The Ex-Google Hacker Taking on the World’s Spy Agencies | Hacker News Reader

The Ex-Google Hacker Taking on the World’s Spy Agencies

wired.com

247 pointswacvasconcelos35 comments

If you've ever heard Morgan's talking about dissassembling malware in Syrian beheading videos it is chilling.

Morgan and Citizen Lab's analysis of malware for sale to governments. https://citizenlab.org/2014/06/backdoor-hacking-teams-tradec...

Morgan's talk at 30c3 https://citizenlab.org/2014/01/morgan-marquis-boires-talk-30...

Morgan's talk at RightsCon https://www.youtube.com/watch?v=05KkCY7Zgm0

Blog post of Vietnamese govt malware attacking the EFF. https://www.eff.org/deeplinks/2014/01/vietnamese-malware-get...

>If you've ever heard Morgan's talking about dissassembling malware in Syrian beheading videos it is chilling.

I am very interested in these kind of talks, but I've seen things on the Internet I'd rather not see again - is it safe to watch?

He doesn't play the actual video of it happening. Just the first frame really to make a point. I would say its pretty tame.

That first writeup is incredible. Imagine if all that effort [by governments] was put into something positive.

Since I got my PhD (math, with background in CS, startups), the only job inquiry I've made is to First Look. I wish I had an in there. Their job page is rather vague. I realize they're growing quickly.

Bump, maybe something is "looking."

Finfisher, a stealthy collection of spying tools sold by the British firm Gamma Group that they eventually tracked to command-and-control servers in 25 countries.

This is why I always take stories about "attack coming from China" with a huge grain of salt. It should be trivial to make an attack look like it came from a certain country, especially for an agency like NSA that has direct access to millions of computers in China.

Would you run a SAAS service, website , etc. from mainland China, even if the hosting was free? Probably not. Between the great firewall of China shutting you down for "maintenance", Carrier Grade NAT blocking your server, etc. etc. it makes no sense.

Personally, I would choose a former USSR country, one with reliable internet access (blame it on the Russians) or Canada, Germany, etc.

Think big picture, your Malware C&C has to have good uptime :), the terrorists don't sleep!

I didn't read that the same way as you, though it's hard to tell what they're saying. My first thought was that means they traced Finfisher installations to 25 countries. Those might be command and control centers for 25 distinct countries, or one. And they might or might not be the countries where the server's were located.

I kinda figured they used a variety of forensic data to identify where an attack originated, not just the IP address. Or am I misreading your comment?

Technical tools aren't enough. Those can also make the situation worse. If people don't receive general security training. Plain tools could be just a trap.

bullshit .. there are tons of people with ultra smart than this fame-ass ! people from russia , china are very very smart than this look-at-me i m so ex-google. if you are that smart why you need article and fame ? why do name dropping ( using google for those ass-hats who don't know what name dropping is ) seriously , get a life

There seem to have been a lot of 'person profile's on HN recently. Might anyone know if this is a summer, current journalism thing, or just HN's recent preference?

HN trends happen regularly. Right now it's profiles, in the past it has been military aircraft, biology, whatever.

It's pretty neat and seems to work well - waves of variety without the segregation of something like subreddits or the chaos of a completely theme-less forum.

Ideally, I'd have a "More like this" button that would identify recent submissions belong to the same topic cluster.

Just more Google marketing. Trying to win hearts and minds, while like Facebook, profiting off of the sale of user data.

I must have misread something. Doesn't it say "ex" in the title? Regardless of how you feel about the company, Google has some of the brightest minds in the world working for them in any given field. Being one of the top security guys at Google is a pretty strong credential, I don't see why it wouldn't be mentioned forthright. I fail to see how this is Google marketing.

'“He has quite a hacker mind,” says Heather Adkins, Google’s manager of information security, “Of everyone I’ve ever hired at Google, I’d put him in the top one percent of technical capability.”'

The guy must be quite smart.

I hope the "brightest minds" realize the negative sentiment the mere mention of Google is eliciting? I honestly couldn't even read the article because of how they exploited me. At first--it was innovative; now they are just irratitaing.

Comparing Google with aggressive governments? Last I knew I was not forced to be a user of Google products. Also: Google does not track and arrest/beat up people with other opinions than the rulers.

