3 ms·
> Analyzing the wiki pages they accessed, bug database issues, and source code repositories, it appears they were looking for information about the architecture
by kccqzy 3y ago
> Analyzing the wiki pages they accessed, bug database issues, and source code repositories, it appears they were looking for information about the architecture, security, and management of our global network; no doubt with an eye on gaining a deeper foothold.
For a nation state actor, the easiest way to accomplish that is to send one of their loyal citizens to become an employee of the target company and then have the person send back "information about the architecture, security, and management" of the target company.
Fun (but possibly apocryphal) fact: more than a decade ago in a social gathering of SREs at Google, several admitted to being on the payroll of some national intelligence bureaus.
- toyg 3y agoNot if such citizens are sanctioned. Code Red. Hint hint.
- elashri 3y agoI think this probably was a name after the famous Code Red worm [1], not a reference to China. [1] https://en.wikipedia.org/wiki/Code_Red_(computer_worm) https://en.wikipedia.org/wiki/Code_Red_(computer_worm)
- curiousgal 3y agoIt's the tech scene on the Internet, everything is a reference to the CCP! /s
- duskwuff 3y agoOr after the flavor of Mountain Dew which was that worm's namesake. Not all names have to make sense. :)
- eep_social 3y ago> we redirected the efforts of a large part of the Cloudflare technical staff (inside and outside the security team) to work on a single project dubbed “Code Red”. Code red is a standard term in emergency response that means smoke/fire. In general, in order to “redirect” that much effort one must do some paperwork to prove the urgency and immediacy of the threat. The MO screams China to me but I wouldn’t read anything into the name “code red” which would have been selected before they identified the specific threat actor anyway.
- eastdakota 3y agoThe name has nothing to do with where we believe the attacker came from. We borrowed it from Google. At Google they have a procedure where, in an emergency, they can declare a Code Yellow or Code Red — depending on the severity. When it happens, it becomes the top engineering priority and whoever is leading it can pull any engineer off to work on the emergency. Those may not be the exact details of Google's system but it's the gist that we ran with. We'd had an outage of some of our services earlier in the Fall that prompted us to first borrow Google's idea. Since our logo is orange, we created "Code Orange" to mitigate the mistakes we'd made that led to that outage. Then this happened and we realized we needed something that was a higher level of emergency than Code Orange, so we created Code Red. At some point we'll write up how we thought of the rules and exit criteria around these, but I think they'll become a part of how we deal with emergencies that come up going forward.
- hn_go_brrrrr 3y agoYeah, that's a pretty accurate description of the color code system. There's some additional nuance to it, but a code red is an immediate existential threat to the business.
- eep_social 3y agoHa, I almost mentioned Google, having been through a code red myself, but it felt like a reach so I went elsewise with my comment! I believe it’s safe to assume google pulled it from emergency response given that their approach to incident management inherits heavily from ICS.
- dmvdoug 3y agoDid you order the code red?! I want the TRUTH. (Sorry, so sorry, it was just too low-hanging not to to pluck: https://m.youtube.com/watch?v=W2G2sac9s34 https://m.youtube.com/watch?v=W2G2sac9s34)
- 4gotunameagain 3y ago> The MO screams China to me How exactly ? Nothing out of the ordinary/regular infiltration, investigation and attempt to move laterally is exposed.
- neilv 3y ago> Fun (but possibly apocryphal) fact: more than a decade ago in a social gathering of SREs at Google, several admitted to being on the payroll of some national intelligence bureaus. They had government engagements with Google's consent, and all those various engagements could be disclosed to each other? If not, what kind of drugs were flowing at this social gathering, to cause such an orgy of bad OPSEC?
- slowbdotro 3y agoKnowing google employees, it's coke. Lots of coke
- neilv 3y agoAt last, an explanation for their fratbro interviews.
- aitchnyu 3y agoCould you explain? Never been exposed to fraternities or Google.
- dijit 3y agoRitualistic hazing of newcomers is a large part of american "frat" culture. What the parent is likely referring to is: Things like "Wearing the noogler hat" or the hoops you jump through in interview (that have nothing to do with the job) are similar in spirit to some university fraternities admission processes, or are depicted as such in media.
- neilv 3y agoYes, also the latent class filtering, and the general "coked-up fratbro" behaviors, like enthusiastically and energetically pursuing ideas that make no sense. (No sense includes hiring for people who obsessively focus their time on memorizing and rehearsing for the rituals to get into that one frat.)
- _kb 3y agoPayroll? You guys are getting paid? Australians get the 'opportunity' to be part of that sort of that sort of espionage as a base level condition of citizenship [0]. As an upside, I guess it helps with encouraging good practices around zero trust processes and systems dev. [0]: https://en.wikipedia.org/wiki/Mass_surveillance_in_Australia#Telecommunications_and_Other_Legislation_Amendment_(Assistance_and_Access)_Act https://en.wikipedia.org/wiki/Mass_surveillance_in_Australia...
- owlstuffing 3y ago> For a nation state actor, the easiest way to accomplish that is to send one of their loyal citizens to become an employee of the target company Precisely. Particularly in the case of US businesses. Why bother picking a lock when you have both the key and permission?