So we know a member of staff was fired, but the data resolution, which may be deliberately vague, is it took place sometime over a 30 day period. Is this like

So we know a member of staff was fired, but the data resolution, which may be deliberately vague, is it took place sometime over a 30 day period. Is this like T-Mobile staff not being paid enough and then T-Mobile getting hacked? Now there's lots of attack vectors when staff are involved, some more than others. I know AV software updates are largely signatures of known malware rehashed, but not new malware like Stuxnet which took some AV companies over a year to reverse engineer before they could even decide if it was malware. But depending on the level of access this member of staff had, or depending on how lax NI's IT policies were, it could have simply been something like a switch ACL redirect using Netgears terminology [1] or a Policy Routing [2] to use Cisco terminology off to some other device that appears to be of Chinese origin. Now its unlikely to be a BGP hijack like the one mentioned here [3], but having spoken with Cisco staff in the past, they do have a constant battle with hackers hacking their switches, but when looking at articles like EoL devices not having zero days fixed [4], does this demonstrate an old security risk or newly added security risk designed to force customers to upgrade to newer equipment? Monitoring the CVE's of devices, can highlight business practices, much like Youview here in the UK issuing a final update to multiple TalkTalk TV Huawei DN372T TV boxes which caused them to overheat and hang with now obvious way to downgrade to the previous stable version. Anyway I doubt it was some sort of BGP hijack [5] and I doubt it was some lizard squad-esque home router hack [6], and I am aware some multi functional home devices are simply not as robust as dedicated commercial solutions, by virtue of having a reduced attack vector by being dedicated to one task. But saying that, how hard is it reverse engineer firmware? We see firmware updates when cars engine management software gets remapped, why not an internal switch that for all intents and purposes appears to be the genuine article? There are ways to monitor some devices at the cpu instruction level like an Intel Processor Trace [7], much like a Jtag can also solicit information [8,9,10]. Thing is we dont know and there lots of possible attack vectors which could be deliberately misleading, like a member of staff losing a usb stick with staff data on somewhere between work, the pub and home[11]. Now considering how long ago some of these encrypted devices were lost, if one is stilling holding onto said device, biding time waiting for CVE's to appear in years to come, also seems to be a valid attack vector. I used to do that with my old hard drives all the time, ie put them into cold storage for a few years, then reactive them and see what viruses and other malware were now being detected on them. Its a constant moving target and time always tells, anyway I'm not disputing how things should work, but I know that interesting results can be obtained with misconfigurations. [1] https://kb.netgear.com/21728/How-do-I-redirect-a-traffic-stream-using-the-web-interface-on-my-managed-switch https://kb.netgear.com/21728/How-do-I-redirect-a-traffic-str... [2] https://www.cisco.com/c/en/us/support/docs/ip/ip-routed-protocols/47900-cat3550pbr.html https://www.cisco.com/c/en/us/support/docs/ip/ip-routed-prot... [3] https://news.ycombinator.com/item?id=30561518 https://news.ycombinator.com/item?id=30561518 [4] https://www.bleepingcomputer.com/news/security/cisco-won-t-fix-authentication-bypass-zero-day-in-eol-routers/ https://www.bleepingcomputer.com/news/security/cisco-won-t-f... [5] https://web.archive.org/web/20220629190453/https://bgpstream.crosswork.cisco.com/event/287556 https://web.archive.org/web/20220629190453/https://bgpstream... [6] https://www.forbes.com/sites/insertcoin/2015/07/09/lizard-squad-hacker-who-shut-down-psn-xbox-live-and-an-airplane-will-face-no-jail-time/?sh=72d980dd2ecd https://www.forbes.com/sites/insertcoin/2015/07/09/lizard-sq... [7] https://www.intel.com/content/www/us/en/developer/videos/collecting-processor-trace-in-intel-system-debugger.html https://www.intel.com/content/www/us/en/developer/videos/col... [8] https://spritesmods.com/?art=hddhack&page=3 https://spritesmods.com/?art=hddhack&page=3 [9] https://www.cisco.com/c/en/us/products/routers/8000-series-routers/trustworthy-framework.html#~trusting-hardware-components https://www.cisco.com/c/en/us/products/routers/8000-series-r... [10] https://www.cisco.com/c/en/us/td/docs/dcn/nexus3550/smartnic/sw/user-guide/cisco-nexus-smartnic-user-guide/exanic-x10x40.html https://www.cisco.com/c/en/us/td/docs/dcn/nexus3550/smartnic... [11] https://www.itpro.co.uk/607833/government-usb-lost-in-pub-car-park https://www.itpro.co.uk/607833/government-usb-lost-in-pub-ca...