Hacker News Reader

Comment by kccqzy | Hacker News Reader

> Analyzing the wiki pages they accessed, bug database issues, and source code repositories, it appears they were looking for information about the architecture, security, and management of our global network; no doubt with an eye on gaining a deeper foothold.

For a nation state actor, the easiest way to accomplish that is to send one of their loyal citizens to become an employee of the target company and then have the person send back "information about the architecture, security, and management" of the target company.

Fun (but possibly apocryphal) fact: more than a decade ago in a social gathering of SREs at Google, several admitted to being on the payroll of some national intelligence bureaus.

View on HN

> Fun (but possibly apocryphal) fact: more than a decade ago in a social gathering of SREs at Google, several admitted to being on the payroll of some national intelligence bureaus.

They had government engagements with Google's consent, and all those various engagements could be disclosed to each other?

If not, what kind of drugs were flowing at this social gathering, to cause such an orgy of bad OPSEC?

Knowing google employees, it's coke. Lots of coke

At last, an explanation for their fratbro interviews.

Could you explain? Never been exposed to fraternities or Google.

Ritualistic hazing of newcomers is a large part of american "frat" culture.

What the parent is likely referring to is: Things like "Wearing the noogler hat" or the hoops you jump through in interview (that have nothing to do with the job) are similar in spirit to some university fraternities admission processes, or are depicted as such in media.

Yes, also the latent class filtering, and the general "coked-up fratbro" behaviors, like enthusiastically and energetically pursuing ideas that make no sense. (No sense includes hiring for people who obsessively focus their time on memorizing and rehearsing for the rituals to get into that one frat.)

Payroll? You guys are getting paid?

Australians get the 'opportunity' to be part of that sort of that sort of espionage as a base level condition of citizenship [0].

As an upside, I guess it helps with encouraging good practices around zero trust processes and systems dev.

[0]: https://en.wikipedia.org/wiki/Mass_surveillance_in_Australia...

> For a nation state actor, the easiest way to accomplish that is to send one of their loyal citizens to become an employee of the target company

Precisely. Particularly in the case of US businesses. Why bother picking a lock when you have both the key and permission?

Not if such citizens are sanctioned. Code Red. Hint hint.

> we redirected the efforts of a large part of the Cloudflare technical staff (inside and outside the security team) to work on a single project dubbed “Code Red”.

Code red is a standard term in emergency response that means smoke/fire. In general, in order to “redirect” that much effort one must do some paperwork to prove the urgency and immediacy of the threat.

The MO screams China to me but I wouldn’t read anything into the name “code red” which would have been selected before they identified the specific threat actor anyway.

The name has nothing to do with where we believe the attacker came from. We borrowed it from Google. At Google they have a procedure where, in an emergency, they can declare a Code Yellow or Code Red — depending on the severity. When it happens, it becomes the top engineering priority and whoever is leading it can pull any engineer off to work on the emergency. Those may not be the exact details of Google's system but it's the gist that we ran with. We'd had an outage of some of our services earlier in the Fall that prompted us to first borrow Google's idea. Since our logo is orange, we created "Code Orange" to mitigate the mistakes we'd made that led to that outage. Then this happened and we realized we needed something that was a higher level of emergency than Code Orange, so we created Code Red. At some point we'll write up how we thought of the rules and exit criteria around these, but I think they'll become a part of how we deal with emergencies that come up going forward.

Ha, I almost mentioned Google, having been through a code red myself, but it felt like a reach so I went elsewise with my comment! I believe it’s safe to assume google pulled it from emergency response given that their approach to incident management inherits heavily from ICS.

Did you order the code red?! I want the TRUTH.

(Sorry, so sorry, it was just too low-hanging not to to pluck: https://m.youtube.com/watch?v=W2G2sac9s34)

Yeah, that's a pretty accurate description of the color code system. There's some additional nuance to it, but a code red is an immediate existential threat to the business.

> The MO screams China to me

How exactly ?

Nothing out of the ordinary/regular infiltration, investigation and attempt to move laterally is exposed.

I think this probably was a name after the famous Code Red worm [1], not a reference to China.

[1] https://en.wikipedia.org/wiki/Code_Red_(computer_worm)

Or after the flavor of Mountain Dew which was that worm's namesake. Not all names have to make sense. :)

It's the tech scene on the Internet, everything is a reference to the CCP! /s

Reply on news.ycombinator.com