Hacker News Reader

Comment by qbasic_forever | Hacker News Reader

I do think a lot of folks are missing the main point that no matter what security theater is in place, a state actor with enough motivation is going to breach it. They're not going to send someone after the password protected parts, they're going to send your recruiter the most irresistible candidate--the perfect background, right out of your favorite school and with expertise in exactly your tech stack. You'll get pages and pages of glowing recommendations from people inside and around the industry. They'll ace your interview loops, be loved by all your engineers and managers, and they won't bat an eye at the lowball first offer you give them. They'll move up the corporate ranks with ease and be everyone's friend... and then the best security in the world doesn't matter one bit.

View on HN

care to add examples? has there ever been a case when state actor sent a rogue employee and succeeded? because in serious organizations there are robust defenses even against potentially rogue employees

Stuxnet is the one that comes to mind first, where a Polish mole was able to be hired at an Iranian nuclear enrichment facility.

Could you cite that? Why would they need to infect flash drives all around the world if they had a mole directly inside the facility?

Edit: grepping Wikipedia for “mole” it does appear that there was an Iranian one working with the Dutch government.

https://en.wikipedia.org/wiki/Stuxnet#cite_ref-156

Not exactly what OP mentioned, but something like that did happen in the past:

https://www.theguardian.com/technology/2010/jul/14/russian-s...

I thought China does this all the time.

https://www.fbi.gov/news/speeches/responding-effectively-to-...

economic espionage is different thing and yes it exists. for example Huawei equipment - is cheap and low quality Cisco ripoff. But it is no different than employees in Silicon Valley changing companies and taking their knowledge to the competitor. In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me

Has Lucid Motors's founder (former Tesla employee) conducted economic espionage or is it simply capitalism working as intended?

> In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me

You may wish to ask Nortel about that:

* https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s...

* 7m ago: https://news.ycombinator.com/item?id=23743869

There's a long list of criticisms against Huawei:

* https://en.wikipedia.org/wiki/Criticism_of_Huawei

I read the Nortel thread and apparently the Nortel management killed the company.

Are there? I've done some hiring and I don't recall any procedures in place for the detection of foreign intelligence assets. I suppose it is possible that I have never worked for a serious organization.

Security clearances would help, but obviously that's not something that's going to be tenable for all companies.

I think the main way to prevent issues is to just assume at any time you could be infiltrated. Don't mistrust all your employees, but don't live with lax security policies that allow a person to get away with something undetected.

Google learned this the hard way, between the Snowden revelations and China's cyberattacks.

Audit trails are important, as is, um, not giving read access to user data without really really good justifications. Even beyond espionage, employees could stalk personal contacts (as happened at Uber in 2016 and Facebook in 2018).

My reading of the comment was that the protections are in the form of limiting what insiders can do / auditing what they do, rather than in detecting them during the hiring process.

I have yet to come across such an organisation, actually, and I'm a security consultant. The scenario is usually if an employee's systems get hacked, very few "serious organisations" seem to have procedures for rogue employees, at least seen from an EU perspective (perhaps the culture is different in the USA or in poorer parts of the world).

it is hard to catch expert rogue employees, but there are systems like conducting security clearance, DLP, UEBA, airgapped system separation (low security, medium security, high security), and ton of other security layers/controls that together can give some assurance

It is _far_ more common than you think. A few years after I started at MS this guy was caught: https://www.theatlantic.com/international/archive/2010/07/wh... I knew a lot of folks internally that worked with him, knew him, etc. and had _no idea_ he was a spy or agent. He was the model of a perfect employee or hire for MS at the time.

wow, so this guy worked as senior developer for infosec vendor NeoBIT (neobit.ru/partners openly cites FSB as their #1 client) and then gets a QA tester job at MSFT, no wonder DHS tracked him since he applied for visa.

see, these people are not that smart, actually

Sure, but those are the people that have been caught. The ones actually making a difference will likely never be known.

https://www.nytimes.com/2019/11/06/technology/twitter-saudi-...

