6 ms·
I do think a lot of folks are missing the main point that no matter what security theater is in place, a state actor with enough motivation is going to breach i
by qbasic_forever 6y ago
I do think a lot of folks are missing the main point that no matter what security theater is in place, a state actor with enough motivation is going to breach it. They're not going to send someone after the password protected parts, they're going to send your recruiter the most irresistible candidate--the perfect background, right out of your favorite school and with expertise in exactly your tech stack. You'll get pages and pages of glowing recommendations from people inside and around the industry. They'll ace your interview loops, be loved by all your engineers and managers, and they won't bat an eye at the lowball first offer you give them. They'll move up the corporate ranks with ease and be everyone's friend... and then the best security in the world doesn't matter one bit.
- slt2021 6y agocare to add examples? has there ever been a case when state actor sent a rogue employee and succeeded? because in serious organizations there are robust defenses even against potentially rogue employees
- freeone3000 6y agoStuxnet is the one that comes to mind first, where a Polish mole was able to be hired at an Iranian nuclear enrichment facility.
- boogies 6y agoCould you cite that? Why would they need to infect flash drives all around the world if they had a mole directly inside the facility? Edit: grepping Wikipedia for “mole” it does appear that there was an Iranian one working with the Dutch government. https://en.wikipedia.org/wiki/Stuxnet#cite_ref-156 https://en.wikipedia.org/wiki/Stuxnet#cite_ref-156
- gcampos 6y agoNot exactly what OP mentioned, but something like that did happen in the past: https://www.theguardian.com/technology/2010/jul/14/russian-spy-worked-for-microsoft https://www.theguardian.com/technology/2010/jul/14/russian-s...
- deleted 6y ago[deleted]
- notsureaboutpg 6y agoWhat's more common is that states can influence or "turn out" a model employee / excellent achiever into an informant / turncoat. Benedict Arnold is a classic historical example.
- mycall 6y agoI thought China does this all the time. https://www.fbi.gov/news/speeches/responding-effectively-to-the-chinese-economic-espionage-threat https://www.fbi.gov/news/speeches/responding-effectively-to-...
- slt2021 6y agoeconomic espionage is different thing and yes it exists. for example Huawei equipment - is cheap and low quality Cisco ripoff. But it is no different than employees in Silicon Valley changing companies and taking their knowledge to the competitor. In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me Has Lucid Motors's founder (former Tesla employee) conducted economic espionage or is it simply capitalism working as intended?
- throw0101a 6y ago> In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me You may wish to ask Nortel about that: * https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s-greatest-tech-company-1.1459269 https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s... * 7m ago: https://news.ycombinator.com/item?id=23743869 https://news.ycombinator.com/item?id=23743869 There's a long list of criticisms against Huawei: * https://en.wikipedia.org/wiki/Criticism_of_Huawei https://en.wikipedia.org/wiki/Criticism_of_Huawei
- slt2021 6y agoI read the Nortel thread and apparently the Nortel management killed the company.
- nsxwolf 6y agoAre there? I've done some hiring and I don't recall any procedures in place for the detection of foreign intelligence assets. I suppose it is possible that I have never worked for a serious organization.
- qbasic_forever 6y agoSecurity clearances would help, but obviously that's not something that's going to be tenable for all companies. I think the main way to prevent issues is to just assume at any time you could be infiltrated. Don't mistrust all your employees, but don't live with lax security policies that allow a person to get away with something undetected.
- vitus 6y agoGoogle learned this the hard way, between the Snowden revelations and China's cyberattacks. Audit trails are important, as is, um, not giving read access to user data without really really good justifications. Even beyond espionage, employees could stalk personal contacts (as happened at Uber in 2016 and Facebook in 2018).
- sanderjd 6y agoMy reading of the comment was that the protections are in the form of limiting what insiders can do / auditing what they do, rather than in detecting them during the hiring process.
- lucb1e 6y agoI have yet to come across such an organisation, actually, and I'm a security consultant. The scenario is usually if an employee's systems get hacked, very few "serious organisations" seem to have procedures for rogue employees, at least seen from an EU perspective (perhaps the culture is different in the USA or in poorer parts of the world).
- slt2021 6y agoit is hard to catch expert rogue employees, but there are systems like conducting security clearance, DLP, UEBA, airgapped system separation (low security, medium security, high security), and ton of other security layers/controls that together can give some assurance
- qbasic_forever 6y agoIt is _far_ more common than you think. A few years after I started at MS this guy was caught: https://www.theatlantic.com/international/archive/2010/07/who-was-the-12th-russian-spy-at-microsoft/344876/ https://www.theatlantic.com/international/archive/2010/07/wh... I knew a lot of folks internally that worked with him, knew him, etc. and had _no idea_ he was a spy or agent. He was the model of a perfect employee or hire for MS at the time.
