7y ago
    Worth reviewing: https://en.wikipedia.org/wiki/Motives_for_spying https://en.wikipedia.org/wiki/Motives_for_spying > MICE: Money, Ideology, Compromise or [Extortion / Ego] > RASCLS framework: Reciprocation, Authority, Scarcity, Commitment and Consistency, Liking, and Social Proof See Also: https://en.wikipedia.org/wiki/Recruitment_of_spies https://en.wikipedia.org/wiki/Recruitment_of_spies
    - mirimir 7y ago
      Thanks. I'm aware of those issues. But in the three TFAs posted recently here, I didn't see anything about blackmail or extortion.
d1zzy 7y ago
Insider risk is not limited to "spies", there are lots of actors that may act against the best interests of the company in regards to how the access and use the data. There are procedures (basically layered security, auditing and monitoring) that can be followed to actively manage this. So yes, there may be "spies" at any one of those companies, or just people doing things they shouldn't do, but to me that's logical and not surprising in any way, any organization has to face this issue.
JohnFen 7y ago
Any company that handles sensitive information, or information about a lot of people (even if not particularly sensitive) has to assume that they have at least one in-house spy of some sort. Partly to make sure they're not more vulnerable than they should be and partly because it's likely to be true.
rapind 7y ago
Digital Ocean, Linode, OVH, Heroku, Cloudways, any cloud database provider, DockerHub, etc?
swalsh 7y ago
This is a scary trend, it's bad enough that anytime I talk to someone online I question if they're a real person. Now we might be transitioning to an era where I can't trust my coworkers either.
all_blue_chucks 7y ago
If it's large and has access to data on lots of people you can bet there are spies. Hell, Google has real time and historic GPS data for half of America. A government would have to be out of their mind not to go after such data.
devnulloverflow 7y ago
Are you talking about in house spies, or spies placed in companies by governments? If the latter, then the answer is all of them.
robk 7y ago
Since like 05 Google has had very high strictness on this kind of access but I'd still bet there are some SREs working as foreign agents

x220 7y ago

Every company that collaborates with the NSA (including Microsoft, Google, Facebook, Apple, and Dropbox) has in house spies. We don't like to think about it this way because the spies are on "our side".

retrovm 7y ago

It seems like there is an inverse relationship between sophistication and risk. If everything is full-custom then it may be quite easy to integrate auditing tools for who accessed user data. If an org uses mostly off-the-shelf software then it's pretty much impossible to audit e.g. who connected to what mysql server and ran which queries. So I'd be a lot more worried about a Twitter (fairly unsophisticated deployments of standard software stacks), moderately worried about Facebook (hacks upon the usual stack) and not very worried about Google (literally everything written in-house).

NullPrefix 7y ago
>who connected to what mysql server and ran which queries I'm pretty sure that is not really a hard task
- vast 7y ago
  It is quite common that sql servers run just with a few accounts. Helpful audit logs on critical systems have a high cost. So technically it is not hard but practically it is.
  - mc32 7y ago
    True but they can have systems which execute on the behalf of an authenticated user and pass that to the SQL server but the system in the middle would have logs of that query and by whom. Now, to be fair, there are usually holes that allow direct access as well.
- moksly 7y ago
  I work in the public sector where we take these things fairly seriously, but it doesn’t really matter when the auditors are drowned in the vast amount of data. We have 300 IT systems with 8000 users that take care of 700000 citizens. There is an ungodly amount of information on who accessed what and when. Data security, even post GDPR is a total illusion. We’re working to build better access control, by indexing data and mapping user rights to job functions, but even then things are going to get lost in the audits.
lonelappde 7y ago
Why would you think that MySQL is harder to get logs from than some custom in house database?
celim307 7y ago
Yo...middleware is a thing.
xienze 7y ago
> who connected to what mysql server and ran which queries. Let’s say I’m a foreign spy who happens to be the company’s DBA. Audit logs don’t really help you there since it’s not particularly noteworthy that I was in the DB.
- retrovm 7y ago
  That's exactly my point. In a company like Twitter there is some person or probably many people who are "the dba" and accessing a mysql directly or even using tools to access the underlying storage is an event of no discernible consequence. By contrast in a Google-style stack there is no person who is "the DBA", making it far easier to audit. A Gmail admin might need to unwrap the encryption keys that protect your attachments to, for example, diagnose a message-of-death that is crashing their backends, but that event would be so rare as to be easily audited, and it would tie a specific actor to a specific victim. Also I would say a custom auditing stack is way more resilient to things like just deleting the logs off the server, restarting the server without auditing, and whatnot.
busterarm 7y ago
The data scientists at Facebook have pretty much free reign to pull down whatever data they feel they need and often do. As much as there's talk about how much of a no-no that is there, it doesn't seem like anyone is really looking. You should be a lot more worried about Facebook. This pretty much applied to US government warrantless wiretaps as well come to think of it. Unfettered access isn't so hot if you like your privacy.
- retrovm 7y ago
  That's a different problem though. The fact that Facebook employees access your private data is not because of insider risk being taken unseriously. It's because looking at and distributing your private data is a core function for that company. They don't consider it a flaw.

xienze 7y ago

I’d wager every single one of them.

lonelappde 7y ago
If even 1 in 10000 people were spies...

empath75 7y ago

All of them. I imagine if you’re a high value target that can be blackmailed, some intelligence service knows all about you.

mirimir 7y ago
These guys weren't blackmailed. They were just bribed.
- catalogia 7y ago
  Worth reviewing: https://en.wikipedia.org/wiki/Motives_for_spying https://en.wikipedia.org/wiki/Motives_for_spying > MICE: Money, Ideology, Compromise or [Extortion / Ego] > RASCLS framework: Reciprocation, Authority, Scarcity, Commitment and Consistency, Liking, and Social Proof See Also: https://en.wikipedia.org/wiki/Recruitment_of_spies https://en.wikipedia.org/wiki/Recruitment_of_spies
  - mirimir 7y ago
    Thanks. I'm aware of those issues. But in the three TFAs posted recently here, I didn't see anything about blackmail or extortion.

d1zzy 7y ago

Insider risk is not limited to "spies", there are lots of actors that may act against the best interests of the company in regards to how the access and use the data. There are procedures (basically layered security, auditing and monitoring) that can be followed to actively manage this. So yes, there may be "spies" at any one of those companies, or just people doing things they shouldn't do, but to me that's logical and not surprising in any way, any organization has to face this issue.

JohnFen 7y ago

Any company that handles sensitive information, or information about a lot of people (even if not particularly sensitive) has to assume that they have at least one in-house spy of some sort. Partly to make sure they're not more vulnerable than they should be and partly because it's likely to be true.

rapind 7y ago

Digital Ocean, Linode, OVH, Heroku, Cloudways, any cloud database provider, DockerHub, etc?

swalsh 7y ago

This is a scary trend, it's bad enough that anytime I talk to someone online I question if they're a real person. Now we might be transitioning to an era where I can't trust my coworkers either.

all_blue_chucks 7y ago

If it's large and has access to data on lots of people you can bet there are spies. Hell, Google has real time and historic GPS data for half of America. A government would have to be out of their mind not to go after such data.

devnulloverflow 7y ago

Are you talking about in house spies, or spies placed in companies by governments? If the latter, then the answer is all of them.

robk 7y ago

Since like 05 Google has had very high strictness on this kind of access but I'd still bet there are some SREs working as foreign agents