6 ms·

Lior Ron: 1/12/2016 Internet search on "how to securely delete files mac" 1/13/2016 Ron leaves Google 1/19/2016 Internet search on "can a MacBook be recovere

by warent 9y ago

Lior Ron: 1/12/2016 Internet search on "how to securely delete files mac" 1/13/2016 Ron leaves Google 1/19/2016 Internet search on "can a MacBook be recovered after formatting the OS" 3/22/2016 A file labelled Chauffer win plan.docx is deleted, shortly before Ron's interview with Stroz Friedberg "Chauffer win plan.docx" is this guy serious? Did he name his other incriminating file "if they find this im fucked.pdf"

curiousDog 9y ago
Haha. Even funnier is Levandowski attempting to delete his trash bin contents while in Stroz's offices for the interview.
- abalone 9y ago
  Does the report mention how they determined this? Was there monitoring software installed on the laptop, or is this part of standard macOS logs?
  - thisisit 9y ago
    They mention a tool called Relativity being used. A google search turns up this website: https://www.relativity.com/ https://www.relativity.com/ Though I am not sure if it is just collates data from MacOs logs or does some kind of deep analysis to pull data.
  - j_s 9y ago
    Google has a hardcore TPM-verified boot with monitoring software installed on all company computers. I believe a good chunk of the userspace log collector is open source: https://github.com/google/grr https://github.com/google/grr Not sure any of this tech was used by or on behalf of the company creating this document though. Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets | https://news.ycombinator.com/item?id=13718586 https://news.ycombinator.com/item?id=13718586 (Feb 2017) > tajen How does Google build such forsenics? | https://news.ycombinator.com/item?id=13718970 https://news.ycombinator.com/item?id=13718970 > bitL: Alphabet just [...] revealed what they track internally to all their employees | https://news.ycombinator.com/item?id=13719728 https://news.ycombinator.com/item?id=13719728
    - tlrobinson 9y ago
      These aren't Google devices though, are they? Presumably all of those were returned to Google when they quit.
      - j_s 9y ago
        I believe you are correct. The monitoring of company equipment detected the exfiltration from Google. Metadata from this could have been used to pinpoint the data flow on personal equipment, but it sounds like this document was prepared on the non-Google side.
  - nevir 9y ago
    If his machine was not configured to secure erase files (unlikely; not the default) when emptying trash, they can be "trivially" recovered by firms like this (HFS+ makes it harder than it should be)
    - abalone 9y ago
      "Secure empty trash" was removed in 10.11.[1] But that can't be what they relied on here. Here's what the report says: "Levandowski also attempted to empty the Trash bin on his MacBook Pro while he was at Stroz Friedberg's office... but our examination found no files were contained in his Trash at the time he attempted to empty it." Is this even possible? You can't "attempt" to empty a trash with no files in it from the GUI. The menu item is disabled. So that would suggest a terminal command, but supposedly there's no command line equivalent for "empty the trash".[2] You can of course delete specific files or folders, but then they'd say he'd try to do that, not "empty the trash bin". The only user action that I can think of that would constitute "attempt to empty an empty trash" is hitting the keyboard shortcut for it (shift-command-delete). But is that even logged on a standard macOS installation? The report references "Exhibit 17" for more detailed forensic analysis. I would be very interested in reading that. [1] There's still a command line option but it may not work correctly with Flash storage, which is why it was removed from the GUI. https://support.apple.com/en-us/HT205267 https://support.apple.com/en-us/HT205267 [2] https://www.imore.com/how-force-empty-trash-your-mac-using-terminal https://www.imore.com/how-force-empty-trash-your-mac-using-t...
PhasmaFelis 9y ago
Is opsec really as hard as all these people make it seem? If I were planning something shady there's probably a lot of stupid questions I'd need to Google for, but I'd at least do it on public library wifi and download a Tor browser or something. I dunno if that would protect me, but it's more than seems to have been done here.
- dx034 9y ago
  Once you start using Tor and public Wifi, you admit that what you're doing is illegal. I think in these cases, many people tell themselves that they operate in some kind of gray area.
  - cyphar 9y ago
    Which is why you should aim to always use Tor. That's one of the points made quite often by the Tor Project -- anonymity is useless if you only use it when you're doing something shady. The same applies to people who only encrypt shady emails, rather than encrypting all of them.
    - stouset 9y ago
      GP meant that doing so would force those involved to be forced to reconcile with themselves the illegality of their behavior. Although ironically I think in this case your point actually still stands.
    - PhasmaFelis 9y ago
      I thought it was considered rude (or at least hell on transmission quality) to play videos, etc. over Tor.
  - kobeya 9y ago
    > Once you start using Tor and public Wifi, you admit that what you're doing is illegal. Thankfully that’s not how law works. Also, I use Tor everyday, for totally legal things I want to keep private.

