6 ms·

I had an interview there where the manager asked me to leave my laptop behind and go for a walk. I was hesitant after hearing stories of Uber conducting electro

I had an interview there where the manager asked me to leave my laptop behind and go for a walk. I was hesitant after hearing stories of Uber conducting electronic espionage against its competitors. They could easily bypass Macbook security with a USB device (I had heard of that on HN too) so I was very nervous to leave my laptop behind and noted its exact orientation and position on the table. Sure enough when I returned my laptop had changed both position and orientation, but only enough to tell if you had specifically memorized it. I could be paranoid. They could have simply moved things on the desk. But anyway, people who are paranoid like me are advised not to take their laptops into Uber interviews. They are capable of just about anything, or so thinks my now paranoid self.

fuzzythinker 10y ago
Thanks for the info. Will know not leave my laptop behind in any interviews.
- cmyr 10y ago
  A better strategy is just to not interview at uber.
- tomjakubowski 10y ago
  I've never felt the need to bring my own laptop to a job interview. If the company asked me to bring my own, I'd consider that strange or even suspicious.
  - whorleater 10y ago
    It'd be really weird for them to request you to bring a laptop, but sometimes when a company flies you out for an onsite and your return flight is that night, your options are either 1) leave your laptop with the hotel as luggage (pretty bad) or 2) bring your laptop to the interview. There's no real reason for them to know you have your laptop with you however.
    - w00tw00tw00t 10y ago
      they did not offer to provide me with a laptop and the interview format was such that I could google things and share some of my personal projects etc
      - hocuspocus 10y ago
        That is weird. What kind of tech company doesn't have an old laptop or a Chromebook for such interview format? What if you don't have a personal laptop? I'm certainly not bringing my work laptop to a job interview...
        mst 10y ago
        The kind that's also too cheap to buy jackets for all their SREs, apparently. This sort of penny-wise-but-pound-foolish shit is depressing, but not nearly as rare as I wish it was.
deleted 10y ago
[deleted]
rajathagasthya 10y ago
> They could easily bypass Macbook security with a USB device Isn't this only possible if the laptop is unlocked?
- andreyf 10y ago
  It's not possible unless you have zero-days against the USB drivers or firmware on your laptop, in which case being logged in or not doesn't really matter.
  - w00tw00tw00t 10y ago
    Proof I'm paranoid. My greater point, however, is that they have done some really shady stuff, and stealing competitor's IP is part of their culture, so their behavior itself promotes and justifies paranoia on my part and on the part of anyone looking to work for or do business with Uber. Reputation is everything.
    - maverick_iceman 10y ago
      It's pretty stupid to get paranoid over this. As GP pointed out if you logged out then it's very unlikely that they will get access.
      - w00tw00tw00t 10y ago
        I think it's pretty stupid to consider any consumer device to be secure enough. I did hear on HN some time before that interview that some USB device can be used to bypass the lock screen, which was the basis for my worrying. Now, some are saying in this thread that it is possible (or at least was at the time) while others saying that it is not (and was not) -- Even an educated sample of tech folks cannot make up their mind, so there is (or at least was) room for justified concern... no?
        andreyf 10y ago
        I think the consensus is that it's possible, but expensive. So like, nation-state espionage yes, corporate espionage no. But anyone who actually knows anything won't be talking about it on HN ;)
danielcampos93 10y ago
im just gonna say the fact that they told you to go for a walk and leave your laptop is pretty creepy.
- marmshallow 10y ago
  Sounds more normal than asking you to take your laptop on a walk.
  - rm_-rf_slash 10y ago
    As a security-minded person, I would be suspicious under any circumstance where someone unfamiliar distanced me from my devices.
ghughes 10y ago
This smells like FUD. > They could have simply moved things on the desk. Is there any evidence suggesting something else happened?
kartickv 10y ago
You didn't ask why?
- w00tw00tw00t 10y ago
  as a candidate you're trying to please and build trust, so naturally I wouldn't raise questions that would indicate my lack of trust
  - gdubs 10y ago
    Piece of unsolicited advice for the future: don't let anyone pressure you into doing anything you don't feel comfortable with. Ever. If a place is worth working for they're not going to judge you for feeling more comfortable keeping your stuff with you.
    - _audakel 10y ago
      What about the TSA people asking for your cell phone at the airport? The whole border crossing incidents
  - rasz_pl 10y ago
    Recruiter A to recruiter B: Well, I hoped this one would be sharp enough, guess we need to search harder for people that wont be careless with our company sensitive stuff laying around simply because someone told them to leave laptop behind and take a walk ...
    - w00tw00tw00t 10y ago
      it wasn't a company laptop
AlexCoventry 10y ago
Did you check the logs to see whether it had been opened in the meantime?
- w00tw00tw00t 10y ago
  No, how do you do that?
  - dmix 10y ago
    Well, logs are quite easily accessible on any OS. Memory forensics would have 100% given you evidence that it was accessed and exactly what was done. There are plenty of guides on how to forensically dump memory but that depends on the OS. But I'm also in this is FUD camp. I highly doubt any company would do such a risky thing such as mirror your machine data merely for an interview. This would be highly illegal and damage the companies reputation for a relatively minor benefit. Especially when interviewing any software dev which any infosec person would assume they are dealing with a sophisticated target with a high chance of being detected. Meaning they would have to use very careful cloning techniques. It would be much easier to get you on staff on a company machine and temporarily monitor you closely after the fact. There are plenty of ways to thoroughly vet someone beforehand without taking such a risk.
    - w00tw00tw00t 10y ago
      I think you might be right, but I had reason to worry given Uber's history with competitors, esp. industrial espionage. They were actively competing with the company I worked for at the time. The laptop was my own, but I have no reason to assume that they knew that. I did have some material of my own that I considered to be valuable to their business so I was concerned primarily about that (I had done things that have pushed the envelop quite a bit in a very specialized area that they were just getting into) All of those factors made me paranoid. If Uber was a good corporate citizen with no history of actively and illegally spying on competitors, I would not have been so freaked out after that episode. Call me paranoid... what's new.
imranq 10y ago
1. Why bring your own laptop to an interview? 2. Isn't this scenario incredibly suspicious?
- aisofteng 10y ago
  I have been asked to bring my laptop to a interview so that I could could in a development environment I am already comfortable with. I not only found it reasonable but also appreciated it.
  - imranq 10y ago
    Ah that makes sense. They can still use a cloud based coding pad like most companies do
sbierwagen 10y ago
Why didn't you just shut it off first? You had FDE turned on, right?
- danielweber 10y ago
  https://github.com/GDSSecurity/EvilAbigail#scenario https://github.com/GDSSecurity/EvilAbigail#scenario
  - brazzledazzle 10y ago
    That's pretty cool but won't do much against macOS.
ebf6 10y ago
> I could be paranoid. They could have simply moved things on the desk. But anyway, people who are paranoid like me are advised not to take their laptops into Uber interviews. They are capable of just about anything, or so thinks my now paranoid self. I would be cautious about discrediting intuition as paranoia.
EnFinlay 10y ago
So, anyone up for getting an Uber interview and using their laptop as a honeypot?

