Hacker News Reader

Comment by whatever1 | Hacker News Reader

Like how can one download so many files from a company network and no alarm is set off ? What do the useless IT departments set up? Just employee spyware ?

View on HN

Sadly, this is pretty routine for us (not Boeing). Every goddamn day we have somebody plugging in a USB stick and copying 1-20 GB of data to it. We see similar volumes "accidentally" uploaded to iCloud whenever someone syncs their work laptop to their personal iCloud account.

We watch it happen. We have the tools to stop it. But we're not empowered to use them, for the exact same reasons that led to Equifax's fuckup-- we're not allowed to do anything that might impact production/pursuit of new revenue.

Lately, I'm not convinced this is even the "wrong" approach. Espionage was not invented alongside the Internet. If we build a Thing and it's the only Thing we sell, data concerning it will inevitably be stolen by someone in some way. But if we iterate on it fast enough, the value of older versions leaked diminishes. We're in the market of building and selling a moving target.

It also creates an inflated volume of data. You can't just break in, grab "the_flag.zip" and run like hell-- you have to exfiltrate a fuckton of data, make sense of it, and carve something usable from it. Like, checking binaries into a git repo makes the size bloom, but it doesn't add a proportionate amount of "value" to stealing that repo. It's padded with drafts and garbage.

You need to disallow all USB devices not on an approved list, which must all be keyboards and mice and nothing more.

I worked somewhere that filled all the usb ports with epoxy. They maintained a large stock of ps/2 keyboards and mice.

I mean, depending on the data type... 45GB isn't really all that much. They probably have 45GB individual CAD files...

Now, if it is 2,000,000 text files totaling 25gb, then that is harder to explain away.

(I just read the article and saw that it deals with a vendor we use daily... so... great news.)

I remember an engineer telling me the physical drawings for the 747 weighed ten times as much as the plane itself.

1000 sheets of paper weighs 10 lbs, the 747 weighs 910,000 lbs, so there were 91 million sheets of paper describing the 747? Does not seem accurate

The 747 has around 6 million individual parts, 15 sheets of paper per part doesn't seem unreasonable.

Just detailed schematics of a given plastic knob in the cockpit should take at least a few pages, nevermind something more complex or critical like turbine blades.

The 6 million figure includes fasteners. Half of the parts of fasteners and there are only 75k engineering drawings. Engineering drawings rarely run more than a few pages per part.

https://www.boeing-747.com/fun_facts_from_boeing.php

Construction drawings are not done on A4. Typical drafted drawing is uses handful of ft by ft range, say 3x4. So that should give ~2 orders of mag less sheets. Does 10,000 sheets of drafting paper sound more reasonable?

Internet says 747 has 6,000,000 parts, half of which are fasteners. So 3m individual components. “171 miles” of wiring. Blah blah. I can easily see 10k drawings to cover that beast, soup to nuts.

3x4 is about right, but the original 747 drawings were not drawn on paper, they were inked on thick thermal and humidity stable mylar. Some detail parts may have been defined multiple (up to a half dozen) E sized (36”x48”) mylars. Then there were separate drawings for each assembly of detail parts. Then there was all the manufacturing planning and detailed work instructions to fabricate each level of assembly. Then there is all the documentation associated with lab qualification testing prior to flight. I have personally authorized qual test reports in excess of 3000 pages, where ~100 pages was my content and the rest was all backup data.

If you adjust the size of the paper, it can be true no matter how many or few parts there are.

Let's say you have 6TB a day going through your perimeter firewall. It's kind of hard to pick out a 40GB stream(s) on HTTPS going to some US cloud provider.

> Like how can one download so many files from a company network and no alarm is set off ?

Slowly, hidden among legitimate traffic, and indirectly. For example, most companies don't notice 100 kb/sec increases in DNS traffic, slight increases in web server image sizes, or changes to server MOTDs.

I just had to download a 69 GB database to my laptop of CAD design files (mostly libraries). I'm glad I have 1 Gbit download speeds, but peers aren't so lucky. Granted, if IT saw remote employees downloading TBs of data it should really raise red flags.

If the FileShare server itself was compromised one could mount it in a way that wouldn't show leakage, or just image the thing and bork the original.

Otherwise you could have a crawler that just traverses the FileShare and makes duplicates at a rate slower than what would look like BAU traffic. Given that most enterprise network shares host a TON of legitimate batch dump/upload file traffic it might be easy to skate by.

We don't know how and over how much time the data was exfiltrated.

So many of the security monitoring tools that purport to detect things like that only work if the attacker is brainless. Modern networks are complex enough where a clever attacker (like a professional ransomware gang) can make malicious traffic look like any other traffic.

Unless this was just a public S3 bucket, there was probably some lateral movement involved, and I'd say time/money would be better spent reducing that particular risk in the future.

Reply on news.ycombinator.com