4 ms·

If any of you get this far down, one thing that caught my eye is that Google said they had analyzed this guy’s network traffic after locking his laptop, confirm

by ttul 3y ago

If any of you get this far down, one thing that caught my eye is that Google said they had analyzed this guy’s network traffic after locking his laptop, confirming various things. If you work at a large company like Google, every packet on their employee access network is recorded and indexed for forensic purposes. This is not something Google would talk about publicly, but it’s standard practice in any company that is a serious target for sophisticated cyberespionage to spend a great deal on specialized equipment that can log all network traffic at scale.

cryptoBros2023 3y ago
Why don’t they steal these documents by taking a photo using a camera? I feel like a genius be the first one thought of this.
alephnerd 3y ago
It's SOP in all companies, not just those facing sophisticated threat actors - there's a reason EDRs like Crowdstrike and SentinelOne are massive players now.
- deelowe 3y ago
  I've never been exposed to that side of things but always wondered do certain levels datamine this information? For example, do they get reports on user activity during the day... A pareto of employee activity perhaps by userid? I mean, why wouldn't they?
  - leetcrew 3y ago
    why would they? if we're talking about sophisticated espionage, that's more of a job for infosec. if we're talking about AFK time, being secretive defeats the purpose.
  - flextheruler 3y ago
    I’ve done this sort of work and my anecdotal experience was it is mostly used to flag blacklisted activities from occurring on the computer spanning things like porn and gambling sites to administrative privileges, but also to modify what level of access these computers had for interacting with different infrastructure between silos. You could use the data to identify activity levels or behavior patterns of the people using the device but it would cost a ton more money and a larger team to do that plus the other responsibilities we had simultaneously. My experience is also not with employee owned devices so in my mind there’s nothing wrong with doing it’s agreed to and is imperative to their function as an employees especially with HIPPA concerned. I think there was some BYOD stuff that was starting at one point and we had to run an emulator on their personal devices so the programs we run to collect logs were sandboxed from their regular phones.
  - Nerada 3y ago
    Essentially you hook up all your log sources to a User and Entity Behaviour Analytics (UEBA) platform, it comes up with a model of "normal" behaviour, and flags users for investigation when they start acting outside of those norms (or things you want to explicitly flag on). No data egress for 6 months, then 20GBs of outbound traffic? Someone's getting notified to take a look and see what that was and where you sent it. You only authenticate against one host on the network, and suddenly you're hitting thousands of hosts? Someone's getting notified to investigate, &c.
- NooneAtAll3 3y ago
  what does EDR mean?
  - rrdharan 3y ago
    Endpoint Detection and Response
- bongodongobob 3y ago
  As someone who has worked at companies, it sure as fuck is not. Unless you are a very valuable company or you make money with data/software, ain't nobody got time for that.
  - fomine3 3y ago
    Yeah, install EDR for satisfaction and forget.
- opello 3y ago
  It absolutely has to be more nuanced than "there's exabytes of pcaps somewhere" because cloning repositories, pushing branches, backups, these things would basically end up being nasty amplification attacks against the ability to store this data. And block dedupe can work for some storage loads, but it's not solving this problem, especially when that git clone came over ssh or https. Data from employee devices all being captured and stored? That seems plausible. All data on the corporate network? Less so to my naive mind. I'd love to hear exactly how that works and what kind of retention exists for it. What seems far more likely is that there's a rules engine that can see all the traffic and makes a decision about if it trips an event to be logged or looks strange enough to be captured (along with some amount of surrounding context, if possible).
  - bongodongobob 3y ago
    Yeah you plug holes so you don't have to audit everything. Disable USB ports, alert on large file transfers, audit file access and device logins, no access to local network shares off-site, etc. That's probably good enough for 99% of the world. Capturing all network traffic is absurd and I doubt that's even a thing. You'd need a department the size of the existing company to be able to manage and do anything meaningful with it. Maybe if you had a super secure jump box you could consider monitoring all the traffic on that, but there are much much easier ways to audit behavior than network traffic. Monitor the devices instead.
orochimaaru 3y ago
This is standard practice in all big companies. Everything is tracked and recorded. If you want to say something to a colleague that you don’t want management to know - use your personal phone and talk at a coffee shop or bar in person.
- resolutebat 3y ago
  It's indeed safe to assume everything is tracked and recorded and can be found if they bother to look for it, but a random line manager is not going to have access to any of it.
- kshacker 3y ago
  Asking for a friend :) On VPN at home, using my work laptop, I happen to browse some non-decent content, more than once, maybe routinely. Is that all tracked or do VPNs have routing to use VPN only for company network, and leave NSFW be handled by my ISP? Or even if is going via ISP and not company network, are the companies usually able to track what all sites I visit Not a Google employee BTW, but work for a company that I am reasonably sure does monitor their network.
  - orochimaaru 3y ago
    Is he on the corporate network on his work vpn? If so, this is recorded. You have to go via corporate proxies and use corporate dns. That’s easily trackable. If he’s installed something like mullvad on his work laptop and he’s able to tunnel out from the corporate network, he’s probably safe from the content but has broken policy on unauthorized software, the intent of which can be malicious. They won’t care in general. But if they want to get rid of him they’ll have the info ready.
  - toast0 3y ago
    Depends on the VPN config if it's everything, or just company resources. Split tunnelling seems uncommon from my experience with corp VPNs... But if you're on work equipment, they likely have corp spyware looking at all your browsing even if you're not on vpn. Shop for fans or whatever you need to do on personal equipment.

