Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

bloomberg.com

Post reply on HN
Print view View original

251–260 of 364 posts

Re: Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

#251

Post by thr0waway1239 »

GooglyMoogly wrote: post #223
bitL wrote: post #112

This is going to be interesting to watch. Alphabet just: - went nuclear on Uber/Otto - revealed what they track internally to all their employees

When your company stores very private info on billions of people, and is actively attacked (sometimes successfully) by the top intelligence agencies of the world[1][2], you have to be extremely careful, and monitor everything. [1] https://en.wikipedia.org/wiki/Operation_Aurora [2] https://www.newyorker.com/news/amy-davidson/tech-companies-s...

Some people might see an irony in your comment.

Economist Joseph Stiglitz wrote in 2009 "...banks that are too big to fail are too big to exist..."

My theory is that the too big to exist theory is now true for basically all the tech giants. Generally, everyone who knows the kind of tracking these companies do (internal and external) agree this is true, except those who benefit from the companies' continued existence e.g. employees, investors, shareholders.

Re: Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

#252

Post by jlgaddis »

mahyarm wrote: post #107
aidos wrote: post #61

Earlier quoted context omitted.

Yeah, they definitely have some really specific accusations about what went on: >>> To gain access to Waymo’s design server, Mr. Levandowski searched for and installed specialized software onto his company-issued laptop. Once inside, he downloaded 9.7 GB of Waymo’s highly confidential files and trade secrets, including blueprints, design files and testing documentation. Then he connected an external drive to the lapt…

My guess is he still had a network connection up when he did the copy. These kind of things like JAMF, osquery and so on upload what you do on your computer on a fairly frequent basis. After a certain company size all of them do something like this, and most of them do not spell out the amount of spying they do on their employee's work devices and office space. Or he didn't do a secure wipe when he reformatted the dr…

Or, you know, syslog.

Re: Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

#253

Post by brazzledazzle »

mahyarm wrote: post #107
aidos wrote: post #61

Earlier quoted context omitted.

Yeah, they definitely have some really specific accusations about what went on: >>> To gain access to Waymo’s design server, Mr. Levandowski searched for and installed specialized software onto his company-issued laptop. Once inside, he downloaded 9.7 GB of Waymo’s highly confidential files and trade secrets, including blueprints, design files and testing documentation. Then he connected an external drive to the lapt…

My guess is he still had a network connection up when he did the copy. These kind of things like JAMF, osquery and so on upload what you do on your computer on a fairly frequent basis. After a certain company size all of them do something like this, and most of them do not spell out the amount of spying they do on their employee's work devices and office space. Or he didn't do a secure wipe when he reformatted the dr…

Unless it's changed since the last time I played with it osquery doesn't upload anything on its own–it's just a local tool/agent that you can use to gather data. Carbon black is a good example of something like that.

JAMF I believe gathers application usage data but nothing as in depth as what's being discussed. It's also comically handicapped. It somehow manages to do a poor job of everything it tries to do so "the world's largest online Mac administrator community" is forum post after forum post of half understood franken-scripts. I used to think it was milquetoast but after sitting through their sales reps crapping all over open source software (despite extensive use of OSS libs in their products) and seeing it fail to do the most basic stuff out of the box my opinion is that it's over priced crap.

Re: Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

#254

Post by manmal »

__jal wrote: post #169
taneq wrote: post #73

Earlier quoted context omitted.

And this "over 14,000 highly confidential and proprietary design files for Waymo’s various hardware systems" is what, an engineering repo? (Edit: My money's on repo. It says 'searched for and installed specialized software', I'm translating that as 'installed git.') Or did he just take a copy of his mailbox? Sounds like a rookie move to be downloading this stuff on his work laptop either way.

I think you're conceptually close, but wrong. My money's on something like this: https://techdocs.altium.com/display/DMAN/Design+Data+Managem... Edit: much better link than the above: http://www.altium.com/documentation/3.0/display/VAULT/Altium...

Yes. They would not use Git for huge binary documents if they were in their right mind.

Re: Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

#255

Post by return0 »

chollida1 wrote: post #4

From another source to provide some colour: > According to a lawsuit filed today in federal court in California, Waymo accuses Anthony Levandowski, an engineer who left Google to found Otto and now serves as a top ranking Uber executive, stole 14,000 highly confidential documents from Google before departing to start his own company. Among the documents were schematics of a circuit board and details about radar and L…

He could have wiped it with a cloth or something. It's kind of scary how they could figure out what he did after the wipe.

Re: Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

#256

Post by brazzledazzle »

danielweber wrote: post #168
sbierwagen wrote: post #152

Earlier quoted context omitted.

Why didn't you just shut it off first? You had FDE turned on, right?

https://github.com/GDSSecurity/EvilAbigail#scenario

That's pretty cool but won't do much against macOS.

Re: Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

#258

Post by kuschku »

Jabbles wrote: post #83
taneq wrote: post #73

Earlier quoted context omitted.

And this "over 14,000 highly confidential and proprietary design files for Waymo’s various hardware systems" is what, an engineering repo? (Edit: My money's on repo. It says 'searched for and installed specialized software', I'm translating that as 'installed git.') Or did he just take a copy of his mailbox? Sounds like a rookie move to be downloading this stuff on his work laptop either way.

Stealing is a rookie move. But I don't think there was a choice about using his work laptop. You can't connect an arbitrary device to Google's network. https://research.google.com/pubs/pub43231.html

That's... an impossible task. All ways to identify a machine in a network are dependent on the machine itself — if properly configured, I can create a machine that can not be told different from another machine.

Just extract the device certificate from one device and store it on another. Problem solved.

Extracting data from the TPM or equivalent stores in ARM devices is also not impossible, as the DRM-breaking community has shown with extracting keys from TPM-based DRM.

Re: Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

#259

Post by blackguardx »

manmal wrote: post #254
__jal wrote: post #169

Earlier quoted context omitted.

I think you're conceptually close, but wrong. My money's on something like this: https://techdocs.altium.com/display/DMAN/Design+Data+Managem... Edit: much better link than the above: http://www.altium.com/documentation/3.0/display/VAULT/Altium...

Yes. They would not use Git for huge binary documents if they were in their right mind.

Altium Vault uses SVN for version control (or at least did the last time I used it).

Is that better than git for binaries?

Re: Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets

#260

Post by bmon »

kuschku wrote: post #258
Jabbles wrote: post #83

Earlier quoted context omitted.

Stealing is a rookie move. But I don't think there was a choice about using his work laptop. You can't connect an arbitrary device to Google's network. https://research.google.com/pubs/pub43231.html

That's... an impossible task. All ways to identify a machine in a network are dependent on the machine itself — if properly configured, I can create a machine that can not be told different from another machine. Just extract the device certificate from one device and store it on another. Problem solved. Extracting data from the TPM or equivalent stores in ARM devices is also not impossible, as the DRM-breaking commun…

How about a whitelist of hardware fingerprints, similar to what Microsoft does with Windows installations. Also, Google is known to have custom manufactured hardware, specifically with security in mind. I don't think the idea that Google is able to secure their own network against foreign devices is really that far-fetched.
Post reply on HN