I find it extremely difficult to avoid interacting with Google products: - a LOT of the web employs google analytics to track you - very many of my contacts use Gmail, so perhaps the majority of my email ends up on their servers - Friends take photos of me that are uploaded to Google+ - My home and car have been captured by the GoogleMaps surveillance van

I agree that it's important to distinguish Google vs. governments. But let's not pretend that you can "opt out" of Google's surveillance on you, even if you aren't using their products.

Edit: Let's also acknowledge that whatever Google collects, the governments have access to.

Yes, Google Analytics is on most of the web. Guess what else is? AdSense. Even if a site doesn't have Analytics, if it has AdSense, then most of the same tracking comes into play.

A massive fraction of the web - at least, the websites that get traffic - has either or both of these built in.

> I find it extremely difficult to avoid interacting with Google products

I think that's not what digitalengineer was talking about. He was saying you can't opt out of governments and violent or unfair law enforcement, whereas you can opt out of Google products. So the OC reminds us Google is pretty tame compared to govts.

>I was not forced to be a user of Google products

Well forced is perhaps a little strong, but it's nearly impossible to avoid giving information to Google if you use the internet. Not using the internet is increasingly not a choice available to people in modern society. The argument here about mobile phones applies just as much to the internet in general: https://news.ycombinator.com/item?id=6707202

http://mako.cc/copyrighteous/google-has-most-of-my-email-bec...

>Despite the fact that I spend hundreds of dollars a year and hours of work to host my own email server, Google has about half of my personal email!

https://news.ycombinator.com/item?id=7731414

>Google Analytics is on a substantial proportion of the Internet. 65% of the top 10k sites, 63.9% of the top 100k, and 50.5% of the top million[1]. My own results from a research project I did using the Common Crawl[2] corpus estimates approximately 39.7% of the 535 million pages processed so far have GA on them.

>The real key to tracking is the referrer data. For the vast majority of clicks, you land on a site that has Google Analytics or you've just left one that did. As Google Analytics tracks your referrer, that means they still have your full browsing history if you jump from GA => !GA => GA => !GA => …

Besides the Gmail part, blocking GA and using Bing or DuckDuckGo isn't the end of the world. I use Bing because of Bing Rewards, and I haven't had to do a Google search in ages. I've heard really good things about DDG as well.

Anyone would think it's difficult to block Google Analytics

Now stop Google seeing your email: http://mako.cc/copyrighteous/google-has-most-of-my-email-bec...

Maybe you could use this handy open source Chrome extension:

https://code.google.com/p/end-to-end/

(guess who developed it)

>Maybe you could use this handy open source Chrome extension

And how exactly does that help me when a gmail user emails me (or replies to my email) without using pgp? Perhaps you meant to say "Maybe you could persuade every person you might ever contact over email to use this obscure Chrome extension".

If you think this is a solution then you have massively misunderstood the problem. Communication is an issue of social groups. What matters is what most people are doing. The choices made by any individual are irrelevant unless most other people do the same. I know that is probably difficult to fit into your existing individualistic model of how the world works.

It's obviously a solution. You don't like it because you suspect correctly that the people you want to communicate with care less about the issue than you do, but that doesn't mean it's not a solution. Indeed it's the only solution possible ...

Why would Google ever sell user data? It's worth much more in their hands alone.

> Why would Google ever sell user data? It's worth much more in their hands alone.

That depends on the price.

There's just ExxonMobile and Apple with enough money (by market cap).

I for one, would be perfectly fine with a great company like ExxonMobile purchasing my data in order to re-educate the misguided people that think Exxon isn't building a better future for our children's children. /s

According to http://www.investopedia.com/articles/investing/070714/apple-... it would appear that the Norwegian Pension Fund (~800Busd) could also (theoretically) purchase google (especially considering you'd "only" have to buy 51%). Interesting thought.

Also, a cursory search for other candidates seem to indicate Mitsubishi Corp has a market cap of 3.1T? But maybe I'm reading that wrong -- I'm not used to looking at these numbers.

> Also, a cursory search for other candidates seem to indicate Mitsubishi Corp has a market cap of 3.1T? ...

That's in Japanese Yen, which is ~34.5B USD.

I figured it might be, thanks for clarifying :-)

Reply on news.ycombinator.com