5 ms·

> They could easily bypass Macbook security with a USB device Isn't this only possible if the laptop is unlocked?

andreyf 10y ago
It's not possible unless you have zero-days against the USB drivers or firmware on your laptop, in which case being logged in or not doesn't really matter.
- w00tw00tw00t 10y ago
  Proof I'm paranoid. My greater point, however, is that they have done some really shady stuff, and stealing competitor's IP is part of their culture, so their behavior itself promotes and justifies paranoia on my part and on the part of anyone looking to work for or do business with Uber. Reputation is everything.
  - maverick_iceman 10y ago
    It's pretty stupid to get paranoid over this. As GP pointed out if you logged out then it's very unlikely that they will get access.
    - w00tw00tw00t 10y ago
      I think it's pretty stupid to consider any consumer device to be secure enough. I did hear on HN some time before that interview that some USB device can be used to bypass the lock screen, which was the basis for my worrying. Now, some are saying in this thread that it is possible (or at least was at the time) while others saying that it is not (and was not) -- Even an educated sample of tech folks cannot make up their mind, so there is (or at least was) room for justified concern... no?
      - andreyf 10y ago
        I think the consensus is that it's possible, but expensive. So like, nation-state espionage yes, corporate espionage no. But anyone who actually knows anything won't be talking about it on HN ;)
  - linkregister 10y ago
    I must've missed that story, when did Uber steal competitor IP? (Except this one, of course. To be fair it was Otto before the acquisition)
rasz_pl 10y ago
I can install hardware backdoor in a macbook in under 3 minutes (with prep obviously). Even you could do it https://www.youtube.com/watch?v=qGPGOoJn54E https://www.youtube.com/watch?v=qGPGOoJn54E hint: there are internal USB buses in the macbook, you can hijack one for something like rubberducky +management circuity to trigger only when laptop is powered on for a longer period of time but not touched (no imu/keyboard/touch events/dimmed screen).
wodenokoto 10y ago
If the machine doesn't have full harddrive encryption, you can just boot from USB/CD/Firewire and have access to everything.
- angry_octet 10y ago
  FDE has been the default for ages.

It's not possible unless you have zero-days against the USB drivers or firmware on your laptop, in which case being logged in or not doesn't really matter.

w00tw00tw00t 10y ago
Proof I'm paranoid. My greater point, however, is that they have done some really shady stuff, and stealing competitor's IP is part of their culture, so their behavior itself promotes and justifies paranoia on my part and on the part of anyone looking to work for or do business with Uber. Reputation is everything.
- maverick_iceman 10y ago
  It's pretty stupid to get paranoid over this. As GP pointed out if you logged out then it's very unlikely that they will get access.
  - w00tw00tw00t 10y ago
    I think it's pretty stupid to consider any consumer device to be secure enough. I did hear on HN some time before that interview that some USB device can be used to bypass the lock screen, which was the basis for my worrying. Now, some are saying in this thread that it is possible (or at least was at the time) while others saying that it is not (and was not) -- Even an educated sample of tech folks cannot make up their mind, so there is (or at least was) room for justified concern... no?
    - andreyf 10y ago
      I think the consensus is that it's possible, but expensive. So like, nation-state espionage yes, corporate espionage no. But anyone who actually knows anything won't be talking about it on HN ;)
- linkregister 10y ago
  I must've missed that story, when did Uber steal competitor IP? (Except this one, of course. To be fair it was Otto before the acquisition)

rasz_pl 10y ago

I can install hardware backdoor in a macbook in under 3 minutes (with prep obviously). Even you could do it https://www.youtube.com/watch?v=qGPGOoJn54E https://www.youtube.com/watch?v=qGPGOoJn54E hint: there are internal USB buses in the macbook, you can hijack one for something like rubberducky +management circuity to trigger only when laptop is powered on for a longer period of time but not touched (no imu/keyboard/touch events/dimmed screen).

wodenokoto 10y ago

If the machine doesn't have full harddrive encryption, you can just boot from USB/CD/Firewire and have access to everything.

angry_octet 10y ago
FDE has been the default for ages.