4 ms·

How hard is it to fool the fitness tracker? Unless it has some robust detection of being taken off and being put back on it would seem like it could be fooled i

by xt00 8y ago

How hard is it to fool the fitness tracker? Unless it has some robust detection of being taken off and being put back on it would seem like it could be fooled in a variety of ways.. not that it means she is guilty but fitness trackers being used in court is already a thing so I wonder if they are actually hard to fool by just normal people doing something simple..

darkpuma 8y ago
> "fitness trackers being used in court is already a thing" It seems to me the quality of that sort of evidence really depends on the nature of the accusations. If somebody is accused of being a technically proficient hacker, this sort of technical evidence of their innocence may have a lower value than if somebody is accused of murdering their business rival in some mundane non-technical way. In other words "accused is a murderer and a hacker" is less likely than "accused is a hacker and a hacker"
- jonstewart 8y ago
  These sorts of arguments are sometimes made, that the suspect was technically proficient and thus could manufacture/manipulate lots of evidence to cover his/her tracks. My experience is that it’s rarely justified. Given the repeated pattern of connections alleged by Tufts, it would be difficult not to have trace evidence on the Mac corroborating it. Unfortunately, that evidence is gone — the fact it was conveniently wiped makes it hard for me to be on the student’s side. However, it’s also the case that Tufts did not conduct a worthy forensic investigation. As an example, macOS maintains a separate, hidden resource fork on every file downloaded via the browser. There’s a corresponding SQLite database of such “quarantined” files, providing some redundancy. I’d be curious about whether the discovered RATs had quarantine entries. I’d also be curious about what the system logs say.
  - Wowfunhappy 8y ago
    > macOS maintains a separate, hidden resource fork on every file downloaded via the browser. There’s a corresponding SQLite database of such “quarantined” files, providing some redundancy. I’d be curious about whether the discovered RATs had quarantine entries. I’d also be curious about what the system logs say. Um, separate from this case, that's a bit worrying from a privacy perspective.
    - ghaff 8y ago
      In what way? You probably aren't proficient enough to cover your tracks on a computer (short of wiping it--and maybe not even then) from a competent computer forensics examiner? That shouldn't really be surprising.
      - jonstewart 8y ago
        Wiping works. The old saw about needing to wipe more than once is bunk.
        ghaff 8y ago
        I meant that, even if you wipe your computer, there may be evidence generated automatically elsewhere such as routers, backup/sync accounts, etc.
      - deleted 8y ago
        [deleted]
      - Wowfunhappy 8y ago
        > In what way? Well, I don't intuitively see a huge difference between my browser history being kept in a database I can't clear (short of nuking the whole system) and my download history being kept in a database I can't clear. I think we'd agree that one would be a problem, so isn't the other? Could a malicious program read this, for instance?
    - jonstewart 8y ago
      It’s how it warns you whether you want to open a file that was downloaded from the internet. Windows has a similar feature with a similar implementation.
      - saagarjha 8y ago
        This should be done exclusively from extended attributes…
  - sizzle 8y ago
    Couldn't they trace the IP that the RAT was phoning home to for a lead on the external culprit, given they were on campus and the possibility of matching the times of the RAT accessing victim's machine and possible CCTV footage of any dorm hall entrances indicated by IP and logs of users etc.
maxerickson 8y ago
Hand it to someone else.
sleepysysadmin 8y ago
The fitness tracker defense is dumb. A hacker skilled to the point of finding 0days in their systems can just script the hacks while you sleep. However the fitness tracker defense in conjunction with mac-user and going to apple store for help tells me she's tech dumb, location data turned on for pictures. I highly doubt there has ever been another PHD veternarian who is also a skilled hacker with this level of techdumb still happening. She might be dating or know someone who is hacking... but you don't get to being a PHD student without knowing your field. Your teachers would know if you're dumb.

by xt00 8y ago

darkpuma 8y ago

> "fitness trackers being used in court is already a thing" It seems to me the quality of that sort of evidence really depends on the nature of the accusations. If somebody is accused of being a technically proficient hacker, this sort of technical evidence of their innocence may have a lower value than if somebody is accused of murdering their business rival in some mundane non-technical way. In other words "accused is a murderer and a hacker" is less likely than "accused is a hacker and a hacker"

jonstewart 8y ago
These sorts of arguments are sometimes made, that the suspect was technically proficient and thus could manufacture/manipulate lots of evidence to cover his/her tracks. My experience is that it’s rarely justified. Given the repeated pattern of connections alleged by Tufts, it would be difficult not to have trace evidence on the Mac corroborating it. Unfortunately, that evidence is gone — the fact it was conveniently wiped makes it hard for me to be on the student’s side. However, it’s also the case that Tufts did not conduct a worthy forensic investigation. As an example, macOS maintains a separate, hidden resource fork on every file downloaded via the browser. There’s a corresponding SQLite database of such “quarantined” files, providing some redundancy. I’d be curious about whether the discovered RATs had quarantine entries. I’d also be curious about what the system logs say.
- Wowfunhappy 8y ago
  > macOS maintains a separate, hidden resource fork on every file downloaded via the browser. There’s a corresponding SQLite database of such “quarantined” files, providing some redundancy. I’d be curious about whether the discovered RATs had quarantine entries. I’d also be curious about what the system logs say. Um, separate from this case, that's a bit worrying from a privacy perspective.
  - ghaff 8y ago
    In what way? You probably aren't proficient enough to cover your tracks on a computer (short of wiping it--and maybe not even then) from a competent computer forensics examiner? That shouldn't really be surprising.
    - jonstewart 8y ago
      Wiping works. The old saw about needing to wipe more than once is bunk.
      - ghaff 8y ago
        I meant that, even if you wipe your computer, there may be evidence generated automatically elsewhere such as routers, backup/sync accounts, etc.
    - deleted 8y ago
      [deleted]
    - Wowfunhappy 8y ago
      > In what way? Well, I don't intuitively see a huge difference between my browser history being kept in a database I can't clear (short of nuking the whole system) and my download history being kept in a database I can't clear. I think we'd agree that one would be a problem, so isn't the other? Could a malicious program read this, for instance?
  - jonstewart 8y ago
    It’s how it warns you whether you want to open a file that was downloaded from the internet. Windows has a similar feature with a similar implementation.
    - saagarjha 8y ago
      This should be done exclusively from extended attributes…
- sizzle 8y ago
  Couldn't they trace the IP that the RAT was phoning home to for a lead on the external culprit, given they were on campus and the possibility of matching the times of the RAT accessing victim's machine and possible CCTV footage of any dorm hall entrances indicated by IP and logs of users etc.

maxerickson 8y ago

Hand it to someone else.

sleepysysadmin 8y ago

The fitness tracker defense is dumb. A hacker skilled to the point of finding 0days in their systems can just script the hacks while you sleep. However the fitness tracker defense in conjunction with mac-user and going to apple store for help tells me she's tech dumb, location data turned on for pictures. I highly doubt there has ever been another PHD veternarian who is also a skilled hacker with this level of techdumb still happening. She might be dating or know someone who is hacking... but you don't get to being a PHD student without knowing your field. Your teachers would know if you're dumb.