Re:Facial recognition company Clearview’s client list stolen...
by hermitdev on Thursday February 27, 2020 @12:44PM
(#22435631)
I worked for a hedge fund where a quant dev emailed to his gmail a copy of the source for the quant models. He was sued in federal court 4 hours before he was terminated. Criminal charges came around 2-3 months later, IIRC. Once he realized he was fucked, he tried dumping his hard drives in a river. Yes, police diving squad was involved.
Dumbass didn't realize that all SSL traffic was being MITM'd. I never sent any sensitive over personal email from work, being well aware of the practices (also helps to have friends in compliance).
Re:Facial recognition company Clearview’s client list stolen...
by htrp on Thursday February 27, 2020 @12:49PM
(#22435669)
It's always the dumb ones that get caught?
Re:Facial recognition company Clearview’s client list stolen...
by Nuzzerino on Thursday February 27, 2020 @03:33PM
(#22437472)
Doesn't the browser display a warning in the case of SSL MITM?
Re:Facial recognition company Clearview’s client list stolen...
by cdumler on Thursday February 27, 2020 @05:43PM
(#22438780)
Not if the browser has been specifically given the cert. It is typical on corporate networks send all HTTP traffic to a router that acts on behalf of the outside world. If your browser (and browsers these days relying on OS installed certs) has a cert validating the router, it will be legitimate: you have a valid cert for the router you're talking to.
The trick is to use a piece of software that doesn't use your system's certs but has it's own built in, like run Linux in a VM and use that browser. That way, you'll see the MitM attack.
I was at a large web dev company where an employee put in his two week notice, then was able to access several of the companies servers and exfiltrate nearly every app or web site they had built in the last two years.
Rumor had it he was using the code to start a dev company on his own and this was the "seed" code that would help him get up and running much faster. AFAIK nothing ever happened to him legally.