Hacker News Reader

Comment by rajathagasthya | Hacker News Reader

> They could easily bypass Macbook security with a USB device

Isn't this only possible if the laptop is unlocked?

It's not possible unless you have zero-days against the USB drivers or firmware on your laptop, in which case being logged in or not doesn't really matter.

Proof I'm paranoid. My greater point, however, is that they have done some really shady stuff, and stealing competitor's IP is part of their culture, so their behavior itself promotes and justifies paranoia on my part and on the part of anyone looking to work for or do business with Uber.

Reputation is everything.

It's pretty stupid to get paranoid over this. As GP pointed out if you logged out then it's very unlikely that they will get access.

I think it's pretty stupid to consider any consumer device to be secure enough. I did hear on HN some time before that interview that some USB device can be used to bypass the lock screen, which was the basis for my worrying. Now, some are saying in this thread that it is possible (or at least was at the time) while others saying that it is not (and was not) -- Even an educated sample of tech folks cannot make up their mind, so there is (or at least was) room for justified concern... no?

I think the consensus is that it's possible, but expensive. So like, nation-state espionage yes, corporate espionage no. But anyone who actually knows anything won't be talking about it on HN ;)

I must've missed that story, when did Uber steal competitor IP?

(Except this one, of course. To be fair it was Otto before the acquisition)

If the machine doesn't have full harddrive encryption, you can just boot from USB/CD/Firewire and have access to everything.

FDE has been the default for ages.

I can install hardware backdoor in a macbook in under 3 minutes (with prep obviously).

Even you could do it https://www.youtube.com/watch?v=qGPGOoJn54E hint: there are internal USB buses in the macbook, you can hijack one for something like rubberducky +management circuity to trigger only when laptop is powered on for a longer period of time but not touched (no imu/keyboard/touch events/dimmed screen).

Reply on news.ycombinator.com