Hacker News Reader

Comment by golem14 | Hacker News Reader

That was not a side project from my limited understanding ;) I believe the M$/Alphabet/Meta security teams are probably more advanced or on par with the best state sponsored teams. I could be wrong, plus the state sponsored teams might have infiltrated the FAANG security teams ;)

However, I think the FAANG companies act somewhat more restricted. Three letter agencies don't have qualms about things like "chloroforming security guards" and such.

Also, use USB Data Blocker dongles where possible.

View on HN

NSA’s TAO surely has many orders of magnitude more budget than Google’s red team?

Probably. It’s way handier if the keylogger is embedded into the cable from your usb-x monitor right when you open the fresh package.

But budget limited ingenuity is fun too!

It's really not hard to realize that organizations whose entire existence is predicated on actually cracking the security of other nation states might garner more investment than a red team focused on checking that your company's security is intact.

I don't think the NSA pays as well though. You also have large restrictions. Not just stuff like never having smoked weed in your life (we are talking about CS people...) but that once you even have a security clearance (a pain to get in the first place) you have a lot of daily life headaches. You have to carefully watch what you say. International travel has to be reported (and can even be a big hassle). Etc. I'm not sure if the same is true for Google's Red/Blue teams, but I feel pretty confident in saying that they probably get paid more.

Correct, government pay scale is a huge problem for talent acquisition. Your choices are either someone who is so ideologically devoted that they're willing to work for 5-25% of what they're worth or "work for us or you're going to prison for a long time".

Citations:

https://apply.intelligencecareers.gov/job-description/119486...

Cyber Mitigations Analyst/System Vulnerability Analyst - Entry to Expert Level (Maryland)

Network Cyber Mitigations Engineers and System Vulnerability Analysts analyze vulnerabilities and develop mitigations to strengthen defenses. They produce formal and informal reports, briefings, and guidance to defend against attacks against network infrastructure devices or systems. NSA analysts' competencies run the gamut of data transport possibilities. They work with traditional wired networks, wireless transport, including Wi-Fi and cellular, collaborative platforms such as video teleconferencing, and the hardware and software that support it all.

Pay Plan: GG, Grade: 07/1 to 15/10

https://www.opm.gov/policy-data-oversight/pay-leave/salaries...

In a very high cost of living area, that means that entry level is $31K and the absolute top for expert level is $176,300.

Compare that to what FAMG are paying new college grads.

Or "I'm a covert foreign asset, so I DGAF what I get paid."

Caps are getting raised, at least at DHS:

> The CTMS [Cybersecurity Talent Management System] salary range has an upper limit of the vice president's salary ($255,800 in 2021), plus an extended range for use in limited circumstances, which has an upper limit of $332,100 in 2021.

https://www.zdnet.com/article/the-us-government-just-launche...

Had a friend with a restriction like this and then switched to a more public unrestricted job.

To be honest, I liked hanging out with them more when they couldn't talk about work :)

All of this is true, but as a government agent, you will be much less likely to go to jail for participating in adversarial activities, which is not nothing.

By many accounts they source exploits from the grey market, too.

It's certainly something someone could do as a side project, even if that wasn't strictly the case here.

> That was not a side project from my limited understanding ;)

First paragraph of the article:

> In episode #3, Daniel Fabian talks about the redteaming efforts - and in particular, about an exercise he and I ran together as a side project back in 2012:

This was a side project.

Reply on news.ycombinator.com