- slt2021 6y agowow, so this guy worked as senior developer for infosec vendor NeoBIT (neobit.ru/partners openly cites FSB as their #1 client) and then gets a QA tester job at MSFT, no wonder DHS tracked him since he applied for visa. see, these people are not that smart, actually
- qbasic_forever 6y agoSure, but those are the people that have been caught. The ones actually making a difference will likely never be known.
- BCM43 6y agohttps://www.nytimes.com/2019/11/06/technology/twitter-saudi-arabia-spies.html https://www.nytimes.com/2019/11/06/technology/twitter-saudi-...
- spc476 6y agoWhile this happened to me in 2004, I can still see it working even today: http://boston.conman.org/2004/09/19.1 http://boston.conman.org/2004/09/19.1
- astura 6y agoYou don't receive insider threat training at work? There's plenty of examples given during that sort of training. The FBI gave some examples in their published literature on the topic. https://www.fbi.gov/file-repository/china-risk-to-corporate-america-2019.pdf https://www.fbi.gov/file-repository/china-risk-to-corporate-...
- kordlessagain 6y ago> Security theater is the practice of taking security measures that are intended to provide the feeling of improved security while doing little or nothing to achieve it. https://en.wikipedia.org/wiki/Security_theater https://en.wikipedia.org/wiki/Security_theater
- karmakaze 6y agoThat's an excessively long game--much easier to compromise someone already in a position.
- rantwasp 6y agowhy not both?
- qbasic_forever 6y agoStates and powerful, well-funded adversaries have all the time in the world. Look at the 9/11 attacks, the hijackers were taught how to fly planes by US flight schools!
- perl4ever 6y agoI don't know that getting a job is anywhere near "an excessively long game" in the context of publicly known instances of espionage. Have you heard about the group of Russian spies that spent decades blending in (somewhat) to US lives and doing nothing much? https://en.wikipedia.org/wiki/Illegals_Program https://en.wikipedia.org/wiki/Illegals_Program They were arrested around 2010; one had allegedly been a spy for ten years, and another since the 1970s.
- katzgrau 6y agoAn engineer with a great pedigree and work background and social finesse who passes all interviews and interaction without detection... Willing to take on a high risk role... All for the good of the homeland? I think you're describing a work of fiction. It's practically a James Bond or Bruce Wayne-like character. This particular person would be extremely hard to find/hire/compel by some competing nation, if they even exist.
- walrus01 6y agoYou may be underestimating the recruiting efforts and budgets of major nation-state intelligence agencies - Russia and China are doing exactly the same thing the US has been doing for a long time. Spending some tens of millions of dollars to accomplish inserting an advanced persistent threat inside of software used by some huge percentage of the US federal government is a tiny drop in the bucket of the budget of such agencies. The main difference is that the US has historically accomplished it through a role in many cases as a vendor, or a supplier of essential high tech stuff (CIA/NSA and Crypto AG for instance).
- devoutsalsa 6y agoFound the person who trains spies!
- eej71 6y agoMeet Jack Barsky. https://en.wikipedia.org/wiki/Jack_Barsky https://en.wikipedia.org/wiki/Jack_Barsky
- katzgrau 6y agoDoesn't quite fit the image of perfection described above
- xienze 6y ago> I think you're describing a work of fiction. It's practically a James Bond or Bruce Wayne-like character. Diane Feinstein, the _Chair of the Senate Intelligence Committee_, had a Chinese spy as her personal driver _for 20 years_. So yes, slipping engineers into tech companies is not that complicated and in fact happens all the time.
- joe_the_user 6y agoIt seems like there are two (or more) issues: 1) Any inviting target will be ... targeted and so likely breached at least at some points. The article is correct that expect a single target to invulnerable is a mistake. 2) US (and other corporate) systems download untestable binary blobs from third parties as standard operating procedure, not because no one understands the risks but because they aren't concerned with the eventual costs (and happy with the immediate benefits). Similarly, everything gets connected to everything in a whole variety of systems (the sabotaged water system and the cars sabotaged by auto-maker-server-sabotage are just things coming through in the last few days or weeks). It seems like a critical analysis should look at point two so the article's nothing can be done implication is here not appealing. Here, the problem seems hypothetically addressable. This may also be unsolvable but it seems closer to solvable. If the US imposed cyber security standards, a solution would seem more likely, etc.
- mc32 6y agoSo... does anyone use Kaspersky anymore? I mean any CTO or underling in any company could be an unknown "asset" --maybe mitigated a bit if they are scrutinized because of official contracts with GOV. These types may by simply naive and sympathetic to some politics elsewhere. All governments should be weary of these types, lest they have undesired outcomes.
- shalmanese 6y agoBut you don't have to run faster than the bear, you just have to run faster than the slowest person. All of this is theoretically possible but the cost has to be justified by the intelligence gain and there's very few security targets that are simultaneously worth the cost and not achievable via simpler means.