by ttul 3y ago

cryptoBros2023 3y ago

Why don’t they steal these documents by taking a photo using a camera? I feel like a genius be the first one thought of this.

alephnerd 3y ago

It's SOP in all companies, not just those facing sophisticated threat actors - there's a reason EDRs like Crowdstrike and SentinelOne are massive players now.

deelowe 3y ago
I've never been exposed to that side of things but always wondered do certain levels datamine this information? For example, do they get reports on user activity during the day... A pareto of employee activity perhaps by userid? I mean, why wouldn't they?
- leetcrew 3y ago
  why would they? if we're talking about sophisticated espionage, that's more of a job for infosec. if we're talking about AFK time, being secretive defeats the purpose.
- flextheruler 3y ago
  I’ve done this sort of work and my anecdotal experience was it is mostly used to flag blacklisted activities from occurring on the computer spanning things like porn and gambling sites to administrative privileges, but also to modify what level of access these computers had for interacting with different infrastructure between silos. You could use the data to identify activity levels or behavior patterns of the people using the device but it would cost a ton more money and a larger team to do that plus the other responsibilities we had simultaneously. My experience is also not with employee owned devices so in my mind there’s nothing wrong with doing it’s agreed to and is imperative to their function as an employees especially with HIPPA concerned. I think there was some BYOD stuff that was starting at one point and we had to run an emulator on their personal devices so the programs we run to collect logs were sandboxed from their regular phones.
- Nerada 3y ago
  Essentially you hook up all your log sources to a User and Entity Behaviour Analytics (UEBA) platform, it comes up with a model of "normal" behaviour, and flags users for investigation when they start acting outside of those norms (or things you want to explicitly flag on). No data egress for 6 months, then 20GBs of outbound traffic? Someone's getting notified to take a look and see what that was and where you sent it. You only authenticate against one host on the network, and suddenly you're hitting thousands of hosts? Someone's getting notified to investigate, &c.
NooneAtAll3 3y ago
what does EDR mean?
- rrdharan 3y ago
  Endpoint Detection and Response
bongodongobob 3y ago
As someone who has worked at companies, it sure as fuck is not. Unless you are a very valuable company or you make money with data/software, ain't nobody got time for that.
- fomine3 3y ago
  Yeah, install EDR for satisfaction and forget.
opello 3y ago
It absolutely has to be more nuanced than "there's exabytes of pcaps somewhere" because cloning repositories, pushing branches, backups, these things would basically end up being nasty amplification attacks against the ability to store this data. And block dedupe can work for some storage loads, but it's not solving this problem, especially when that git clone came over ssh or https. Data from employee devices all being captured and stored? That seems plausible. All data on the corporate network? Less so to my naive mind. I'd love to hear exactly how that works and what kind of retention exists for it. What seems far more likely is that there's a rules engine that can see all the traffic and makes a decision about if it trips an event to be logged or looks strange enough to be captured (along with some amount of surrounding context, if possible).
- bongodongobob 3y ago
  Yeah you plug holes so you don't have to audit everything. Disable USB ports, alert on large file transfers, audit file access and device logins, no access to local network shares off-site, etc. That's probably good enough for 99% of the world. Capturing all network traffic is absurd and I doubt that's even a thing. You'd need a department the size of the existing company to be able to manage and do anything meaningful with it. Maybe if you had a super secure jump box you could consider monitoring all the traffic on that, but there are much much easier ways to audit behavior than network traffic. Monitor the devices instead.

orochimaaru 3y ago

This is standard practice in all big companies. Everything is tracked and recorded. If you want to say something to a colleague that you don’t want management to know - use your personal phone and talk at a coffee shop or bar in person.

resolutebat 3y ago
It's indeed safe to assume everything is tracked and recorded and can be found if they bother to look for it, but a random line manager is not going to have access to any of it.
kshacker 3y ago
Asking for a friend :) On VPN at home, using my work laptop, I happen to browse some non-decent content, more than once, maybe routinely. Is that all tracked or do VPNs have routing to use VPN only for company network, and leave NSFW be handled by my ISP? Or even if is going via ISP and not company network, are the companies usually able to track what all sites I visit Not a Google employee BTW, but work for a company that I am reasonably sure does monitor their network.
- orochimaaru 3y ago
  Is he on the corporate network on his work vpn? If so, this is recorded. You have to go via corporate proxies and use corporate dns. That’s easily trackable. If he’s installed something like mullvad on his work laptop and he’s able to tunnel out from the corporate network, he’s probably safe from the content but has broken policy on unauthorized software, the intent of which can be malicious. They won’t care in general. But if they want to get rid of him they’ll have the info ready.
- toast0 3y ago
  Depends on the VPN config if it's everything, or just company resources. Split tunnelling seems uncommon from my experience with corp VPNs... But if you're on work equipment, they likely have corp spyware looking at all your browsing even if you're not on vpn. Shop for fans or whatever you need to do on personal equipment.