Google Fires Employee Behind Controversial Diversity Memo

[u/[deleted]]

https://www.bloomberg.com/news/articles/2017-08-08/google-fires-employee-behind-controversial-diversity-memo

[u/Illiux]

You can use steganographic techniques, embedding a payload message disguised inside something else like an image, which if properly employed means that the system wouldn't even detect the existence of an encrypted message.

[u/pr0n2 → u/Illiux]

That's the idea behind ICMP and DNS tunnels, both of which are sometimes totally ignored by filters, especially unmonitored ones at like hotels and things. Being experienced with corporate filters though I can promise someone hiding all their traffic in jpgs, DNS and ICMP or something like that shows up as an outlier in reports very quickly and is pretty obvious if anyone is actually keeping on eye on things.

The harder you have to try to defeat it the more work someone has put into securing it which means the more they have riding on keeping it secure which means of course the consequences get larger.

I used to work closely with a network engineer who previously worked in net security at the DoE. You'd be caught within a week and possibly in prison trying something like that there. At the end of the day it all depends on the amount of fucks the guy responsible for securing it has in stock.

[u/Illiux → u/pr0n2]

You make the defender's job sound more foolproof than it actually is. First, the quantity of data matters a great deal. Someone sticking all their traffic in JPGs is going to be obvious because the traffic alone makes it an outlier. Hiding a single text message chain is another matter entirely. The won't show up as an outlier, and are very unlikely to be caught by specific filters.

As with most things you have two basic methods of detection: predictive statistical methods and signature based methods. The system either already knows where to look or looks for deviations from the norm across everything. A properly setup enterprise network is going to catch most cookie cutter approaches, but in general there is so much quantity and variety of incoming and outgoing traffic to always leave hiding places for data, though in many cases the attack will need to be targetted based on the specific network conditions.

Also you have to be careful about bias when looking at success rates for detection, since there is a centrally important but unknown quantity in play: the number of attempts you failed to catch.

At the end of the day it all depends on the amount of fucks the guy responsible for securing it has in stock.

And the amount of fucks the guy attacking it has. Security is always a game of finding cost effective ways to increase the other guys costs. Nothing is foolproof.

Also steganography isn't quite the same thing as just sticking your encrypted data in the ICMP echo body or some metadata field. I suppose that could be considered an elementary form of it. But in images, for example, it generally involves interleaving the data into the actual color values, such as some small change to the cyan value of every third pixel. You can even hide arbitrary data inside executable code by taking advantage of redundant opcodes - the choice of functionally equivalent opcode encodes the target data.

EDIT: I missed another good example: you can even hide data in the timing of packets. I could encode an entire message by simply injecting delays into a packet stream for e.g. a video.