“It’s actually really, really difficult to detect once they’re in,” said Mark Sutton, chief information security officer.
Ironically, the fake workers were doing a good job, he said. “They were actually decent workers, doing good work and producing good results for the organization, but obviously from many different aspects, you can’t have those within the organization.”
He did not say which company the fake workers had infiltrated. But Bain has now revamped its hiring procedures, he said. New employees, even those who will work remotely, must show up in person for their first day of work at a company office, for example.
In July, the Justice Department shut down 29 sites across 16 states that housed computers used to help fake workers appear to be located in the United States. And the problem of fake workers is global. North Korea’s efforts to plant fake IT workers at US companies and government agencies, to steal data and commit other crimes, is growing more sophisticated and more dangerous, the speakers said Wednesday.
This week, the FBI issued a new alert about the latest North Korean techniques. The alert highlighted a half dozen possible red flags, such as a new employee using remote desktop software to control their work computer or frequently changing the bank account for their pay check. North Koreans are also more frequently hiring or extorting US citizens to help pull off the schemes, the alert said.
Speaking at BC, Michael Kelly, a special agent in Boston for the bureau’s cyber division, said the fake workers are getting harder to weed out during the hiring process and harder to detect once they infiltrate companies.
“One of the challenges with that particular scheme is that any one of those individual characteristics isn’t enough to say definitively that threat actor is a [North Korean] military and IT worker,” Kelly said. “You really need to look at a more comprehensive approach to try to get a more in-depth perspective of whether or not you’re dealing with a legitimate employee.”
The bureau’s latest warning followed a series of alerts it has issued over the past two years concerning the fake worker schemes.
Former FBI counsel Matthew Greenberg said blocking fake applicants was easier said than done.
“It’s a real threat, an issue that has a lot of different tentacles,” said Greenberg, who is now assistant general counsel at Wells Fargo. “From a security, from an HR, from a legal [perspective], everything has to combine to to defend against this one.”
In addition to the North Korean threat, speakers at the BC conference also warned of several cyber risks that could be exploited more over the next few years.
Quantum computers, which make calculations using atomic particles instead of semiconductors, threaten to crack encryption codes that protect sensitive data and transactions, Greenberg warned. Companies from Google and IBM to local startup QuEra are racing to build useful quantum computers, but none have yet succeeded.
“It’s going to be a nasty game changer,” Greenberg said. Cyber criminals and adversary nations are stealing encrypted data and stashing it away, waiting for the day quantum computers help crack the codes, he said.
FBI special agent Kelly said he worries about the vulnerability of basic infrastructure, citing an attack this summer on water and wastewater systems. Kelly said the affected areas were “very fortunate” no one died after some systems issued warnings to boil water. Massachusetts officials said no local systems were hit by that attack.
“I think we should take that as a warning shot,” he said. “That is an attack style that right now, nation-state threat actors are ready to use.”
Bain’s Sutton said with AI and the increasing sophistication of all kinds of attacks, he is more worried than he used to be. In planning meetings, he used to ask his security team “what’s the worst that could happen,” he recalled. “Like, glass half full,” he explained. “But now it’s like, ‘what’s the worst that can happen,’ glass half empty.”
The FBI itself disclosed last month that hackers had penetrated the bureau’s computers and stolen data.
Jose Perez, FBI Operations Director of the Criminal and Cyber Branch, called the incident “the elephant in the room.”
He said the hack happened because a vendor used by the FBI failed to patch a known security vulnerability.
“No agency is immune,” he said.
🏛️ There ought to be a law against rogue AI, but there isn’t. Why? Read more from tech columnist Hiawatha Bray.
🚰 Boston beverage startup Bevi wants to dispense better health. Read more from tech reporter Aaron Pressman.
💼 Oracle CEO tries to reassure Boston business crowd about AI, saying ‘people are still going to matter.’ Read more from business reporter Jon Chesto.
🌊 A data center. Underwater. Yes, some in this small Maine town are worried. Read more from Globe correspondent Sabrina Shankman.
📰 Anonymous no more: Meet the 36-year-old Boston software engineer behind the viral Mass Daily News website. Read more from media reporter Aidan Ryan.
🎟️ Autonomous mascots: Coming to a theme park near you? Read more from tech columnist Hiawatha Bray.
💰 Investment firm Spectrum Equity in Boston raised $2.5 billion for its 11th fund, which will focus on software, artificial intelligence, and data services companies.
🤝 Semiconductor testing company Teradyne in North Reading is investing $300 million in California testing firm FormFactor as part of a technology collaboration agreement.
⚡ Energy infrastructure tech company VEIR in Woburn raised $110 million in a deal led by Matter Venture Partners and Tyche Partners.
🔢 Data AI startup Tamr in Cambridge raised $21 million in a deal led by Volition Capital.
📦 Warehouse automation company Symbotic in Wilmington acquired German automation software firm cellumation GmbH. Terms of the deal were not disclosed.
🌏 World AI model builder Flexcompute in Watertown received a strategic investment from Samsung Ventures, Applied Ventures, LLC, the venture capital arm of Applied Materials, and others. The amount was not disclosed.
👋 Cambridge business software firm HubSpot said chief legal officer and corporate secretary Erika Fisher is leaving next month.
🔒 Business software firm Pegasystems in Waltham hired Sean Croston as chief information security officer. Croston previously was CISO at USAA.
➕ Industrial software company Velotic in Boston added Houman Behzadi, former president and chief product officer at C3 AI, to its board of directors.
🌟 Data software company Starburst in Boston hired Kerman Lau as chief financial officer. Lau previously was CFO of Moveworks.
🏥 Medical robotics company Myomo in Burlington hired Mary-Katherine “Katie” McClure as chief commercial officer. McClure previously worked at Inspire Medical Systems.
🖥️ HubSpot cofounder Dharmesh Shah apologized after his brief LinkedIn message to employees losing their jobs drew criticism. The Cambridge-based company announced last Tuesday that it would cut nearly 660 jobs, or about 7 percent of its workforce.
Is What We’re Watching True or False? (New Yorker)
Tool and target: US law enforcement grapple with AI-enabled terrorism and anti-tech extremism (The Guardian)
Using AI for Just 10 Minutes Erodes Your Ability to Persist at Hard Things (UC Berkeley Research)
👋 Thanks for reading. We’ll be will be back next Wednesday.
❓ Have a tip? Email Aaron at aaron.pressman@globe.com.
✍🏼 If someone sent you this newsletter, you can sign up for your own copy.
Aaron Pressman can be reached at aaron.pressman@globe.com. Follow him @ampressman.