Hacker News Reader

Comment by alexpotato | Hacker News Reader

Reading articles like this always causes me to think two things:

1. If this is what a couple of smart guys can do as, essentially, a side project then I can only imagine what nation states with teams of people like this can accomplish.

2. I get why some orgs pour wax into the USB ports of their desktop machines.

View on HN

That was not a side project from my limited understanding ;) I believe the M$/Alphabet/Meta security teams are probably more advanced or on par with the best state sponsored teams. I could be wrong, plus the state sponsored teams might have infiltrated the FAANG security teams ;)

However, I think the FAANG companies act somewhat more restricted. Three letter agencies don't have qualms about things like "chloroforming security guards" and such.

Also, use USB Data Blocker dongles where possible.

NSA’s TAO surely has many orders of magnitude more budget than Google’s red team?

I don't think the NSA pays as well though. You also have large restrictions. Not just stuff like never having smoked weed in your life (we are talking about CS people...) but that once you even have a security clearance (a pain to get in the first place) you have a lot of daily life headaches. You have to carefully watch what you say. International travel has to be reported (and can even be a big hassle). Etc. I'm not sure if the same is true for Google's Red/Blue teams, but I feel pretty confident in saying that they probably get paid more.

Correct, government pay scale is a huge problem for talent acquisition. Your choices are either someone who is so ideologically devoted that they're willing to work for 5-25% of what they're worth or "work for us or you're going to prison for a long time".

Citations:

https://apply.intelligencecareers.gov/job-description/119486...

Cyber Mitigations Analyst/System Vulnerability Analyst - Entry to Expert Level (Maryland)

Network Cyber Mitigations Engineers and System Vulnerability Analysts analyze vulnerabilities and develop mitigations to strengthen defenses. They produce formal and informal reports, briefings, and guidance to defend against attacks against network infrastructure devices or systems. NSA analysts' competencies run the gamut of data transport possibilities. They work with traditional wired networks, wireless transport, including Wi-Fi and cellular, collaborative platforms such as video teleconferencing, and the hardware and software that support it all.

Pay Plan: GG, Grade: 07/1 to 15/10

https://www.opm.gov/policy-data-oversight/pay-leave/salaries...

In a very high cost of living area, that means that entry level is $31K and the absolute top for expert level is $176,300.

Compare that to what FAMG are paying new college grads.

Or "I'm a covert foreign asset, so I DGAF what I get paid."

Caps are getting raised, at least at DHS:

> The CTMS [Cybersecurity Talent Management System] salary range has an upper limit of the vice president's salary ($255,800 in 2021), plus an extended range for use in limited circumstances, which has an upper limit of $332,100 in 2021.

https://www.zdnet.com/article/the-us-government-just-launche...

Had a friend with a restriction like this and then switched to a more public unrestricted job.

To be honest, I liked hanging out with them more when they couldn't talk about work :)

All of this is true, but as a government agent, you will be much less likely to go to jail for participating in adversarial activities, which is not nothing.

Probably. It’s way handier if the keylogger is embedded into the cable from your usb-x monitor right when you open the fresh package.

But budget limited ingenuity is fun too!

It's really not hard to realize that organizations whose entire existence is predicated on actually cracking the security of other nation states might garner more investment than a red team focused on checking that your company's security is intact.

By many accounts they source exploits from the grey market, too.

It's certainly something someone could do as a side project, even if that wasn't strictly the case here.

> That was not a side project from my limited understanding ;)

First paragraph of the article:

> In episode #3, Daniel Fabian talks about the redteaming efforts - and in particular, about an exercise he and I ran together as a side project back in 2012:

This was a side project.

Well, the NSA was diverting shipments of Cisco networking gear to install custom firmware with back doors.

But...this sort of hack is around two decades old and doesn't represent anything new in the field. There are at least a dozen toolkits one can use to implement this on a number of USB-friendly microcontrollers.

I would expect someone working for Google's red team to be able to bang this device out, from scratch, in one day.

Google probably spent more on the voice actor and graphics for the video.

Reply on news.ycombinator.com