[kylell]

How can you get infected by just visiting a fake website, where they on windows, are we doing such a poor job, we like to brag with nice titles, architect etc, but the industry is quite shit, if you can get infected just by visiting a site.

[JohnStrangeII]

Every current PC system can be broken, no matter which operating system it is running. Intelligence agencies use 0-day exploits and test the software they use against known antivirus software and intrusion detection systems.

There are also plenty of companies such as Lench/Gamma who overtly advertise their ability to penetrate any system. You can only buy or lease their software as a state actor, though.

[DyslexicAtheist]

> You can only buy or lease their software as a state actor, though.

there is a wide spectrum of actors in this space and besides the well known (Gamma/HackingTeam) also include many smaller firms that do not shy from working in a gray area and cater to both criminal enterprises, unstable regimes, warlords. Especially smaller fish fill the niche (AREA[¹], Negg[²], ...)

Though any of these providers they don't just give you a software because "solutions* would (due to their nature) rarely work out of the box. Instead they come with a consulting service contract to ensure the system is correctly used (to facilitate breaching the target). So "state actors" isn't restricted to spy-agencies but low-level law-enforcement who lack the budget and technical know-how for maintaining or creating these tools. So these systems are kind of a poor-mans TAO.

¹ https://www.linkedin.com/feed/update/urn:li:activity:6367357...

² https://twitter.com/ValbonneConsult/status/95357449457630412...

[petepete]

"After installing malware on the engineers’ computers by luring them to a fake version of the LinkedIn website, GCHQ was able to steal their keys to the secure parts of Belgacom’s networks and begin monitoring the data flowing across them. "

FFS.

[chatmasta]

The computers of engineers are great targets for hacking. Dozens of package managers across languages and operating systems, as well as GitHub, provide easy vectors for getting complex code to execute on computer of the dev. Devs are used to running code from the terminal, and typically have many interesting files in their file systems that could assist with lateral movement or even lead to compromising of the build system (!!)

Despite this, devs are still generally very cavalier about running code from the internet on their machines. Often times they have no choice of security mitigations because their package manager is compromised by flaws in its design.

[madez]

Why do people let keys lie around on storage? A smartcard is dirt cheap and comes even including reader in all shapes and sizes. There are no excuses.

[stordoff]

Monitor their communications so you know exactly what software they are using, then drop a 0-day on the forged site (I find it very unlikely that GCHQ don't stockpile Firefox/Chrome escapes and Windows/Linux priv. escalations etc.). There's little an individual can do against such a targeted attack without completely airgapping the machine which A) probably isn't viable for a network/software engineer and B) GCHQ are probably determined enough to gain physical access if they deem it necessary.