Hacker News Reader

Comment by slt2021 | Hacker News Reader

slt2021

care to add examples? has there ever been a case when state actor sent a rogue employee and succeeded? because in serious organizations there are robust defenses even against potentially rogue employees

View on HN

It is _far_ more common than you think. A few years after I started at MS this guy was caught: https://www.theatlantic.com/international/archive/2010/07/wh... I knew a lot of folks internally that worked with him, knew him, etc. and had _no idea_ he was a spy or agent. He was the model of a perfect employee or hire for MS at the time.

wow, so this guy worked as senior developer for infosec vendor NeoBIT (neobit.ru/partners openly cites FSB as their #1 client) and then gets a QA tester job at MSFT, no wonder DHS tracked him since he applied for visa.

see, these people are not that smart, actually

Sure, but those are the people that have been caught. The ones actually making a difference will likely never be known.

Stuxnet is the one that comes to mind first, where a Polish mole was able to be hired at an Iranian nuclear enrichment facility.

Could you cite that? Why would they need to infect flash drives all around the world if they had a mole directly inside the facility?

Edit: grepping Wikipedia for “mole” it does appear that there was an Iranian one working with the Dutch government.

https://en.wikipedia.org/wiki/Stuxnet#cite_ref-156

I thought China does this all the time.

https://www.fbi.gov/news/speeches/responding-effectively-to-...

economic espionage is different thing and yes it exists. for example Huawei equipment - is cheap and low quality Cisco ripoff. But it is no different than employees in Silicon Valley changing companies and taking their knowledge to the competitor. In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me

Has Lucid Motors's founder (former Tesla employee) conducted economic espionage or is it simply capitalism working as intended?

> In the former, people relocate from one company in the valley to China, in the latter, people go from one SV company to another. Same thing for me

You may wish to ask Nortel about that:

* https://www.bnnbloomberg.ca/did-a-chinese-hack-kill-canada-s...

* 7m ago: https://news.ycombinator.com/item?id=23743869

There's a long list of criticisms against Huawei:

* https://en.wikipedia.org/wiki/Criticism_of_Huawei

I read the Nortel thread and apparently the Nortel management killed the company.

https://www.nytimes.com/2019/11/06/technology/twitter-saudi-...

Not exactly what OP mentioned, but something like that did happen in the past:

https://www.theguardian.com/technology/2010/jul/14/russian-s...

Are there? I've done some hiring and I don't recall any procedures in place for the detection of foreign intelligence assets. I suppose it is possible that I have never worked for a serious organization.

Security clearances would help, but obviously that's not something that's going to be tenable for all companies.

I think the main way to prevent issues is to just assume at any time you could be infiltrated. Don't mistrust all your employees, but don't live with lax security policies that allow a person to get away with something undetected.

Google learned this the hard way, between the Snowden revelations and China's cyberattacks.

Audit trails are important, as is, um, not giving read access to user data without really really good justifications. Even beyond espionage, employees could stalk personal contacts (as happened at Uber in 2016 and Facebook in 2018).

My reading of the comment was that the protections are in the form of limiting what insiders can do / auditing what they do, rather than in detecting them during the hiring process.

You don't receive insider threat training at work? There's plenty of examples given during that sort of training.

The FBI gave some examples in their published literature on the topic.

https://www.fbi.gov/file-repository/china-risk-to-corporate-...

I have yet to come across such an organisation, actually, and I'm a security consultant. The scenario is usually if an employee's systems get hacked, very few "serious organisations" seem to have procedures for rogue employees, at least seen from an EU perspective (perhaps the culture is different in the USA or in poorer parts of the world).

it is hard to catch expert rogue employees, but there are systems like conducting security clearance, DLP, UEBA, airgapped system separation (low security, medium security, high security), and ton of other security layers/controls that together can give some assurance

While this happened to me in 2004, I can still see it working even today: http://boston.conman.org/2004/09/19.1

Reply on news.ycombinator.com