4 ms·

I'm very curious who gets hired to write the code for a project like this. What caliber are they, what kinds of backgrounds do they come from, and how are they

I'm very curious who gets hired to write the code for a project like this. What caliber are they, what kinds of backgrounds do they come from, and how are they recruited to these positions? Is this more likely to be done by a government agency or a defense contractor? I have always assumed that the world's most talented hackers work in places like Silicon Valley and Wall Street, but Stuxnet was clearly the work of some brilliant minds, so I'm curious.

ars 14y ago
If it's Israel then they come from the military which is the first place students go after school - so they do in fact have access to the world's most talented hackers. A lot of them go on to create startups after finishing service. See: http://news.ycombinator.com/item?id=977176 http://news.ycombinator.com/item?id=977176 for a bit more.
maukdaddy 14y ago
Both agencies and contractors employee people with the skillsets needed to write these kinds of things. While there are a large number of incompetent government employees and contractors, there are also a small number of frighteningly talented developers working in this area.
- ImprovedSilence 14y ago
  It's the same with any big company, and it kind of boils down to the adage: "20% of the people do 80% of the work".
  - chii 14y ago
    i sometimes wish that there's some sort of darwinian selection system that could be put in place, in order to improve the overall efficiency and productivity of companies...but then again, i m writing this from my work terminal...
brigade 14y ago
I think there are defense contractors that develop and weaponize exploits, rootkits, and so on for the government and while I'm sure some of that work was used in Stuxnet, I think anything specific to Stuxnet was handled by actual governmental agencies. The article names the NSA and an Israeli unit. As for recruiting, you wouldn't ever get recruited directly to such a project - you'd already need a TS/SCI clearance and to have proven yourself within the NSA. As for recruiting into the general field of classified cybersecurity, it's not too much different from any other field; they post job ads, scour college campuses, probably advertise at defcon, etc. Generally if you're getting hired without a clearance it's not for a specific position - it takes upwards of half a year before you get cleared and can start, at which point they figure out which project to put you in. As for the most talented hackers, keep in mind the subject area: Wall Street has very little demand for security researchers, and Silicon Valley's demand for them is minuscule compared to the government's.
- juuso 14y ago
  For example this one seems fairly direct to me: http://www.clearancejobs.com/jobs/1536410/cyber-software-engineer-2 http://www.clearancejobs.com/jobs/1536410/cyber-software-eng...
  - narcissus 14y ago
    Can someone explain to me how Google Earth is considered a 'security research' tool (as mentioned in 'Preferred Qualifications')? I'm woefully clueless when it comes to this realm of software, so I'd love for some insight.
    - deleted 14y ago
      [deleted]
- seanp2k2 14y ago
  VUPEN provides 0-days to governments http://www.vupen.com/english/ http://www.vupen.com/english/
krschultz 14y ago
Just a guess, but the public options are basically the NSA and their contractors (ex. Booz Allen Hamilton). There are excellent hackers in those places.
sukuriant 14y ago
You'd be surprised how many brilliant hackers are working in department stores for very low wages, just doing tech support or some other job.
kitsune_ 14y ago
Israel owns companies such as IAI which in turn operate subsidiaries such as IAI ELTA (http://www.iai.co.il/17887-en/Groups_ELTA.aspx http://www.iai.co.il/17887-en/Groups_ELTA.aspx) They also operate a nuclear program. They have world class technical universities. The military is a huge employer for engineers and researchers in Israel. If they can create and market high-tech SIGINT / ELINT / EW / COMINT systems, a nation like Israel should be able to create programs such as STUXNET. They have the know how and expertise. In response to your question. In Israel, a small country, you have mandatory military service, a close relationship between the private sector, government and military, I think the path for an engineer is very clear cut if he or she wants to enter this domain of work. Vice versa, the government will have no problem finding you.
yukoncornelius 14y ago
The work is farmed out to the National Labs and federally funded RDCs from a coordinating office: "Olympic Games borrowed some for what they termed "destructive testing," essentially building a virtual replica of Natanz, but spreading the test over several of the Energy Department's national laboratories to keep even the most trusted nuclear workers from figuring out what was afoot." The engineers working on the P-1s are employed by Sandia, ORNL, LANL, Mitre, RAND, SRI, etc and are in the dark about project specifics due to compartmentalization. Want a job: http://www.sandia.gov/careers/students_postdocs/internships/institutes/cyber_defenders.html http://www.sandia.gov/careers/students_postdocs/internships/...

