News for hackers. Stuff that matters.
Re:Bossware is a big legal risk by triyambakam on Wednesday May 15, 2024 @04:58PM (#40372275)
So how do I know if my work computer features such surveillance?
Re:Bossware is a big legal risk by ChrisMarshallNY on Wednesday May 15, 2024 @05:17PM (#40372461)
That's a big reason that I purchased my own, personal computer, many years ago. I was paid well enough, that it was quite possible.

Back then, they hadn't really gotten going with all the monitoring stuff, but I did it from a sense of personal integrity.

I was writing open-source stuff, and there was no way that I was going to allow my company to try to claim it. I didn't use company time, and I didn't use company equipment.

I did not have a "shower clause" in my employment contract, so I was free to work on my own stuff, on my own time.

Re:Bossware is a big legal risk by saagarjha on Thursday May 16, 2024 @09:39AM (#40378330)
Are you a contractor? This makes things a lot easier. For salaried employees that kind of agreement is far more common :(
Re:Bossware is a big legal risk by ChrisMarshallNY on Thursday May 16, 2024 @10:58AM (#40379219)
No, I was an employee.

However, I worked at a company that employed a ton of photographers, and there is no way that they would be able to get photographers to sign over that kind of authority to the company.

That said, I was there for almost 27 years, and a lot could change, in that time.

By the time I left, their HR was starting to get downright rapacious, so newer employees might have had to sign over those kinds of rights.

Re:Bossware is a big legal risk by saagarjha on Friday May 17, 2024 @01:59AM (#40386842)
Yeah, fair enough. Employment contracts have gotten a lot worse over the years as lawyers figured out what they could get away with.
Re:Bossware is a big legal risk by 98codes on Wednesday May 15, 2024 @05:09PM (#40372375)
You have to assume that it does.
Re:Bossware is a big legal risk by Etheryte on Wednesday May 15, 2024 @05:05PM (#40372339)
Either root the device or mitm yourself, not much outside of that that you can do to ensure nothing fishy is going on.
Re:Bossware is a big legal risk by paxys on Wednesday May 15, 2024 @05:42PM (#40372752)
Assume it does. Don't do any personal work on it. Isolate it from your home network.
Re:Bossware is a big legal risk by toss1 on Wednesday May 15, 2024 @05:29PM (#40372607)
As many others said, assume that it does, by default.

Do you have admin rights, including to the firmware? Can you, and did you setup from scratch the device that you received from the from the employer? If not, then it is almost 100% there is surveillance. If they let you do all the setup, then maybe 50%.

Just isolate any box your employer touches, both physically and in the network sense, separate visible and sound space as possible, separate WiFi network, etc..

Re:Bossware is a big legal risk by halfcat on Wednesday May 15, 2024 @05:33PM (#40372657)
Generally you won’t, but some vendors documentation lists folder paths you can check, like if this folder exists in your computer it’s running Teramind [1]:

C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}

[1] https://kb.teramind.co/en/articles/8791095-how-to-verify-if-...

Re:Bossware is a big legal risk by bitwize on Wednesday May 15, 2024 @04:59PM (#40372284)
That's the neat thing -- you don't.
Re:Bossware is a big legal risk by woleium on Wednesday May 15, 2024 @05:05PM (#40372337)
Just assume it does
Re:Bossware is a big legal risk by davely on Wednesday May 15, 2024 @05:35PM (#40372683)
No kidding!

We have some ridiculous timeout on our work machines that triggers the screensaver after 2 minutes of idle time (we can’t change this).

After it’s triggered, you need to enter your password to unlock (company mandated, 10 chars minimum, no repeating chars, at least 1 upper and 1 lower case char, at least 1 special symbol, change every 90 days, can't be too similar to last 10(!) passwords).

Okay, this is annoying. So, for the longest time, I used an open source mouse jiggler app (basically simulated cursor movement).

This worked fine until a recent software update. I wondered why my screen saver was being triggered again. Oh, the mouse jiggler isn’t running! Let’s open it up.

