Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOGE worker’s code supports NLRB whistleblower

krebsonsecurity.com

Post reply on HN
Print view View original

301–310 of 586 posts

Re: DOGE worker’s code supports NLRB whistleblower

#301

Post by tenpies »

stevenwoo wrote: post #287
mythrowaway49 wrote: post #263

this part of the whistleblower complaint seem way worse: " On or about March 11, 2025, NxGen metrics indicated abnormal usage at points the prior week. I saw way above baseline response times, and resource utilization showed increased network output above anywhere it had been historically – as far back as I could look. I noted that this lined up closely with the data out event. I also notice increased logins blocked…

Any guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers and DOGE are working from insecure open networks. The worst possible interpretation is straightforward - they are working for the Russians as agents and let the Russians in or installed the keyloggers for Russia.

Don't forget the third option: false flag.

The objective may not have been to obtain access or any useful data. The objective may have been to get the scary headlines about Russians and use the existing media and political agitprop to further destabilize the government you seek to color revolution away.

Re: DOGE worker’s code supports NLRB whistleblower

#302

Post by whalesalad »

icedchai wrote: post #285
timewizard wrote: post #242

Earlier quoted context omitted.

To be fair the code actually creates a new API gateway server that acts as a proxy on to an already existing server and you're possibly meant to use this header with your own gateway service. So, it's set as a header, sent to a user owned proxy, then to the actual external endpoint. On the other hand I think the receiving API Gateway will be able to see and log your AWS account identifier when you do this. So your IP…

The code seems like a "creative" use of API gateway to turn it into a proxy for other external sites (single site, really, since you need one per site.) Wouldn't it be simpler to send the requests through a lambda (with a function URL) and get better control of the outbound requests?

tbh the ip space of lambda is large, but not as large as you might think. i did some experiments ages ago with the hypothesis that lambda could be a decent proxy network (if many ip addresses are needed) but iirc the upper limit in my testing was about ~50 ip's.

Even this example if you maxx out your usage of regions appears to only give (2,4 * num_regions) or let's say 70-80 ip's maximum. And they are AWS ip's, which means it is gonna be really easy to detect and block that traffic.

But if you know your target receives lots of traffic from AWS systems all around the world ... this is a good way to mimic that.

Re: DOGE worker’s code supports NLRB whistleblower

#303

Post by j_w »

skissane wrote: post #289
tw04 wrote: post #3

Someone needs to go to prison over this. It’s not just a misunderstanding, it is an intentional attack on every US citizen.

The problem with prosecuting them – they are employees of a White House office, doing what their bosses told them to do, and it is clear their bosses are carrying out the President's wishes. If Joe Blow off the street walks into a federal agency and takes all their data – open and shut case, throw the book at them, see you in a few decades. If someone from the White House walks into a federal agency, tells the agency…

The claim that because your boss tells you to do something illegal means that you should just do it is bullshit. It's your social responsibility to not capitulate under these circumstances.

If you don't feel that way then you deserve the world you are creating.

Re: DOGE worker’s code supports NLRB whistleblower

#304

Post by timewizard »

icedchai wrote: post #285
timewizard wrote: post #242

Earlier quoted context omitted.

To be fair the code actually creates a new API gateway server that acts as a proxy on to an already existing server and you're possibly meant to use this header with your own gateway service. So, it's set as a header, sent to a user owned proxy, then to the actual external endpoint. On the other hand I think the receiving API Gateway will be able to see and log your AWS account identifier when you do this. So your IP…

The code seems like a "creative" use of API gateway to turn it into a proxy for other external sites (single site, really, since you need one per site.) Wouldn't it be simpler to send the requests through a lambda (with a function URL) and get better control of the outbound requests?

This is cheaper in that you don't have to pay for any compute time.

Re: DOGE worker’s code supports NLRB whistleblower

#305

Post by mfer »

throwworhtthrow wrote: post #222
mfer wrote: post #192

Earlier quoted context omitted.

Setting aside legitimate (thats a matter of judgement)... Some previous attempts for DOGE to get data has resulted in data being deleted before they can look and requests for judges to block access to data. DOGE may be trying to be covert in order to stop these two activities from happening before they can get and review the data.

> Setting aside legitimate (thats a matter of judgement) By definition, a judge decides what's legitimate. If DOGE expects their access to be blocked by a court judgement, and bum-rushes agencies to exfiltrate data ahead of the judgement, that's also criminal intent. I am not sure what you are getting at. "Covert" isn't how I'd describe DOGE's actions. "Brazen" maybe?

People have admitted in news interviews to destroying government data to prevent others from knowing what the government was doing. That’s likely criminal. This is a legitimate reason to get at information before people who might destroy have the opportunity.

What’s happening with judges is very political. We likely won’t know what’s allowed until things have gone through the appeals process. There have been cases of judges admitting they will rule against the current administration no matter the topic or law. This is messy, to say the least.

