Hacker News Reader

Comment by BurningFrog | Hacker News Reader

> they have an active infiltrator in Twitter

If I was China, I'd go for this. Twitter has thousands of employees, many of which can surely be turned with some pressure. Also many who has family in China that can be used for leverage.

View on HN

I’d have to imagine this is very common, and they’ve probably got one at all the big tech companies. It’s an underreported threat IMO. Who would say no to doubling their salary in exchange for running the occasional DB query for their home country?

I expect a lot of people would say no to that and report the attempt to company security.

Of course, if I'm China, I can try it with enough people to get several assets.

Also, of the offer includes "we won't kill your grandma", uptake might be higher.

> I expect a lot of people would say no to that and report the attempt to company security.

Turning someone is rarely an upfront request.

You make friends with them and make small talk about politics to see if there are any sympathies to your cause.

Ask for a small favor and see if they'll do it, then progress slowly. You only ask them to break the law once they're already on your side.

And if a little persuasion was needed, the folder with evidence of assets secrets that would turn their life upside down if revealed. Ideally real secrets, but these days made up ones are probably as effective.

Motives for spying are varied: https://en.wikipedia.org/wiki/Motives_for_spying

> MICE: Money, Ideology, Compromise, and Ego or Extortion (depending on source)

> RASCLS: Reciprocation, Authority, Scarcity, Commitment and Consistency, Liking, and Social Proof.

Social engineering at its finest.

Also common spy recruitment tactic.

Oh boy, I’d encourage you to work in government for a year or two. I did IT for a government department that eventually wound up being investigated for letting the Taliban use their equipment (all I did was help them troubleshoot run of the mill PC issues FWIW). I personally know someone who had root access to a government land auction DB. Someone asked them to run “off the book” queries in exchange for looking the other way if said DBA wanted to run their own unaudited queries.

At competent companies -- I make no claim about Twitter here, but certainly at Google or at my employer -- it is extremely uncommon to have access to that database. All requests to access are logged and individually permissioned. Asking to access without a good reason, such as attachment to an active customer ticket, etc -- will get a hard no.

But at the same time, there's usually a way round it. For example, break the account in some way so the user opens a ticket, then grab the ticket and dump the whole contents of the account to 'debug'.

Who watches the watchers?

Doubling their salary? People have sold secret classified data for just thousands of dollars worth of gift cards.

At a public company like Twitter, for SOX compliance reasons, it will be very difficult to find someone that has such permissions, and running anything unusual can be easily found by auditing. I'd stop with the conspiracy theories.

https://www.washingtonpost.com/national-security/former-twit...

In general, most companies want to scope SOX as narrowly as possible. So if you can, only things that your auditors think will affect revenue reporting.

Querying ads performance data? Sure, we'll SOXify it. Querying user accounts writ large? "Meh, our engineers need to be productive."

SOX doesn't really stop this kind of prying, and it has happened in the past.

https://www.npr.org/2019/11/07/777352750/how-saudi-arabia-us...

SOX is about financial compliance. It is not a computer security standard.

I’ve worked for lots of SOX companies as a third party and had root/sqlplus on most of them. There’s really to relationship between SOX and security.

There are always weaknesses and internal vulnerabilities in every system.

If it was from the inside more likely a privileged user was compromised. It could also explain why Twitter is being quiet, especially if the investigation is ongoing.

Anyone who isn't stupid. Considering how may big corporations have ties with government agencies, if you try to pull something like that and you get caught you could easily be charged with espionage.

Even people with large IQs can be 'temporarily' stupid. Hence the term "lapse in judgement." Somebody who's intelligent but lets their ego run wild might believe they're too smart to get caught.

Why go to all that trouble? Why not just send their version of a National Security Letter?

That is how the Saudis did it.

https://www.npr.org/2019/11/07/777352750/how-saudi-arabia-us...

Saudis and many OGUsers kids.

Saudis are amateurs.

It doesn't scale -- the more you do it, the more likely one of them is to squeal or be caught, then MSS would be leaking their priority target list straight to the the FBI. Instead they would carefully target people with access, but not necessarily force them to divulge information / tamper with systems except when they really need it.

Occam's razor supports this one. Which would also bring liability to Twitter for not taking adequate steps to secure their servers.

It's not like they get l337 h4xx0rs to pwn their internal systems; they probably just have login credentials or permissions they shouldn't have, which aren't audited, and they can sneak things out in plain sight.

this begs the question: is it a security liability to hire anyone with any family in China?

Reply on news.ycombinator.com