points by sailfast 1 day ago | 0 comments
I’ll update my threat model to include sophisticated non-state human traffickers or smugglers that are all sharing intel with each other if that’s what you’re suggesting? Or perhaps just selling in the dark to whomever is buying? Sounds like you know this is happening?
I’m not making a good guy / bad guy judgment here FWIW. I do, however, find it less likely a smaller scale non-state operation would bother hacking a government agency or buying info on the open market. Sounds like it’s a higher priority than I thought.
Makes sense for larger orgs at higher levels - but I admit my mental model didn’t think about parallel private attempts to exploit, sell, use and otherwise secure comms. It was a blind spot. Seemed too leaky and obvious given the incentives to leak information - but I clearly don’t understand bad guys very well.
As sophisticated as your average low-rent startup IT guy, sure. "Can you set up an HTTP server with Basic Authentication and a TLS certificate?" is the bar here.
> I do, however, find it less likely a smaller scale non-state operation would bother hacking a government agency...
And yet, here we have someone who's not even profiting from the information who has obtained it.
> ... It was a blind spot.
Yes. Definitely. Whenever you find yourself thinking that only "sophisticated actors" and/or "well-funded actors" are motivated to and/or capable of poking around in Internet-facing services to see what they can find and/or do to them, remember all of the times that friggin teenagers and folks who meet some definitions of homeless have yanked dreadfully sensitive data out of said services.
I don't think we know the particulars of how this data was snagged, but so many of what businesses describe as "sophisticated attacks" by "persistent threat actors" are the meatspace equivalent of either walking through a doorway and making copies of everything sitting in plain sight in the room within, or unlocking a door with a well-labeled key that was sitting right next to that door, entering the room, and then firing up the universal copy machine.
Bonus chatter:
If Homeland Security agents who could be murdered, kidnapped, or both if their covers were blown could have their covers blown by data entrusted to friggin Okta, then Homeland Security wanted to have those agents killed and/or kidnapped. Don't believe this? Consider what would have to be done to make it possible for folks in a serious Federal Witness Protection program to earn a paycheck and pay taxes without alerting folks who would be rather interested in kidnapping and/or killing them and their families.