Hacker News Reader

Comment by ttul | Hacker News Reader

If any of you get this far down, one thing that caught my eye is that Google said they had analyzed this guy’s network traffic after locking his laptop, confirming various things. If you work at a large company like Google, every packet on their employee access network is recorded and indexed for forensic purposes.

This is not something Google would talk about publicly, but it’s standard practice in any company that is a serious target for sophisticated cyberespionage to spend a great deal on specialized equipment that can log all network traffic at scale.

View on HN

This is standard practice in all big companies. Everything is tracked and recorded. If you want to say something to a colleague that you don’t want management to know - use your personal phone and talk at a coffee shop or bar in person.

It's indeed safe to assume everything is tracked and recorded and can be found if they bother to look for it, but a random line manager is not going to have access to any of it.

Asking for a friend :) On VPN at home, using my work laptop, I happen to browse some non-decent content, more than once, maybe routinely. Is that all tracked or do VPNs have routing to use VPN only for company network, and leave NSFW be handled by my ISP? Or even if is going via ISP and not company network, are the companies usually able to track what all sites I visit

Not a Google employee BTW, but work for a company that I am reasonably sure does monitor their network.

Depends on the VPN config if it's everything, or just company resources. Split tunnelling seems uncommon from my experience with corp VPNs...

But if you're on work equipment, they likely have corp spyware looking at all your browsing even if you're not on vpn. Shop for fans or whatever you need to do on personal equipment.

Is he on the corporate network on his work vpn? If so, this is recorded. You have to go via corporate proxies and use corporate dns. That’s easily trackable.

If he’s installed something like mullvad on his work laptop and he’s able to tunnel out from the corporate network, he’s probably safe from the content but has broken policy on unauthorized software, the intent of which can be malicious.

They won’t care in general. But if they want to get rid of him they’ll have the info ready.

It's SOP in all companies, not just those facing sophisticated threat actors - there's a reason EDRs like Crowdstrike and SentinelOne are massive players now.

I've never been exposed to that side of things but always wondered do certain levels datamine this information? For example, do they get reports on user activity during the day... A pareto of employee activity perhaps by userid? I mean, why wouldn't they?

why would they? if we're talking about sophisticated espionage, that's more of a job for infosec. if we're talking about AFK time, being secretive defeats the purpose.

I’ve done this sort of work and my anecdotal experience was it is mostly used to flag blacklisted activities from occurring on the computer spanning things like porn and gambling sites to administrative privileges, but also to modify what level of access these computers had for interacting with different infrastructure between silos.

You could use the data to identify activity levels or behavior patterns of the people using the device but it would cost a ton more money and a larger team to do that plus the other responsibilities we had simultaneously.

My experience is also not with employee owned devices so in my mind there’s nothing wrong with doing it’s agreed to and is imperative to their function as an employees especially with HIPPA concerned.

I think there was some BYOD stuff that was starting at one point and we had to run an emulator on their personal devices so the programs we run to collect logs were sandboxed from their regular phones.

Essentially you hook up all your log sources to a User and Entity Behaviour Analytics (UEBA) platform, it comes up with a model of "normal" behaviour, and flags users for investigation when they start acting outside of those norms (or things you want to explicitly flag on).

No data egress for 6 months, then 20GBs of outbound traffic? Someone's getting notified to take a look and see what that was and where you sent it. You only authenticate against one host on the network, and suddenly you're hitting thousands of hosts? Someone's getting notified to investigate, &c.

what does EDR mean?

Endpoint Detection and Response

As someone who has worked at companies, it sure as fuck is not. Unless you are a very valuable company or you make money with data/software, ain't nobody got time for that.

Yeah, install EDR for satisfaction and forget.

It absolutely has to be more nuanced than "there's exabytes of pcaps somewhere" because cloning repositories, pushing branches, backups, these things would basically end up being nasty amplification attacks against the ability to store this data. And block dedupe can work for some storage loads, but it's not solving this problem, especially when that git clone came over ssh or https.

Data from employee devices all being captured and stored? That seems plausible. All data on the corporate network? Less so to my naive mind. I'd love to hear exactly how that works and what kind of retention exists for it.

What seems far more likely is that there's a rules engine that can see all the traffic and makes a decision about if it trips an event to be logged or looks strange enough to be captured (along with some amount of surrounding context, if possible).

Yeah you plug holes so you don't have to audit everything. Disable USB ports, alert on large file transfers, audit file access and device logins, no access to local network shares off-site, etc. That's probably good enough for 99% of the world.

Capturing all network traffic is absurd and I doubt that's even a thing. You'd need a department the size of the existing company to be able to manage and do anything meaningful with it. Maybe if you had a super secure jump box you could consider monitoring all the traffic on that, but there are much much easier ways to audit behavior than network traffic. Monitor the devices instead.

Why don’t they steal these documents by taking a photo using a camera? I feel like a genius be the first one thought of this.

Reply on news.ycombinator.com