5 ms·

That was not a side project from my limited understanding ;) I believe the M$/Alphabet/Meta security teams are probably more advanced or on par with the best st

That was not a side project from my limited understanding ;) I believe the M$/Alphabet/Meta security teams are probably more advanced or on par with the best state sponsored teams. I could be wrong, plus the state sponsored teams might have infiltrated the FAANG security teams ;) However, I think the FAANG companies act somewhat more restricted. Three letter agencies don't have qualms about things like "chloroforming security guards" and such. Also, use USB Data Blocker dongles where possible.

theptip 4y ago
NSA’s TAO surely has many orders of magnitude more budget than Google’s red team?
- tapland 4y ago
  Probably. It’s way handier if the keylogger is embedded into the cable from your usb-x monitor right when you open the fresh package. But budget limited ingenuity is fun too!
- cbsmith 4y ago
  It's really not hard to realize that organizations whose entire existence is predicated on actually cracking the security of other nation states might garner more investment than a red team focused on checking that your company's security is intact.
- godelski 4y ago
  I don't think the NSA pays as well though. You also have large restrictions. Not just stuff like never having smoked weed in your life (we are talking about CS people...) but that once you even have a security clearance (a pain to get in the first place) you have a lot of daily life headaches. You have to carefully watch what you say. International travel has to be reported (and can even be a big hassle). Etc. I'm not sure if the same is true for Google's Red/Blue teams, but I feel pretty confident in saying that they probably get paid more.
  - Arainach 4y ago
    Correct, government pay scale is a huge problem for talent acquisition. Your choices are either someone who is so ideologically devoted that they're willing to work for 5-25% of what they're worth or "work for us or you're going to prison for a long time". Citations: https://apply.intelligencecareers.gov/job-description/1194863 https://apply.intelligencecareers.gov/job-description/119486... Cyber Mitigations Analyst/System Vulnerability Analyst - Entry to Expert Level (Maryland) Network Cyber Mitigations Engineers and System Vulnerability Analysts analyze vulnerabilities and develop mitigations to strengthen defenses. They produce formal and informal reports, briefings, and guidance to defend against attacks against network infrastructure devices or systems. NSA analysts' competencies run the gamut of data transport possibilities. They work with traditional wired networks, wireless transport, including Wi-Fi and cellular, collaborative platforms such as video teleconferencing, and the hardware and software that support it all. Pay Plan: GG, Grade: 07/1 to 15/10 https://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/2022/general-schedule/ https://www.opm.gov/policy-data-oversight/pay-leave/salaries... In a very high cost of living area, that means that entry level is $31K and the absolute top for expert level is $176,300. Compare that to what FAMG are paying new college grads.
    - CamperBob2 4y ago
      Correct, government pay scale is a huge problem for talent acquisition. Your choices are either someone who is so ideologically devoted that they're willing to work for 5-25% of what they're worth or "work for us or you're going to prison for a long time" Or "I'm a covert foreign asset, so I DGAF what I get paid."
    - Scoundreller 4y ago
      Caps are getting raised, at least at DHS: > The CTMS [Cybersecurity Talent Management System] salary range has an upper limit of the vice president's salary ($255,800 in 2021), plus an extended range for use in limited circumstances, which has an upper limit of $332,100 in 2021. https://www.zdnet.com/article/the-us-government-just-launched-a-big-push-to-fill-cybersecurity-jobs-with-salaries-to-match/ https://www.zdnet.com/article/the-us-government-just-launche...
- tptacek 4y ago
  By many accounts they source exploits from the grey market, too.
deleted 4y ago
[deleted]
jonas21 4y ago
It's certainly something someone could do as a side project, even if that wasn't strictly the case here.
xoogler2004 4y ago
This was a side project.
411111111111111 4y ago
> That was not a side project from my limited understanding ;) First paragraph of the article: > In episode #3, Daniel Fabian talks about the redteaming efforts - and in particular, about an exercise he and I ran together as a side project back in 2012:

theptip 4y ago

NSA’s TAO surely has many orders of magnitude more budget than Google’s red team?

tapland 4y ago
Probably. It’s way handier if the keylogger is embedded into the cable from your usb-x monitor right when you open the fresh package. But budget limited ingenuity is fun too!
cbsmith 4y ago
It's really not hard to realize that organizations whose entire existence is predicated on actually cracking the security of other nation states might garner more investment than a red team focused on checking that your company's security is intact.
godelski 4y ago
I don't think the NSA pays as well though. You also have large restrictions. Not just stuff like never having smoked weed in your life (we are talking about CS people...) but that once you even have a security clearance (a pain to get in the first place) you have a lot of daily life headaches. You have to carefully watch what you say. International travel has to be reported (and can even be a big hassle). Etc. I'm not sure if the same is true for Google's Red/Blue teams, but I feel pretty confident in saying that they probably get paid more.
- Arainach 4y ago
  Correct, government pay scale is a huge problem for talent acquisition. Your choices are either someone who is so ideologically devoted that they're willing to work for 5-25% of what they're worth or "work for us or you're going to prison for a long time". Citations: https://apply.intelligencecareers.gov/job-description/1194863 https://apply.intelligencecareers.gov/job-description/119486... Cyber Mitigations Analyst/System Vulnerability Analyst - Entry to Expert Level (Maryland) Network Cyber Mitigations Engineers and System Vulnerability Analysts analyze vulnerabilities and develop mitigations to strengthen defenses. They produce formal and informal reports, briefings, and guidance to defend against attacks against network infrastructure devices or systems. NSA analysts' competencies run the gamut of data transport possibilities. They work with traditional wired networks, wireless transport, including Wi-Fi and cellular, collaborative platforms such as video teleconferencing, and the hardware and software that support it all. Pay Plan: GG, Grade: 07/1 to 15/10 https://www.opm.gov/policy-data-oversight/pay-leave/salaries-wages/2022/general-schedule/ https://www.opm.gov/policy-data-oversight/pay-leave/salaries... In a very high cost of living area, that means that entry level is $31K and the absolute top for expert level is $176,300. Compare that to what FAMG are paying new college grads.
  - CamperBob2 4y ago
    Correct, government pay scale is a huge problem for talent acquisition. Your choices are either someone who is so ideologically devoted that they're willing to work for 5-25% of what they're worth or "work for us or you're going to prison for a long time" Or "I'm a covert foreign asset, so I DGAF what I get paid."
  - Scoundreller 4y ago
    Caps are getting raised, at least at DHS: > The CTMS [Cybersecurity Talent Management System] salary range has an upper limit of the vice president's salary ($255,800 in 2021), plus an extended range for use in limited circumstances, which has an upper limit of $332,100 in 2021. https://www.zdnet.com/article/the-us-government-just-launched-a-big-push-to-fill-cybersecurity-jobs-with-salaries-to-match/ https://www.zdnet.com/article/the-us-government-just-launche...
tptacek 4y ago
By many accounts they source exploits from the grey market, too.

deleted 4y ago

[deleted]

jonas21 4y ago

It's certainly something someone could do as a side project, even if that wasn't strictly the case here.

xoogler2004 4y ago

This was a side project.

411111111111111 4y ago

> That was not a side project from my limited understanding ;) First paragraph of the article: > In episode #3, Daniel Fabian talks about the redteaming efforts - and in particular, about an exercise he and I ran together as a side project back in 2012: