20 ms·

Seem pertinent to atleast get an affidavit from the ex-employee detailing what he as done, agree to hold on to the hardware as evidence, put liability on the em

Seem pertinent to atleast get an affidavit from the ex-employee detailing what he as done, agree to hold on to the hardware as evidence, put liability on the employee for any time-bombs that might have been stored, ask him explicitly to give in writing all the activities he performed, etc. Just to have a thread to pull on, in the future, when something might go wrong.

geek_at 5y ago
We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obfuscated) our internal working theory is that he was tracking the movement data of the boss to avoid him whenever possible.
- Abimelex 5y ago
  how hard can you obfuscate nodejs? I'm pretty sure if you drop the code in some infosec channels they will happily take the challenge and tell you what it does ;)
  - TedDoesntTalk 5y ago
    An easier solution might be to look at the packets the nodejs program is sending over the network (if you can configure a MITM)
    - vorticalbox 5y ago
      Its package.json and / or node_modules might also give some clues
- ChuckNorris89 5y ago
  >he was tracking the movement data of the boss to avoid him whenever possible. Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I just don't get, something doesn't feel right about this being the true reason. To me it looks more like he wanted a covert backdoor in the company network for IP-theft, black-mail or other such data exfiltration purposes. If only he knew that in a year he could avoid his boss all the time thanks to covid-WFH.
  - PragmaticPulp 5y ago
    > Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I’ve mentored a lot of juniors. It’s not uncommon for young people, especially those with less developed social skills, to have an undeserved fear of their boss or anyone else with authority. It’s common with young people who have debilitating anxiety and a tendency toward rumination. They think that as long as they avoid the authority figure, they can avoid any negative social interactions (which are largely imagined). It’s possible that the boss was bad, of course, but I kind of doubt it given that his response to this situation was to let the person off easy.
    - ChuckNorris89 5y ago
      >I’ve mentored a lot of juniors. It’s not uncommon for young people, especially those with less developed social skills. Sure, but even as a junior employee, we're still talking about mature adults here, not kindergarten kiddies, who can vote, pay taxes and are held accountable for their actions in front of the law, so they should be aware that deliberately backdooring their employer so that they can surveillance their boss, not only most likely violates their employment contract they signed and can have serious legal backlash against then both from the company and from the person who's privacy they were trying to break. >It’s common with young people who have debilitating anxiety and a tendency toward rumination. Yeah, I get that, but how is this in excuse for hacking your employer/boss? Why not seek therapy from professionals for that and try to either quit toxic workplaces or report abusive bosses and find a workplace that accommodates your personality and emotional type, not try to hack and backdoor your employer's network to keep tabs on your boss. There is no workplace in the world and no work colleagues that will tolerate you hacking their network and invading their privacy because you have anxiety and a tendency toward rumination.
- mannykannot 5y ago
  At one point you wrote "It is beyond me why a co-founder of a company would distribute these devices around town but well.." I take it, however, that the installer turned out to be someone else. Now I am curious as to whether this company advertises itself as a supplier of such things, and if so, what it claims about their capabilities. Given that the code has not been reverse engineered, can you be sure its capabilities are limited to data exfiltration? I'm also wondering what the perpetrator was up to, if the device's purpose was indeed to help him avoid the boss.
  - BadGhost 5y ago
    This is what I was thinking, except that I started wondering what weird shit this company or its owner are up to.. Maybe a slap on the wrist is just a solution to a mutually assured destruction situation. We all love conspiracy theories so if i were the author of this article id quickly quash this one and provide some more deets.
- vorticalbox 5y ago
  Any plans to release to code? I would love to take a look.
  - TedDoesntTalk 5y ago
    The license.md does not say it is open source :)
    - mbreese 5y ago
      The person who has the device never agreed to that license…
      - brazzy 5y ago
        ...which means that by default they're basically not allowed to do anything with it.
      - dehrmann 5y ago
        Finding a book on a sidewalk doesn't mean you can scan it and legally distribute it.
        SolarNet 5y ago
        Yes but if said book was used in the commission of a crime there is a certain level where it doesn't matter. Don't plug shit into private networks unless you want it reverse engineered. This falls under the fair use exceptions (learning what software is doing / was doing to your network). The copyright holder can take it up with whoever they licensed it to, there is a reason a lot of them read "not to be used in the commission of a crime".
        bigiain 5y ago
        Yeah, it'd be a pretty brazen or stupid hacker who tried to sue you for copyright infringement for code that if they claimed ownership of, provides proof of their illegal activity.
- exikyut 5y ago
  For what it's worth, I'm pretty sure it's quite likely there is a disproportionate number of people Out There™ that would be very happy to sign an NDA and have a look at the nodejs program for free. You might even be able to find someone local. Maybe wander over to the next in-person security conference vaguely nearby? Sadly you have no contact info in your profile so I can't even suggest to people seeing this to cold-email you. (I objectively don't think I would be very successful myself, given that you've mentioned everyone in the office looked at it; I don't have a lot of relevant experience, which sounds reasonably necessary to be successful here.)

geek_at 5y ago

We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obfuscated) our internal working theory is that he was tracking the movement data of the boss to avoid him whenever possible.

