Hacker News Reader

Hacker News

Comment by warent | Hacker News Reader

Full thread

warent

Lior Ron:

1/12/2016 Internet search on "how to securely delete files mac"

1/13/2016 Ron leaves Google

1/19/2016 Internet search on "can a MacBook be recovered after formatting the OS"

3/22/2016 A file labelled Chauffer win plan.docx is deleted, shortly before Ron's interview with Stroz Friedberg

"Chauffer win plan.docx" is this guy serious? Did he name his other incriminating file "if they find this im fucked.pdf"

View on HN

Is opsec really as hard as all these people make it seem? If I were planning something shady there's probably a lot of stupid questions I'd need to Google for, but I'd at least do it on public library wifi and download a Tor browser or something. I dunno if that would protect me, but it's more than seems to have been done here.

Once you start using Tor and public Wifi, you admit that what you're doing is illegal. I think in these cases, many people tell themselves that they operate in some kind of gray area.

Which is why you should aim to always use Tor. That's one of the points made quite often by the Tor Project -- anonymity is useless if you only use it when you're doing something shady. The same applies to people who only encrypt shady emails, rather than encrypting all of them.

GP meant that doing so would force those involved to be forced to reconcile with themselves the illegality of their behavior.

Although ironically I think in this case your point actually still stands.

I thought it was considered rude (or at least hell on transmission quality) to play videos, etc. over Tor.

> Once you start using Tor and public Wifi, you admit that what you're doing is illegal.

Thankfully that’s not how law works. Also, I use Tor everyday, for totally legal things I want to keep private.

It's not how law works -- currently, in some countries. But it is how suspicion works, and governments in the US and UK, for example, seem highly suspicious of their populous.

In the US at least the law cannot devolve into suspicion being adequate burden of proof. This is a constitutional protection that has been strengthened, not weakened by the courts over time, with only infrequent temporary setbacks. It's unfortunate that's not how things operate on the other side of the pond, but that's connected to why the US is the way it is.

Sure, but it doesn't mean that the police can't start investigating people they find suspicious.

Aren't you talking about criminal rather than civil law?

Salina v. Texas changed that. It's a horrendous decision. https://www.theatlantic.com/politics/archive/2013/06/supreme...

> In the US at least the law cannot devolve into suspicion being adequate burden of proof.

Once an attacker knows or has guessed at your identity, they can focus their investigation and make it much easier to find admissible evidence against you. It's best to keep them from ever thinking of you in the first place, if you can. That means not doing anything visibly suspicious.

On your work computer? :-)

Yes, in fact. Part of my job too. We have servers accessed through Tor as a rudimentary DoS protection.

Or just from home on your own computer, instead of your company laptop.

Could also just use DuckDuckGo! its my normal search engine so nothing out of the ordinary to be using it.

I personally think that true OPSEC is impossible in the long-term, simply because it's too easy to slip up or look suspicious from having good OPSEC. I've met a few people that had pretty good OPSEC (to the point where I believe they had fake passports, fake backstories and so on). But they all cracked eventually, in one way or another. However, adequate OPSEC is quite doable (but still hard).

As with all security, threat models are key. Is your threat model a state actor trying to reveal something about you? Is it a prosecutor or investigator that is particularly vicious? Is it someone you're in a personal relationship with? Is it an unknown adversary with unknown capabilities? And how long do you need to have your strong OPSEC? And so on. With the right threat model and timeline laid out, having strong OPSEC is not impossible. But it's still quite hard.

All of that being said, I would not classify any aspect of Levandowski's behaviour as being passable as OPSEC.

>>If I were planning something shady there's probably a lot of stupid questions I'd need to Google for, but I'd at least do it on public library wifi and download a Tor browser or something..

Google will never find out what you do on your home PC, especially using TOR /some other engine (Google displays the captcha often on TOR). Even if they did, it would be illegal and /or super secret and they'd never reveal it in court. Now, if shady means that NSA is after you, not so sure.

However, if you want to steal from Google and use their computer to search their search engine from their office...I guess you deserve to get caught. Let's not forget that Google has a right to safeguard their trade secrets and when you accept the job, you agree to their terms.

>do it on public library wifi

yes, one of many ways to get 'anonymous' internet, another is cash buying old cable modem, even unprovisioned they still log into cmts and give you dns access(hint hint)

>and download a Tor browser

no, you go swap meet/yard sale/goodwill/craigslist(using library computer) and cash buy old used($100) working laptop with preinstalled windows

Haha. Even funnier is Levandowski attempting to delete his trash bin contents while in Stroz's offices for the interview.

Does the report mention how they determined this? Was there monitoring software installed on the laptop, or is this part of standard macOS logs?

They mention a tool called Relativity being used. A google search turns up this website: https://www.relativity.com/

Though I am not sure if it is just collates data from MacOs logs or does some kind of deep analysis to pull data.

Google has a hardcore TPM-verified boot with monitoring software installed on all company computers. I believe a good chunk of the userspace log collector is open source: https://github.com/google/grr

Not sure any of this tech was used by or on behalf of the company creating this document though.

Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets | https://news.ycombinator.com/item?id=13718586 (Feb 2017)

> tajen How does Google build such forsenics? | https://news.ycombinator.com/item?id=13718970

> bitL: Alphabet just [...] revealed what they track internally to all their employees | https://news.ycombinator.com/item?id=13719728

These aren't Google devices though, are they? Presumably all of those were returned to Google when they quit.

I believe you are correct. The monitoring of company equipment detected the exfiltration from Google. Metadata from this could have been used to pinpoint the data flow on personal equipment, but it sounds like this document was prepared on the non-Google side.

If his machine was not configured to secure erase files (unlikely; not the default) when emptying trash, they can be "trivially" recovered by firms like this (HFS+ makes it harder than it should be)

"Secure empty trash" was removed in 10.11.[1] But that can't be what they relied on here.

Here's what the report says: "Levandowski also attempted to empty the Trash bin on his MacBook Pro while he was at Stroz Friedberg's office... but our examination found no files were contained in his Trash at the time he attempted to empty it."

Is this even possible? You can't "attempt" to empty a trash with no files in it from the GUI. The menu item is disabled. So that would suggest a terminal command, but supposedly there's no command line equivalent for "empty the trash".[2] You can of course delete specific files or folders, but then they'd say he'd try to do that, not "empty the trash bin".

The only user action that I can think of that would constitute "attempt to empty an empty trash" is hitting the keyboard shortcut for it (shift-command-delete). But is that even logged on a standard macOS installation?

The report references "Exhibit 17" for more detailed forensic analysis. I would be very interested in reading that.

[1] There's still a command line option but it may not work correctly with Flash storage, which is why it was removed from the GUI. https://support.apple.com/en-us/HT205267

[2] https://www.imore.com/how-force-empty-trash-your-mac-using-t...

Reply on news.ycombinator.com