fuzzythinker 10y ago

Thanks for the info. Will know not leave my laptop behind in any interviews.

cmyr 10y ago
A better strategy is just to not interview at uber.
tomjakubowski 10y ago
I've never felt the need to bring my own laptop to a job interview. If the company asked me to bring my own, I'd consider that strange or even suspicious.
- whorleater 10y ago
  It'd be really weird for them to request you to bring a laptop, but sometimes when a company flies you out for an onsite and your return flight is that night, your options are either 1) leave your laptop with the hotel as luggage (pretty bad) or 2) bring your laptop to the interview. There's no real reason for them to know you have your laptop with you however.
  - w00tw00tw00t 10y ago
    they did not offer to provide me with a laptop and the interview format was such that I could google things and share some of my personal projects etc
    - hocuspocus 10y ago
      That is weird. What kind of tech company doesn't have an old laptop or a Chromebook for such interview format? What if you don't have a personal laptop? I'm certainly not bringing my work laptop to a job interview...
      - mst 10y ago
        The kind that's also too cheap to buy jackets for all their SREs, apparently. This sort of penny-wise-but-pound-foolish shit is depressing, but not nearly as rare as I wish it was.

deleted 10y ago

[deleted]

rajathagasthya 10y ago

> They could easily bypass Macbook security with a USB device Isn't this only possible if the laptop is unlocked?