Abimelex 5y ago
how hard can you obfuscate nodejs? I'm pretty sure if you drop the code in some infosec channels they will happily take the challenge and tell you what it does ;)
- TedDoesntTalk 5y ago
  An easier solution might be to look at the packets the nodejs program is sending over the network (if you can configure a MITM)
  - vorticalbox 5y ago
    Its package.json and / or node_modules might also give some clues
ChuckNorris89 5y ago
>he was tracking the movement data of the boss to avoid him whenever possible. Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I just don't get, something doesn't feel right about this being the true reason. To me it looks more like he wanted a covert backdoor in the company network for IP-theft, black-mail or other such data exfiltration purposes. If only he knew that in a year he could avoid his boss all the time thanks to covid-WFH.
- PragmaticPulp 5y ago
  > Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I’ve mentored a lot of juniors. It’s not uncommon for young people, especially those with less developed social skills, to have an undeserved fear of their boss or anyone else with authority. It’s common with young people who have debilitating anxiety and a tendency toward rumination. They think that as long as they avoid the authority figure, they can avoid any negative social interactions (which are largely imagined). It’s possible that the boss was bad, of course, but I kind of doubt it given that his response to this situation was to let the person off easy.
  - ChuckNorris89 5y ago
    >I’ve mentored a lot of juniors. It’s not uncommon for young people, especially those with less developed social skills. Sure, but even as a junior employee, we're still talking about mature adults here, not kindergarten kiddies, who can vote, pay taxes and are held accountable for their actions in front of the law, so they should be aware that deliberately backdooring their employer so that they can surveillance their boss, not only most likely violates their employment contract they signed and can have serious legal backlash against then both from the company and from the person who's privacy they were trying to break. >It’s common with young people who have debilitating anxiety and a tendency toward rumination. Yeah, I get that, but how is this in excuse for hacking your employer/boss? Why not seek therapy from professionals for that and try to either quit toxic workplaces or report abusive bosses and find a workplace that accommodates your personality and emotional type, not try to hack and backdoor your employer's network to keep tabs on your boss. There is no workplace in the world and no work colleagues that will tolerate you hacking their network and invading their privacy because you have anxiety and a tendency toward rumination.
mannykannot 5y ago
At one point you wrote "It is beyond me why a co-founder of a company would distribute these devices around town but well.." I take it, however, that the installer turned out to be someone else. Now I am curious as to whether this company advertises itself as a supplier of such things, and if so, what it claims about their capabilities. Given that the code has not been reverse engineered, can you be sure its capabilities are limited to data exfiltration? I'm also wondering what the perpetrator was up to, if the device's purpose was indeed to help him avoid the boss.
- BadGhost 5y ago
  This is what I was thinking, except that I started wondering what weird shit this company or its owner are up to.. Maybe a slap on the wrist is just a solution to a mutually assured destruction situation. We all love conspiracy theories so if i were the author of this article id quickly quash this one and provide some more deets.
vorticalbox 5y ago
Any plans to release to code? I would love to take a look.
- TedDoesntTalk 5y ago
  The license.md does not say it is open source :)
  - mbreese 5y ago
    The person who has the device never agreed to that license…
    - brazzy 5y ago
      ...which means that by default they're basically not allowed to do anything with it.
    - dehrmann 5y ago
      Finding a book on a sidewalk doesn't mean you can scan it and legally distribute it.
      - SolarNet 5y ago
        Yes but if said book was used in the commission of a crime there is a certain level where it doesn't matter. Don't plug shit into private networks unless you want it reverse engineered. This falls under the fair use exceptions (learning what software is doing / was doing to your network). The copyright holder can take it up with whoever they licensed it to, there is a reason a lot of them read "not to be used in the commission of a crime".
        bigiain 5y ago
        Yeah, it'd be a pretty brazen or stupid hacker who tried to sue you for copyright infringement for code that if they claimed ownership of, provides proof of their illegal activity.
exikyut 5y ago
For what it's worth, I'm pretty sure it's quite likely there is a disproportionate number of people Out There™ that would be very happy to sign an NDA and have a look at the nodejs program for free. You might even be able to find someone local. Maybe wander over to the next in-person security conference vaguely nearby? Sadly you have no contact info in your profile so I can't even suggest to people seeing this to cold-email you. (I objectively don't think I would be very successful myself, given that you've mentioned everyone in the office looked at it; I don't have a lot of relevant experience, which sounds reasonably necessary to be successful here.)