‹ BackHN Continuity

Thread

'We hacked the FBI:' Hackers say they have data on all FBI employees

817 points · 614 comments · spenvo

  1. htrp · · focus · HN ↗
    TLDR. A Peoplesoft (Oracle HR) instance was compromised which allowed movement into GovCloud (AWS)
    1. jimbob45 · · focus · HN ↗
      I’m skeptical that multiple terabytes of data were exfiltrated quietly. I’m struggling to see this as anything other than a bluff.
      1. iAMkenough · · focus · HN ↗
        I'm less skeptical after seeing it happen to IDScan and terrabytes of government-issued IDs being exfiltrated quietly.

        Still skeptical, but the FBI's vendors are just as vulnerable to 0-days as Hertz's vendors.

      2. chrismarlow9 · · focus · HN ↗
        If it was compressed prior to exfiltration it would be much smaller than the original data. I would expect this is mostly human readable text and a fairly high compression ratio. Agree it would still be large but 2 TB at 7:1 ratio drops to 285 GB. I don't know how much these servers are doing with data but I'd suspect sneaking out 10 GB/day over a month or 20GB/day over 2 weeks isn't going to trip up much. The CPU hog for the original compression might, but if you batch out the process in chunks (like a good data engineer), you probably wont trip many thresholds outside of expected use. Just a theory on how I might sneak that much data out of somewhere that has eyes on it, I don't know many details except what's in the article.
        1. pixl97 · · focus · HN ↗
          Na, they just linked it up to the VLAN that carries the netflix traffic and no one noticed because it wasn't even a drop.

          Now, I made that totally up, but this is how things go. They'll watch one area like a hawk only to leave another glaringly wide door open.

          What is even worse is there are a lot of horrifically inefficient apps out there calling way too much data for no reason and suddenly a hack of an entire database gets lost as noise in relation to all the traffic on the servers and networks.

        2. Art9681 · · focus · HN ↗
          Anomaly detection is getting better. A small delta can still trigger it. Wether a human reviewed it is another story. But the post mortem will reveal all the signs in hindsight.
      3. greenavocado · · focus · HN ↗
        Imagine the AWS bill
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.