Re: DOGE worker’s code supports NLRB whistleblower

#306

Post by CSMastermind »

stevenwoo wrote: post #287
mythrowaway49 wrote: post #263

this part of the whistleblower complaint seem way worse: " On or about March 11, 2025, NxGen metrics indicated abnormal usage at points the prior week. I saw way above baseline response times, and resource utilization showed increased network output above anywhere it had been historically – as far back as I could look. I noted that this lined up closely with the data out event. I also notice increased logins blocked…

Any guesses for best possible interpretion? The Russians have infiltrated their PCs with keyloggers and DOGE are working from insecure open networks. The worst possible interpretation is straightforward - they are working for the Russians as agents and let the Russians in or installed the keyloggers for Russia.

Spearfishing then some kind of spyware on the system would be my guess.

Though with nation state actors you can't rule out Pegasus like zero-click infiltrations.

Re: DOGE worker’s code supports NLRB whistleblower

#307

Post by thrwaway438 »

jiggawatts wrote: post #227
Delk wrote: post #171

Earlier quoted context omitted.

The original complaint mentions: "7. March 3rd - I received a call during which an ACIO stated instructions were given that we were not to adhere to SOP with the doge account creation in regards to creating records. He specifically was told that there were to be no logs or records made of the accounts created for DOGE employees." Which part of doing an audit, or some other DOGE employee's job, requires logs or record…

[flagged]

Your argument makes sense. I still speculate they're doing malicious things.

Re: DOGE worker’s code supports NLRB whistleblower

#308

Post by michaelt »

Cheer2171 wrote: post #233
michaelt wrote: post #210

Earlier quoted context omitted.

Sometimes, depending on the situation. My company retains all e-mails for at least 5 years, for audit purposes. But if some troublemaker were to e-mail child porn to an employee, we'd need to remove that from the audit records, because the laws against possessing child porn don't have an exception for corporate audit records. So there's essentially always some account with the power to erase things from the audit rec…

It sounds like you haven't actually had to face that situation, because it is more complicated than just having to delete an offending attachment. You would still have an audit log of the deletion of that email record by the superuser, even if the content is deleted. And there would be other records generated to document the deletion, like I'm sure a long email or slack thread from this getting discovered and sent up…

> You would still have an audit log of the deletion of that email record by the superuser, even if the content is deleted.

If needing things wiped from the audit logs happens often, you might indeed have an audited interface for wiping things from the audit logs.

But if it's very rare? Maybe I just request the production database password for "Incident #12345" and run some careful SQL.

> And there would be other records generated to document the deletion, like I'm sure a long email or slack thread

For sure - but the account capable of deleting entries from the audit logs exists

And if I am ordered to hand it over to someone who doesn't care to explain their actions on slack? Then there won't be any explanations in slack.

Re: DOGE worker’s code supports NLRB whistleblower

#309

Post by bronson »

frumplestlatz wrote: post #256
bronson wrote: post #209

Earlier quoted context omitted.

To intimidate. To scare into silence.

Except that all you’d be doing is creating a trail of physical evidence demonstrating a felony conspiracy — and a frankly stupid one at that.

From recent news it seems unlikely these guys are interested in behaving rationally.

Re: DOGE worker’s code supports NLRB whistleblower

#310

Post by skissane »

j_w wrote: post #303
skissane wrote: post #289

Earlier quoted context omitted.

The problem with prosecuting them – they are employees of a White House office, doing what their bosses told them to do, and it is clear their bosses are carrying out the President's wishes. If Joe Blow off the street walks into a federal agency and takes all their data – open and shut case, throw the book at them, see you in a few decades. If someone from the White House walks into a federal agency, tells the agency…

The claim that because your boss tells you to do something illegal means that you should just do it is bullshit. It's your social responsibility to not capitulate under these circumstances. If you don't feel that way then you deserve the world you are creating.

The problem is a lot of relevant criminal laws contain this word “unauthorized”. If you have access to a computer system, and it is authorized by the people who own the system, it isn’t a crime. These people will say that whatever they did/bypassed was (1) authorized by the President (of course if you ask Trump if he authorized them to do whatever he’ll say “yes”); (2) authorized by the senior agency leadership (because Trump has made clear that if they refuse to authorize it they’ll be fired).

So, how do you prosecute them for accessing a computer system (or data or whatever) without authorization when both the President and the senior agency leadership say they authorized it?

Well, you can’t-unless you want to argue that the President / agency leadership’s authorization is illegal and hence illegally invalid, ultra vires. But even supposing you are right about that in the abstract, will you be able to convince a judge and jury of it? And even supposing you convince a jury, trial judge and appellate court, there’s a dozen different ways SCOTUS could overturn it (from narrow questions of statutory construction to sweeping rulings about the President’s inherent constitutional power to demand information from the executive branch), and I think the main question for the current SCOTUS majority will be which of those ways they choose.

My impression is that a lot of people are mixing up what they think the law ought to be, with what it actually is. Just because something ought to be a crime doesn’t mean it actually is one - and that’s especially going to be the case with unprecedented situations, it is hard to make something a crime if nobody foresaw it would one day happen.

Post reply on HN