Hacker News Reader

Comment by austincheney | Hacker News Reader

You couldn't transfer it over the network anyways, because the networks are physically separated from the normal internet (NIPR). You cannot use massive storage devices either (like hard disks, sd cards, flash drives). He would have had to hand carry stuff out, probably on optical media.

View on HN

> probably on optical media.

I cringe thinking NSA would have DVD-burners connected to any machine on their campus. Sure in their labs they probably have every device ever made -- strictly labeled and used only for hacking. But it would be asinine to have their "corporate" machines equipped with them. I bet he either used a microSD card or just put HDDs in his pocket.

You need optical media to transfer content from one network to another without setting off alarms. The network admin knows if you plug in mass storage devices within about 2 seconds. Mass storage devices require a mounting process that communicates with both the bios and the OS. The OS will then send an alert to a known point on the network, and if configured directly will respond to the switch at the local network which will drop the subnet. If you are dumb enough to pop a USB device in everybody in your office will know in seconds as they lose their connection. Then your boss will get scolded and you will get stuck with remedial training. It is pretty damn embarrassing like wearing a dunce cap. They may not always know who the offending person is, but they will have the IP of the offending terminal and a hardware signature of the offending device.

Yup, many organizations have this policy enforced. It'd be crazy to think a place like NSA would let you connect your USB stick to any of their terminals.

What if he had a legit reason for connecting mass storage, but just abused the privilege while connected? Network admins know he's connecting it, know what he says he's doing, has approved it and thus overrides and ignores any warnings...

Equally, what's to stop them being in the know of exactly what he's doing and abusing their privilege to allow him to do it? You assume he's acting alone... what if he wasn't?

The best lies contain elements of truth... or are almost entirely true. Find a legit reason for bypassing security and while you're bypassed, abuse it without getting caught.

> Equally, what's to stop them being in the know of exactly what he's doing and abusing their privilege to allow him to do it? You assume he's acting alone... what if he wasn't?

Because violations and exceptions to policy are logged and those logs are periodically audited. There is a process for achieving access with an exception to policy for various approved reasons. Deleting entries from access control logs requires an accomplice that doesn't mind jail time. At some point this starts to sound like a crazy conspiracy theory.

I find the most simple answers are generally the most probable. Let's not forget this went on for nearly 20 years and security staff gets rotated.

They have to transfer data from the high side to the low side somehow, and supposedly carefully-scrutinized DVD burners is one way of doing this.

Ah, great points. Thanks.

Reply on news.ycombinator.com