4

Myself and the rest of my coworkers on my (former) employer’s dev team were all just laid off from our jobs, and the employer took our MacBook Pros without letting us clear of our personal information or log out from web services.

Now, I’ve covered the bases the best I can by changing those web passwords, and I was smart enough to use a unique password for logging into this machine and used 2FA on all sites that supported it.

I know that I’m screwed when it comes to the files that were stored on my computer; I lost months of work on personal projects. (To be fair, I shouldn’t have been using it for personal things… but alas, this is the situation I currently find myself in. Live and learn.)

Something that does bother me a lot is that my private signing key and Apple iOS dev certs were on the computer as well.

I’m just really paranoid that something bad is going to come from this. I’ve never let anything like this happen before, but this caught me and my coworkers by surprise; we didn’t have any time to back up or wipe anything. They called us into to a different room, told us the bad news, and unceremoniously escorted us out without letting us go back to our computers.

What steps can and should I take from here on out to help prevent further damage from this?

TL;DR: Laid off, wasn’t able to clear personal data, remove private keys, or log out of websites. What can I do at this point to at least minimize Bad Things™?

  • 2
    Contact Apple and have them revoke your old certificate, and request they issue you a new one. – John Deters Feb 12 at 18:58
  • Just log in at developer.apple.com, and invalidate your signing certificates. But first change your AppleID password in case your old computer remembers it. – gnasher729 Feb 12 at 19:36
4

Welcome to Information Security!

Sorry to hear about the surprise layoff. That's quite unfortunate. From what I can tell you already took great security steps to change your passwords for your accounts and you enabled 2FA before this happened. Some other steps you can take is to revoke your Apple certs and privates keys and generate new ones. This will prevent anyone else from using the old one. It may be troublesome depending on what apps are currently using this cert but I don't see what else you can do here accept take the hit and do the extra work to change the certificate.

Also, a lot of sites now have the ability for you to see your "active sessions" from your account. You can see where you are logged into your account and can end those sessions. Facebook, apple, google does this and I think...Dropbox, Onedrive and Box do this too. These settings should be under any Security/Privacy settings.

Depending on what type of information you lost I would also suggest you get yourself some sort of identity theft + credit monitoring solution so you can keep track of any suspicious activity. Nowadays most will monitor changes on your credit and provide Dark Web monitoring so you will be alerted when your information is being sold on the internet somewhere. Some good ones are USAA(if you have a military family member), Complete ID (if you have a Costco membership), LifeLock...for anyone. Do some research, there a lot of good companies out there to help you monitor your private information. The cost is well worth the peace of mind.

Last suggestion I can think of is to Freeze your Credit. Since the Equifax breach Congress passed a law last September to make is easier for customers to freeze and unfreeze your credit. Why freeze your credit?....To prevent anyone else pretending to be you from taking out loans in your name. By law the bureaus have to unfreeze your credit within 1 hour of your request and freezing and unfreezing are now free; before they charged you.

It's impossible to be 100% risk free with your information, the best thing you can do is try and mitigate the risks as much as possible. I hope some of these suggestions help you.

April

  • 3
    Considering identity theft a threat here seems like overkill to me. Most employers already have enough information to do that anyway, and generally you just trust them not to. "Dark web monitoring" is mostly marketing BS, nice blog post about it here. – AndrolGenhald Feb 12 at 19:11
  • Thanks Androl. I am checking out the blog post. – April Parker Feb 12 at 19:17
  • Also, welcome to Information Security SE! – AndrolGenhald Feb 12 at 19:28
  • They are doing this to protect their intellectual property and company secrets stored on your work computer: it would put them at risk to let you leave with the data. Some become aggressive after hearing their job discontinues. We can only hope that they have equally secure practices for employee privacy, but selling former employee data to dark web is quite a long shot. – Esa Jokinen Feb 12 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.