3 ms·

care to add examples? has there ever been a case when state actor sent a rogue employee and succeeded? because in serious organizations there are robust defense

by slt2021 6y ago

care to add examples? has there ever been a case when state actor sent a rogue employee and succeeded? because in serious organizations there are robust defenses even against potentially rogue employees

freeone3000 6y ago
Stuxnet is the one that comes to mind first, where a Polish mole was able to be hired at an Iranian nuclear enrichment facility.
- boogies 6y ago
  Could you cite that? Why would they need to infect flash drives all around the world if they had a mole directly inside the facility? Edit: grepping Wikipedia for “mole” it does appear that there was an Iranian one working with the Dutch government. https://en.wikipedia.org/wiki/Stuxnet#cite_ref-156 https://en.wikipedia.org/wiki/Stuxnet#cite_ref-156
gcampos 6y ago
Not exactly what OP mentioned, but something like that did happen in the past: https://www.theguardian.com/technology/2010/jul/14/russian-spy-worked-for-microsoft https://www.theguardian.com/technology/2010/jul/14/russian-s...
- deleted 6y ago
  [deleted]
notsureaboutpg 6y ago
What's more common is that states can influence or "turn out" a model employee / excellent achiever into an informant / turncoat. Benedict Arnold is a classic historical example.
mycall 6y ago
I thought China does this all the time. https://www.fbi.gov/news/speeches/responding-effectively-to-the-chinese-economic-espionage-threat https://www.fbi.gov/news/speeches/responding-effectively-to-...
- slt2021 6y ago
  economic espionage is different thing and yes it exists. for example Huawei equipment - is cheap and low quality Cisco ripoff. But it is no different than employees in Silicon Valley changing companies and taking their knowledge to the competitor. In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me Has Lucid Motors's founder (former Tesla employee) conducted economic espionage or is it simply capitalism working as intended?
  - throw0101a 6y ago
    > In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me You may wish to ask Nortel about that: * https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s-greatest-tech-company-1.1459269 https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s... * 7m ago: https://news.ycombinator.com/item?id=23743869 https://news.ycombinator.com/item?id=23743869 There's a long list of criticisms against Huawei: * https://en.wikipedia.org/wiki/Criticism_of_Huawei https://en.wikipedia.org/wiki/Criticism_of_Huawei
    - slt2021 6y ago
      I read the Nortel thread and apparently the Nortel management killed the company.
nsxwolf 6y ago
Are there? I've done some hiring and I don't recall any procedures in place for the detection of foreign intelligence assets. I suppose it is possible that I have never worked for a serious organization.
- qbasic_forever 6y ago
  Security clearances would help, but obviously that's not something that's going to be tenable for all companies. I think the main way to prevent issues is to just assume at any time you could be infiltrated. Don't mistrust all your employees, but don't live with lax security policies that allow a person to get away with something undetected.
  - vitus 6y ago
    Google learned this the hard way, between the Snowden revelations and China's cyberattacks. Audit trails are important, as is, um, not giving read access to user data without really really good justifications. Even beyond espionage, employees could stalk personal contacts (as happened at Uber in 2016 and Facebook in 2018).
- sanderjd 6y ago
  My reading of the comment was that the protections are in the form of limiting what insiders can do / auditing what they do, rather than in detecting them during the hiring process.
lucb1e 6y ago
I have yet to come across such an organisation, actually, and I'm a security consultant. The scenario is usually if an employee's systems get hacked, very few "serious organisations" seem to have procedures for rogue employees, at least seen from an EU perspective (perhaps the culture is different in the USA or in poorer parts of the world).
- slt2021 6y ago
  it is hard to catch expert rogue employees, but there are systems like conducting security clearance, DLP, UEBA, airgapped system separation (low security, medium security, high security), and ton of other security layers/controls that together can give some assurance
qbasic_forever 6y ago
It is _far_ more common than you think. A few years after I started at MS this guy was caught: https://www.theatlantic.com/international/archive/2010/07/who-was-the-12th-russian-spy-at-microsoft/344876/ https://www.theatlantic.com/international/archive/2010/07/wh... I knew a lot of folks internally that worked with him, knew him, etc. and had _no idea_ he was a spy or agent. He was the model of a perfect employee or hire for MS at the time.
- slt2021 6y ago
  wow, so this guy worked as senior developer for infosec vendor NeoBIT (neobit.ru/partners openly cites FSB as their #1 client) and then gets a QA tester job at MSFT, no wonder DHS tracked him since he applied for visa. see, these people are not that smart, actually
  - qbasic_forever 6y ago
    Sure, but those are the people that have been caught. The ones actually making a difference will likely never be known.
BCM43 6y ago
https://www.nytimes.com/2019/11/06/technology/twitter-saudi-arabia-spies.html https://www.nytimes.com/2019/11/06/technology/twitter-saudi-...
spc476 6y ago
While this happened to me in 2004, I can still see it working even today: http://boston.conman.org/2004/09/19.1 http://boston.conman.org/2004/09/19.1
astura 6y ago
You don't receive insider threat training at work? There's plenty of examples given during that sort of training. The FBI gave some examples in their published literature on the topic. https://www.fbi.gov/file-repository/china-risk-to-corporate-america-2019.pdf https://www.fbi.gov/file-repository/china-risk-to-corporate-...