by warent 9y ago

curiousDog 9y ago

Haha. Even funnier is Levandowski attempting to delete his trash bin contents while in Stroz's offices for the interview.

abalone 9y ago
Does the report mention how they determined this? Was there monitoring software installed on the laptop, or is this part of standard macOS logs?
- thisisit 9y ago
  They mention a tool called Relativity being used. A google search turns up this website: https://www.relativity.com/ https://www.relativity.com/ Though I am not sure if it is just collates data from MacOs logs or does some kind of deep analysis to pull data.
- j_s 9y ago
  Google has a hardcore TPM-verified boot with monitoring software installed on all company computers. I believe a good chunk of the userspace log collector is open source: https://github.com/google/grr https://github.com/google/grr Not sure any of this tech was used by or on behalf of the company creating this document though. Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets | https://news.ycombinator.com/item?id=13718586 https://news.ycombinator.com/item?id=13718586 (Feb 2017) > tajen How does Google build such forsenics? | https://news.ycombinator.com/item?id=13718970 https://news.ycombinator.com/item?id=13718970 > bitL: Alphabet just [...] revealed what they track internally to all their employees | https://news.ycombinator.com/item?id=13719728 https://news.ycombinator.com/item?id=13719728
  - tlrobinson 9y ago
    These aren't Google devices though, are they? Presumably all of those were returned to Google when they quit.
    - j_s 9y ago
      I believe you are correct. The monitoring of company equipment detected the exfiltration from Google. Metadata from this could have been used to pinpoint the data flow on personal equipment, but it sounds like this document was prepared on the non-Google side.
- nevir 9y ago
  If his machine was not configured to secure erase files (unlikely; not the default) when emptying trash, they can be "trivially" recovered by firms like this (HFS+ makes it harder than it should be)
  - abalone 9y ago
    "Secure empty trash" was removed in 10.11.[1] But that can't be what they relied on here. Here's what the report says: "Levandowski also attempted to empty the Trash bin on his MacBook Pro while he was at Stroz Friedberg's office... but our examination found no files were contained in his Trash at the time he attempted to empty it." Is this even possible? You can't "attempt" to empty a trash with no files in it from the GUI. The menu item is disabled. So that would suggest a terminal command, but supposedly there's no command line equivalent for "empty the trash".[2] You can of course delete specific files or folders, but then they'd say he'd try to do that, not "empty the trash bin". The only user action that I can think of that would constitute "attempt to empty an empty trash" is hitting the keyboard shortcut for it (shift-command-delete). But is that even logged on a standard macOS installation? The report references "Exhibit 17" for more detailed forensic analysis. I would be very interested in reading that. [1] There's still a command line option but it may not work correctly with Flash storage, which is why it was removed from the GUI. https://support.apple.com/en-us/HT205267 https://support.apple.com/en-us/HT205267 [2] https://www.imore.com/how-force-empty-trash-your-mac-using-terminal https://www.imore.com/how-force-empty-trash-your-mac-using-t...

PhasmaFelis 9y ago

Is opsec really as hard as all these people make it seem? If I were planning something shady there's probably a lot of stupid questions I'd need to Google for, but I'd at least do it on public library wifi and download a Tor browser or something. I dunno if that would protect me, but it's more than seems to have been done here.

dx034 9y ago
Once you start using Tor and public Wifi, you admit that what you're doing is illegal. I think in these cases, many people tell themselves that they operate in some kind of gray area.
- cyphar 9y ago
  Which is why you should aim to always use Tor. That's one of the points made quite often by the Tor Project -- anonymity is useless if you only use it when you're doing something shady. The same applies to people who only encrypt shady emails, rather than encrypting all of them.
  - stouset 9y ago
    GP meant that doing so would force those involved to be forced to reconcile with themselves the illegality of their behavior. Although ironically I think in this case your point actually still stands.
  - PhasmaFelis 9y ago
    I thought it was considered rude (or at least hell on transmission quality) to play videos, etc. over Tor.
- kobeya 9y ago
  > Once you start using Tor and public Wifi, you admit that what you're doing is illegal. Thankfully that’s not how law works. Also, I use Tor everyday, for totally legal things I want to keep private.