A big dialog box appears on the screen: “THIS APPLICATION VIOLATES COMPANY POLICY AND ITS USAGE HAS BEEN REPORTED.”

Oh… cool.

I went on Amazon and ordered some $5 hardware mouse jiggler dongle. That worked for about a month or so.

Then suddenly, I started getting CrowdStrike notifications: “Functions of a USB device were restricted according to company policy.”

Fun times!

It’s only a matter of time until Zoom starts sending reports of whether I had the window in focus or not during meetings with management.

Re:Bossware is a big legal risk by bitwize on Wednesday May 15, 2024 @08:19PM (#40373911)
Slack sets your status to "away" after 30 min of inactivity. You cannot disable this.
Re:Bossware is a big legal risk by ohthatsnotright on Thursday May 16, 2024 @12:24PM (#40380200)
I set my Slack status to offline permanently, never allow it to show my presence. It's great.
Re:Bossware is a big legal risk by mattmerr on Wednesday May 15, 2024 @05:47PM (#40372812)
Does watching a video pause the timeout? If so, hypothetically one could stream or locally create a video with no contents but long duration.
Re:Bossware is a big legal risk by davely on Wednesday May 15, 2024 @05:55PM (#40372890)
Ah, that's an interesting point. I haven't tried to correlate that, but it must be true. For example, the screensaver never seems to appear during Zoom calls!
Re:Bossware is a big legal risk by Izkata on Wednesday May 15, 2024 @06:14PM (#40373057)
That might also be implemented as "don't start the screensaver if the camera is in use". Easy to detect in either /proc/ or /sys/, I forget which one I was fiddling with.
Re:Bossware is a big legal risk by hunter2_ on Wednesday May 15, 2024 @06:25PM (#40373166)
Nah, I know people who use Zoom for this purpose without the camera enabled. It's just Zoom invoking the OS's wake lock.
Re:Bossware is a big legal risk by kridsdale1 on Wednesday May 15, 2024 @05:45PM (#40372779)
You can get mechanical mouse mover devices that are not connected to the pc at all. It should be fully undetectable.
Re:Bossware is a big legal risk by davely on Wednesday May 15, 2024 @05:54PM (#40372884)
Ah, that's a good point. I've thought about this, but I use a trackball due to mild RSI. So, I don't think it can help me there.

(This is going to make me embark on a weekend project to use an Arduino, some servos and a 3D printed finger to move my trackball.)

Re:Bossware is a big legal risk by eequah9L on Wednesday May 15, 2024 @06:14PM (#40373055)
Plug in a second mouse then?

The trick that I heard is to just place the mouse on a clock. The second hand jiggles the mouse every minute. Can be stashed away in a drawer or something. Never tried this though.

Re:Bossware is a big legal risk by kyleee on Wednesday May 15, 2024 @06:02PM (#40372956)
I found nosleep.page a while back here, wonder if it would work for you?
Re:Bossware is a big legal risk by hunter2_ on Wednesday May 15, 2024 @06:30PM (#40373199)
If you're on a work VPN, presumably you wouldn't want this in the DNS logs. Best to make a local clone! Simply "Save" from the browser, assuming the whole trick is within a client-side script that doesn't phone home, which appears to be the case.
Re:Bossware is a big legal risk by GauntletWizard on Wednesday May 15, 2024 @05:48PM (#40372823)
You are the user I fear most; clever enough the be dangerous and aware of the bullshit.

If you were really smart you would lobby your IT department to change the ridiculously short timeout, and protest by not working when it locks on you during normal pauses.

Re:Bossware is a big legal risk by brokenmachine on Wednesday May 15, 2024 @07:50PM (#40373731)
The dangerous ones are these misguided IT departments.

I bet they also have many other great ideas and processes that are strangling efficiency and preventing innovation.

Of course it's a balance, but think of the wasted productivity from a 2 minute timeout with stupid password requirements like that. That incurs a cost.