freeone3000 6y ago

Stuxnet is the one that comes to mind first, where a Polish mole was able to be hired at an Iranian nuclear enrichment facility.

boogies 6y ago
Could you cite that? Why would they need to infect flash drives all around the world if they had a mole directly inside the facility? Edit: grepping Wikipedia for “mole” it does appear that there was an Iranian one working with the Dutch government. https://en.wikipedia.org/wiki/Stuxnet#cite_ref-156 https://en.wikipedia.org/wiki/Stuxnet#cite_ref-156

gcampos 6y ago

Not exactly what OP mentioned, but something like that did happen in the past: https://www.theguardian.com/technology/2010/jul/14/russian-spy-worked-for-microsoft https://www.theguardian.com/technology/2010/jul/14/russian-s...

deleted 6y ago
[deleted]

notsureaboutpg 6y ago

What's more common is that states can influence or "turn out" a model employee / excellent achiever into an informant / turncoat. Benedict Arnold is a classic historical example.

mycall 6y ago

I thought China does this all the time. https://www.fbi.gov/news/speeches/responding-effectively-to-the-chinese-economic-espionage-threat https://www.fbi.gov/news/speeches/responding-effectively-to-...

slt2021 6y ago
economic espionage is different thing and yes it exists. for example Huawei equipment - is cheap and low quality Cisco ripoff. But it is no different than employees in Silicon Valley changing companies and taking their knowledge to the competitor. In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me Has Lucid Motors's founder (former Tesla employee) conducted economic espionage or is it simply capitalism working as intended?
- throw0101a 6y ago
  > In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me You may wish to ask Nortel about that: * https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s-greatest-tech-company-1.1459269 https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s... * 7m ago: https://news.ycombinator.com/item?id=23743869 https://news.ycombinator.com/item?id=23743869 There's a long list of criticisms against Huawei: * https://en.wikipedia.org/wiki/Criticism_of_Huawei https://en.wikipedia.org/wiki/Criticism_of_Huawei
  - slt2021 6y ago
    I read the Nortel thread and apparently the Nortel management killed the company.

nsxwolf 6y ago

Are there? I've done some hiring and I don't recall any procedures in place for the detection of foreign intelligence assets. I suppose it is possible that I have never worked for a serious organization.

qbasic_forever 6y ago
Security clearances would help, but obviously that's not something that's going to be tenable for all companies. I think the main way to prevent issues is to just assume at any time you could be infiltrated. Don't mistrust all your employees, but don't live with lax security policies that allow a person to get away with something undetected.
- vitus 6y ago
  Google learned this the hard way, between the Snowden revelations and China's cyberattacks. Audit trails are important, as is, um, not giving read access to user data without really really good justifications. Even beyond espionage, employees could stalk personal contacts (as happened at Uber in 2016 and Facebook in 2018).
sanderjd 6y ago
My reading of the comment was that the protections are in the form of limiting what insiders can do / auditing what they do, rather than in detecting them during the hiring process.

lucb1e 6y ago

I have yet to come across such an organisation, actually, and I'm a security consultant. The scenario is usually if an employee's systems get hacked, very few "serious organisations" seem to have procedures for rogue employees, at least seen from an EU perspective (perhaps the culture is different in the USA or in poorer parts of the world).

slt2021 6y ago
it is hard to catch expert rogue employees, but there are systems like conducting security clearance, DLP, UEBA, airgapped system separation (low security, medium security, high security), and ton of other security layers/controls that together can give some assurance

qbasic_forever 6y ago

It is _far_ more common than you think. A few years after I started at MS this guy was caught: https://www.theatlantic.com/international/archive/2010/07/who-was-the-12th-russian-spy-at-microsoft/344876/ https://www.theatlantic.com/international/archive/2010/07/wh... I knew a lot of folks internally that worked with him, knew him, etc. and had _no idea_ he was a spy or agent. He was the model of a perfect employee or hire for MS at the time.

slt2021 6y ago
wow, so this guy worked as senior developer for infosec vendor NeoBIT (neobit.ru/partners openly cites FSB as their #1 client) and then gets a QA tester job at MSFT, no wonder DHS tracked him since he applied for visa. see, these people are not that smart, actually
- qbasic_forever 6y ago
  Sure, but those are the people that have been caught. The ones actually making a difference will likely never be known.

BCM43 6y ago

https://www.nytimes.com/2019/11/06/technology/twitter-saudi-arabia-spies.html https://www.nytimes.com/2019/11/06/technology/twitter-saudi-...

spc476 6y ago

While this happened to me in 2004, I can still see it working even today: http://boston.conman.org/2004/09/19.1 http://boston.conman.org/2004/09/19.1

astura 6y ago

You don't receive insider threat training at work? There's plenty of examples given during that sort of training. The FBI gave some examples in their published literature on the topic. https://www.fbi.gov/file-repository/china-risk-to-corporate-america-2019.pdf https://www.fbi.gov/file-repository/china-risk-to-corporate-...