Re:Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets
by Jabbles on Thursday February 23, 2017 @07:17PM
(#13719392)
Just to be clear "his" laptop is "the laptop issued to him by Google".
I'd think that standard antivirus software detects and alerts external drives being attached.
Re:Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets
by corvus_sapiens on Thursday February 23, 2017 @08:14PM
(#13719898)
1) makes sense if Levandowski did it over the company internet connection. There could be a record of his unusual requests (software download, software update).
> they can infer that he wiped it
For 4), Levandowski reformatted the hard drive before returning it, so there's no inference there.
Re:Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets
by joezydeco on Friday February 24, 2017 @11:53AM
(#13725334)
It could be a lot simpler than that.
Perhaps the size of the downloaded repository is larger than the physical size of the drive on the laptop?
Re:Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets
by Animats on Friday February 24, 2017 @12:41AM
(#13721330)
Since he was working on self-driving cars at Google, he probably was authorized access to the software and hardware involved.
Re:Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets
by foota on Thursday February 23, 2017 @07:07PM
(#13719291)
Maybe video footage?
Re:Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets
by ocdtrekkie on Thursday February 23, 2017 @07:28PM
(#13719491)
This is all information a rudimentary desktop auditing tool can gather and store on a server. Most collect both hardware (which would include connected devices) and software inventory. Anyone SHOULD be auditing company PCs on a relatively regular basis. It wouldn't surprise me if Google was auditing much more frequently than the average and could catch something like this in the act.
Re:Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets
by 086421357909764 on Thursday February 23, 2017 @08:20PM
(#13719934)
Yup, lots of firms using HIDS that gather all sorts of system data. OSSEC is what I've seen rather frequently for this.
They had to know that he:
1. modified the software on his laptop
2. logged into an area he should not have had access to (this is probably standard)
3. attached an external drive (possible, but standard?)
4. and they got all this info after he deleted the drive, which means they either went in and found remaining data on the drive or else they captured the info in real time.
I suppose if the drive is clean now, and they know he downloaded data, they can infer that he wiped it.
I suppose that if they know he accessed it, and there was software on his computer preventing him from doing so, they can infer that he downloaded something to overcome it.
But knowing that he connected to an external drive implies active monitoring. That's the part I am most curious about.