Re:Bossware is a big legal risk by davely on Wednesday May 15, 2024 @06:05PM (#40372973)
Hah. I'd like to think there's nothing to fear from me as a user.

Look, I get why some of these policies are in place -- a bunch of it stems from locking down our systems and protecting critical data due to various Sarbanes-Oxley requirements. Plus, sometimes smart people do dumb things, and it leads to bad things (e.g, see the LinkedIn incident) [1].

But man, oh man, is it annoying! Especially if I'm in my own home, with no one around, and I otherwise get my work done.

[1] https://darknetdiaries.com/transcript/86/

Re:Bossware is a big legal risk by GauntletWizard on Wednesday May 15, 2024 @07:05PM (#40373440)
I thoroughly agree - Two minutes is an insane timeout, and exactly the kind of security stupidity that makes users like yourself build ways to circumvent it, making it worse than useless because now you're plugging in sketchy dongles into your corporate PC.
Re:Bossware is a big legal risk by rsynnott on Thursday May 16, 2024 @04:59AM (#40376420)
This... sounds like their security is doing their job, tbh? Like, yes, if you have access to sensitive data your computer _should_ lock when you are away from it, and you shouldn't be able to circumvent this.

I am, generally, very sceptical of corporate surveillance stuff, and think that it should be largely banned. But this particular case isn't surveillance, it's security.

Re:Bossware is a big legal risk by tbyehl on Thursday May 16, 2024 @07:41AM (#40377157)
Knowledge that my employer might detect or block a software or USB mouse jiggler is why I ended up making a BLE mouse jiggler out of a Pico W.
Re:Bossware is a big legal risk by whoitwas on Thursday May 16, 2024 @07:45AM (#40377186)
I alias a script to run caffeinate. They aren't going to mess with your terminal processes.

https://ss64.com/mac/caffeinate.html

Re:Bossware is a big legal risk by saagarjha on Thursday May 16, 2024 @09:40AM (#40378343)
pkill -9 caffeinate seems pretty reasonable for them to start doing
Re:Bossware is a big legal risk by Etheryte on Thursday May 16, 2024 @10:20AM (#40378824)
I mean, you can just make a copy and name it whatever? You can even have it generate a new name every time you run it if you'd like. Imo this is a rather pointless cat and mouse game with developers, because either they can't do their work properly or there will be ways to work around stuff like this.
Re:Bossware is a big legal risk by saagarjha on Friday May 17, 2024 @01:58AM (#40386830)
I mean it was pointless way before that, but yes
Re:Bossware is a big legal risk by ang_cire on Thursday May 16, 2024 @12:03PM (#40379966)
If you're on MacOS or Windows, start a WebEx or zoom call; the timeout for screen locks is reset while a meeting is running. Also, it means that your boss sees "in a meeting" if they look at your status, which makes you look busy, which bosses think means productive.
Re:Bossware is a big legal risk by woleium on Saturday May 18, 2024 @10:18AM (#40399278)
i solved this by putting an optical mouse on a 12 inch wall clock (laid flat under my desk). the second hand moves the mouse a little bit once a minute.
Re:Bossware is a big legal risk by SpaceNugget on Thursday May 16, 2024 @05:11AM (#40376472)
There's a (_relatively_ benign) bossware-like software on my work provided laptop. It forces updates of browsers and common software like the company VPN. When it updates and restarts my browser, it helpfully mentions that if the browser itself was unable to restore my tabs, I can always ask IT to look up what tabs I had open before the update. Maybe ask your IT services if they can help you remember what you had open a few days ago.
Re:Bossware is a big legal risk by EE84M3i on Thursday May 16, 2024 @09:03AM (#40377866)
Make friends with the folks in the enterprise security team and ask them about their kitting process.
Re:Bossware is a big legal risk by rockooooo on Thursday May 16, 2024 @10:45AM (#40379096)
If your company is even halfway legitimate they will have what they collect / monitor in your employee handbook or a privacy policy somewhere.