andreyf 10y ago
It's not possible unless you have zero-days against the USB drivers or firmware on your laptop, in which case being logged in or not doesn't really matter.
- w00tw00tw00t 10y ago
  Proof I'm paranoid. My greater point, however, is that they have done some really shady stuff, and stealing competitor's IP is part of their culture, so their behavior itself promotes and justifies paranoia on my part and on the part of anyone looking to work for or do business with Uber. Reputation is everything.
  - maverick_iceman 10y ago
    It's pretty stupid to get paranoid over this. As GP pointed out if you logged out then it's very unlikely that they will get access.
    - w00tw00tw00t 10y ago
      I think it's pretty stupid to consider any consumer device to be secure enough. I did hear on HN some time before that interview that some USB device can be used to bypass the lock screen, which was the basis for my worrying. Now, some are saying in this thread that it is possible (or at least was at the time) while others saying that it is not (and was not) -- Even an educated sample of tech folks cannot make up their mind, so there is (or at least was) room for justified concern... no?
      - andreyf 10y ago
        I think the consensus is that it's possible, but expensive. So like, nation-state espionage yes, corporate espionage no. But anyone who actually knows anything won't be talking about it on HN ;)

danielcampos93 10y ago

im just gonna say the fact that they told you to go for a walk and leave your laptop is pretty creepy.

marmshallow 10y ago
Sounds more normal than asking you to take your laptop on a walk.
- rm_-rf_slash 10y ago
  As a security-minded person, I would be suspicious under any circumstance where someone unfamiliar distanced me from my devices.

ghughes 10y ago

This smells like FUD. > They could have simply moved things on the desk. Is there any evidence suggesting something else happened?

kartickv 10y ago

You didn't ask why?

w00tw00tw00t 10y ago
as a candidate you're trying to please and build trust, so naturally I wouldn't raise questions that would indicate my lack of trust
- gdubs 10y ago
  Piece of unsolicited advice for the future: don't let anyone pressure you into doing anything you don't feel comfortable with. Ever. If a place is worth working for they're not going to judge you for feeling more comfortable keeping your stuff with you.
  - _audakel 10y ago
    What about the TSA people asking for your cell phone at the airport? The whole border crossing incidents
- rasz_pl 10y ago
  Recruiter A to recruiter B: Well, I hoped this one would be sharp enough, guess we need to search harder for people that wont be careless with our company sensitive stuff laying around simply because someone told them to leave laptop behind and take a walk ...
  - w00tw00tw00t 10y ago
    it wasn't a company laptop

AlexCoventry 10y ago

Did you check the logs to see whether it had been opened in the meantime?

w00tw00tw00t 10y ago
No, how do you do that?
- dmix 10y ago
  Well, logs are quite easily accessible on any OS. Memory forensics would have 100% given you evidence that it was accessed and exactly what was done. There are plenty of guides on how to forensically dump memory but that depends on the OS. But I'm also in this is FUD camp. I highly doubt any company would do such a risky thing such as mirror your machine data merely for an interview. This would be highly illegal and damage the companies reputation for a relatively minor benefit. Especially when interviewing any software dev which any infosec person would assume they are dealing with a sophisticated target with a high chance of being detected. Meaning they would have to use very careful cloning techniques. It would be much easier to get you on staff on a company machine and temporarily monitor you closely after the fact. There are plenty of ways to thoroughly vet someone beforehand without taking such a risk.
  - w00tw00tw00t 10y ago
    I think you might be right, but I had reason to worry given Uber's history with competitors, esp. industrial espionage. They were actively competing with the company I worked for at the time. The laptop was my own, but I have no reason to assume that they knew that. I did have some material of my own that I considered to be valuable to their business so I was concerned primarily about that (I had done things that have pushed the envelop quite a bit in a very specialized area that they were just getting into) All of those factors made me paranoid. If Uber was a good corporate citizen with no history of actively and illegally spying on competitors, I would not have been so freaked out after that episode. Call me paranoid... what's new.

imranq 10y ago

1. Why bring your own laptop to an interview? 2. Isn't this scenario incredibly suspicious?

aisofteng 10y ago
I have been asked to bring my laptop to a interview so that I could could in a development environment I am already comfortable with. I not only found it reasonable but also appreciated it.
- imranq 10y ago
  Ah that makes sense. They can still use a cloud based coding pad like most companies do

sbierwagen 10y ago

Why didn't you just shut it off first? You had FDE turned on, right?

danielweber 10y ago
https://github.com/GDSSecurity/EvilAbigail#scenario https://github.com/GDSSecurity/EvilAbigail#scenario
- brazzledazzle 10y ago
  That's pretty cool but won't do much against macOS.

ebf6 10y ago

> I could be paranoid. They could have simply moved things on the desk. But anyway, people who are paranoid like me are advised not to take their laptops into Uber interviews. They are capable of just about anything, or so thinks my now paranoid self. I would be cautious about discrediting intuition as paranoia.

EnFinlay 10y ago

So, anyone up for getting an Uber interview and using their laptop as a honeypot?