ars 14y ago

If it's Israel then they come from the military which is the first place students go after school - so they do in fact have access to the world's most talented hackers. A lot of them go on to create startups after finishing service. See: http://news.ycombinator.com/item?id=977176 http://news.ycombinator.com/item?id=977176 for a bit more.

maukdaddy 14y ago

Both agencies and contractors employee people with the skillsets needed to write these kinds of things. While there are a large number of incompetent government employees and contractors, there are also a small number of frighteningly talented developers working in this area.

ImprovedSilence 14y ago
It's the same with any big company, and it kind of boils down to the adage: "20% of the people do 80% of the work".
- chii 14y ago
  i sometimes wish that there's some sort of darwinian selection system that could be put in place, in order to improve the overall efficiency and productivity of companies...but then again, i m writing this from my work terminal...

brigade 14y ago

I think there are defense contractors that develop and weaponize exploits, rootkits, and so on for the government and while I'm sure some of that work was used in Stuxnet, I think anything specific to Stuxnet was handled by actual governmental agencies. The article names the NSA and an Israeli unit. As for recruiting, you wouldn't ever get recruited directly to such a project - you'd already need a TS/SCI clearance and to have proven yourself within the NSA. As for recruiting into the general field of classified cybersecurity, it's not too much different from any other field; they post job ads, scour college campuses, probably advertise at defcon, etc. Generally if you're getting hired without a clearance it's not for a specific position - it takes upwards of half a year before you get cleared and can start, at which point they figure out which project to put you in. As for the most talented hackers, keep in mind the subject area: Wall Street has very little demand for security researchers, and Silicon Valley's demand for them is minuscule compared to the government's.

juuso 14y ago
For example this one seems fairly direct to me: http://www.clearancejobs.com/jobs/1536410/cyber-software-engineer-2 http://www.clearancejobs.com/jobs/1536410/cyber-software-eng...
- narcissus 14y ago
  Can someone explain to me how Google Earth is considered a 'security research' tool (as mentioned in 'Preferred Qualifications')? I'm woefully clueless when it comes to this realm of software, so I'd love for some insight.
  - deleted 14y ago
    [deleted]
seanp2k2 14y ago
VUPEN provides 0-days to governments http://www.vupen.com/english/ http://www.vupen.com/english/

krschultz 14y ago

Just a guess, but the public options are basically the NSA and their contractors (ex. Booz Allen Hamilton). There are excellent hackers in those places.

sukuriant 14y ago

You'd be surprised how many brilliant hackers are working in department stores for very low wages, just doing tech support or some other job.

kitsune_ 14y ago

Israel owns companies such as IAI which in turn operate subsidiaries such as IAI ELTA (http://www.iai.co.il/17887-en/Groups_ELTA.aspx http://www.iai.co.il/17887-en/Groups_ELTA.aspx) They also operate a nuclear program. They have world class technical universities. The military is a huge employer for engineers and researchers in Israel. If they can create and market high-tech SIGINT / ELINT / EW / COMINT systems, a nation like Israel should be able to create programs such as STUXNET. They have the know how and expertise. In response to your question. In Israel, a small country, you have mandatory military service, a close relationship between the private sector, government and military, I think the path for an engineer is very clear cut if he or she wants to enter this domain of work. Vice versa, the government will have no problem finding you.

yukoncornelius 14y ago

The work is farmed out to the National Labs and federally funded RDCs from a coordinating office: "Olympic Games borrowed some for what they termed "destructive testing," essentially building a virtual replica of Natanz, but spreading the test over several of the Energy Department's national laboratories to keep even the most trusted nuclear workers from figuring out what was afoot." The engineers working on the P-1s are employed by Sandia, ORNL, LANL, Mitre, RAND, SRI, etc and are in the dark about project specifics due to compartmentalization. Want a job: http://www.sandia.gov/careers/students_postdocs/internships/institutes/cyber_defenders.html http://www.sandia.gov/careers/students_postdocs/internships/...