While this happened to me in 2004, I can still see it working even today: http://boston.conman.org/2004/09/19.1

You don't receive insider threat training at work? There's plenty of examples given during that sort of training.

The FBI gave some examples in their published literature on the topic.

https://www.fbi.gov/file-repository/china-risk-to-corporate-...

That's an excessively long game--much easier to compromise someone already in a position.

why not both?

States and powerful, well-funded adversaries have all the time in the world. Look at the 9/11 attacks, the hijackers were taught how to fly planes by US flight schools!

I don't know that getting a job is anywhere near "an excessively long game" in the context of publicly known instances of espionage. Have you heard about the group of Russian spies that spent decades blending in (somewhat) to US lives and doing nothing much?

https://en.wikipedia.org/wiki/Illegals_Program

They were arrested around 2010; one had allegedly been a spy for ten years, and another since the 1970s.

It seems like there are two (or more) issues:

1) Any inviting target will be ... targeted and so likely breached at least at some points. The article is correct that expect a single target to invulnerable is a mistake.

2) US (and other corporate) systems download untestable binary blobs from third parties as standard operating procedure, not because no one understands the risks but because they aren't concerned with the eventual costs (and happy with the immediate benefits). Similarly, everything gets connected to everything in a whole variety of systems (the sabotaged water system and the cars sabotaged by auto-maker-server-sabotage are just things coming through in the last few days or weeks).

It seems like a critical analysis should look at point two so the article's nothing can be done implication is here not appealing. Here, the problem seems hypothetically addressable. This may also be unsolvable but it seems closer to solvable. If the US imposed cyber security standards, a solution would seem more likely, etc.

An engineer with a great pedigree and work background and social finesse who passes all interviews and interaction without detection... Willing to take on a high risk role... All for the good of the homeland?

I think you're describing a work of fiction. It's practically a James Bond or Bruce Wayne-like character. This particular person would be extremely hard to find/hire/compel by some competing nation, if they even exist.

You may be underestimating the recruiting efforts and budgets of major nation-state intelligence agencies - Russia and China are doing exactly the same thing the US has been doing for a long time. Spending some tens of millions of dollars to accomplish inserting an advanced persistent threat inside of software used by some huge percentage of the US federal government is a tiny drop in the bucket of the budget of such agencies.

The main difference is that the US has historically accomplished it through a role in many cases as a vendor, or a supplier of essential high tech stuff (CIA/NSA and Crypto AG for instance).

Meet Jack Barsky.

https://en.wikipedia.org/wiki/Jack_Barsky

Doesn't quite fit the image of perfection described above

> I think you're describing a work of fiction. It's practically a James Bond or Bruce Wayne-like character.

Diane Feinstein, the _Chair of the Senate Intelligence Committee_, had a Chinese spy as her personal driver _for 20 years_. So yes, slipping engineers into tech companies is not that complicated and in fact happens all the time.

And then they move up the corporate ladder, loved by all? Read OP's original description, not the same. Driver spy is not a counterpoint.

Isnt that the FBI's job to vet people?

The good of the homeland and money. You're essentially being paid to do two jobs. Go work for a good salary in a foreign country, and then collect a good salary from your intelligence agency.

Hell if you're targeting the US, why not do it? The worst that can happen to you is that you'll be deported and go back home to work a great job within the government.

> The worst that can happen to you is that you'll be deported

This is demonstrably not true.

So... does anyone use Kaspersky anymore?

I mean any CTO or underling in any company could be an unknown "asset" --maybe mitigated a bit if they are scrutinized because of official contracts with GOV. These types may by simply naive and sympathetic to some politics elsewhere. All governments should be weary of these types, lest they have undesired outcomes.

But you don't have to run faster than the bear, you just have to run faster than the slowest person. All of this is theoretically possible but the cost has to be justified by the intelligence gain and there's very few security targets that are simultaneously worth the cost and not achievable via simpler means.

> Security theater is the practice of taking security measures that are intended to provide the feeling of improved security while doing little or nothing to achieve it.

https://en.wikipedia.org/wiki/Security_theater

Reply on news.ycombinator.com