3 ms·

> "fitness trackers being used in court is already a thing" It seems to me the quality of that sort of evidence really depends on the nature of the accusations

> "fitness trackers being used in court is already a thing" It seems to me the quality of that sort of evidence really depends on the nature of the accusations. If somebody is accused of being a technically proficient hacker, this sort of technical evidence of their innocence may have a lower value than if somebody is accused of murdering their business rival in some mundane non-technical way. In other words "accused is a murderer and a hacker" is less likely than "accused is a hacker and a hacker"

jonstewart 8y ago
These sorts of arguments are sometimes made, that the suspect was technically proficient and thus could manufacture/manipulate lots of evidence to cover his/her tracks. My experience is that it’s rarely justified. Given the repeated pattern of connections alleged by Tufts, it would be difficult not to have trace evidence on the Mac corroborating it. Unfortunately, that evidence is gone — the fact it was conveniently wiped makes it hard for me to be on the student’s side. However, it’s also the case that Tufts did not conduct a worthy forensic investigation. As an example, macOS maintains a separate, hidden resource fork on every file downloaded via the browser. There’s a corresponding SQLite database of such “quarantined” files, providing some redundancy. I’d be curious about whether the discovered RATs had quarantine entries. I’d also be curious about what the system logs say.
- Wowfunhappy 8y ago
  > macOS maintains a separate, hidden resource fork on every file downloaded via the browser. There’s a corresponding SQLite database of such “quarantined” files, providing some redundancy. I’d be curious about whether the discovered RATs had quarantine entries. I’d also be curious about what the system logs say. Um, separate from this case, that's a bit worrying from a privacy perspective.
  - ghaff 8y ago
    In what way? You probably aren't proficient enough to cover your tracks on a computer (short of wiping it--and maybe not even then) from a competent computer forensics examiner? That shouldn't really be surprising.
    - jonstewart 8y ago
      Wiping works. The old saw about needing to wipe more than once is bunk.
      - ghaff 8y ago
        I meant that, even if you wipe your computer, there may be evidence generated automatically elsewhere such as routers, backup/sync accounts, etc.
    - deleted 8y ago
      [deleted]
    - Wowfunhappy 8y ago
      > In what way? Well, I don't intuitively see a huge difference between my browser history being kept in a database I can't clear (short of nuking the whole system) and my download history being kept in a database I can't clear. I think we'd agree that one would be a problem, so isn't the other? Could a malicious program read this, for instance?
  - jonstewart 8y ago
    It’s how it warns you whether you want to open a file that was downloaded from the internet. Windows has a similar feature with a similar implementation.
    - saagarjha 8y ago
      This should be done exclusively from extended attributes…
      - sfopdxnonstop 8y ago
        Oh my God but that would be bad because privacy or something! Only some other implementation is okay!
        dang 8y ago
        Could you please stop posting unsubstantive comments to Hacker News? You've been doing it a lot, and we're trying for better here. In addition to https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html, you might also find these links helpful for getting the spirit of this site: https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/hackernews.html https://news.ycombinator.com/hackernews.html http://www.paulgraham.com/trolls.html http://www.paulgraham.com/trolls.html http://www.paulgraham.com/hackernews.html http://www.paulgraham.com/hackernews.html
- sizzle 8y ago
  Couldn't they trace the IP that the RAT was phoning home to for a lead on the external culprit, given they were on campus and the possibility of matching the times of the RAT accessing victim's machine and possible CCTV footage of any dorm hall entrances indicated by IP and logs of users etc.

jonstewart 8y ago

These sorts of arguments are sometimes made, that the suspect was technically proficient and thus could manufacture/manipulate lots of evidence to cover his/her tracks. My experience is that it’s rarely justified. Given the repeated pattern of connections alleged by Tufts, it would be difficult not to have trace evidence on the Mac corroborating it. Unfortunately, that evidence is gone — the fact it was conveniently wiped makes it hard for me to be on the student’s side. However, it’s also the case that Tufts did not conduct a worthy forensic investigation. As an example, macOS maintains a separate, hidden resource fork on every file downloaded via the browser. There’s a corresponding SQLite database of such “quarantined” files, providing some redundancy. I’d be curious about whether the discovered RATs had quarantine entries. I’d also be curious about what the system logs say.

Wowfunhappy 8y ago
> macOS maintains a separate, hidden resource fork on every file downloaded via the browser. There’s a corresponding SQLite database of such “quarantined” files, providing some redundancy. I’d be curious about whether the discovered RATs had quarantine entries. I’d also be curious about what the system logs say. Um, separate from this case, that's a bit worrying from a privacy perspective.
- ghaff 8y ago
  In what way? You probably aren't proficient enough to cover your tracks on a computer (short of wiping it--and maybe not even then) from a competent computer forensics examiner? That shouldn't really be surprising.
  - jonstewart 8y ago
    Wiping works. The old saw about needing to wipe more than once is bunk.
    - ghaff 8y ago
      I meant that, even if you wipe your computer, there may be evidence generated automatically elsewhere such as routers, backup/sync accounts, etc.
  - deleted 8y ago
    [deleted]
  - Wowfunhappy 8y ago
    > In what way? Well, I don't intuitively see a huge difference between my browser history being kept in a database I can't clear (short of nuking the whole system) and my download history being kept in a database I can't clear. I think we'd agree that one would be a problem, so isn't the other? Could a malicious program read this, for instance?
- jonstewart 8y ago
  It’s how it warns you whether you want to open a file that was downloaded from the internet. Windows has a similar feature with a similar implementation.
  - saagarjha 8y ago
    This should be done exclusively from extended attributes…
    - sfopdxnonstop 8y ago
      Oh my God but that would be bad because privacy or something! Only some other implementation is okay!
      - dang 8y ago
        Could you please stop posting unsubstantive comments to Hacker News? You've been doing it a lot, and we're trying for better here. In addition to https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html, you might also find these links helpful for getting the spirit of this site: https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/hackernews.html https://news.ycombinator.com/hackernews.html http://www.paulgraham.com/trolls.html http://www.paulgraham.com/trolls.html http://www.paulgraham.com/hackernews.html http://www.paulgraham.com/hackernews.html
sizzle 8y ago
Couldn't they trace the IP that the RAT was phoning home to for a lead on the external culprit, given they were on campus and the possibility of matching the times of the RAT accessing victim's machine and possible CCTV footage of any dorm hall entrances indicated by IP and logs of users etc.