Hacker News Reader

Comment by wyldfire | Hacker News Reader

> After getting my drives back I checked one of my USB drives and it had a .docx file on it that didn't come from me.

Booooo. Die BVT dropped the ball on preserving the chain of custody for this evidence. They should have used equipment that bars device writes.

View on HN

Or leaving the .docx file was intentional and by opening it, the guy triggered a hidden payload which installs malware which the police use to monitor him.

If they had his hardware for a year I don't think they would need him to trigger a hidden payload.

Its to allow them to continue monitoring his activities going forward, without the need for annoying warrants and physical searches.

I think the point is that they could have just installed the malware since they had physical possession for an entire year.

And the counterpoint is that he'd obviously got a new computer and any further surveillance would benefit from access to that one.

That's a good point. I was assuming the old hard drive was loaded on old equipment but that's not necessarily the case.

Why would you ever spin those drives up again? I'd sledgehammer them just to make sure.

Would it be possible to hide an exploit or test in a Word doc or image? I suppose they could have planted the image there with some steganographic encryption, and if the author was clever enough to find another link and click it, he would alert authorities to that fact?

This sounds farfetched when I write it out.

I would reuse an already existing files on the hard drive to do that instead of adding a new one.

By adding a new file, it piques curiosity, or triggers communication to the person in the photo to let them know that they're on to them.

Plausible line of thought.

I was thinking about this too but, at least in my case, would make me doubt about it.

Its common to use Word macros to install malware.

Though in this case mitigated by the split between .docx (macro-less) documents and .docm (macro-enabled).

Either file type can also be unzipped and have their contents inspected for anything suspicious.

Reply on news.ycombinator.com