4 ms·
Can we talk about who "Bill" (the source for the article) is ? If we read between the lines, it appears that someone sitting at a fairly large Internet choke p
by rsync 5y ago
Can we talk about who "Bill" (the source for the article) is ?
If we read between the lines, it appears that someone sitting at a fairly large Internet choke point is grepping the flow of mail traffic for keywords (for lack of better terms since it's not literally grep).
Presumably someone placed highly enough that they can do such analysis without management oversight ?
Or are there compliance and security reasons to "grep" IMAP traffic for certain things and he just added some other keywords ?
Where, in 2021, would a network admin own this much traffic and have this little oversight ?
-----
EDIT: ... and now that I think about it, wouldn't this be fairly easy to suss out ? The source states:
"So I’m seeing this traffic to just like 10 net blocks tied to Microsoft, which means I’m only looking at maybe 25 percent of Microsoft’s infrastructure,"
I have neither the time nor the inclination but if there is an ISP out there that is routing 25% of MS mail infrastructure, all I have to do is look at mail routes to MS for a few days and run some traceroutes and I could probably make some guesses as to which network "Bill" works for ...
- yencabulator 5y agoI would assume(/hope) IMAP would be TLS protected, these days. And since Bill doesn't seem to be inside Microsoft, he'd have to MITM the TLS sessions? To me, it sounds more like Bill broke into (some of) the "proxy network" (likely bots on home computers?) used by the attackers, and is spying on them.