Slashdot Mirror
Mac Thief Caught Thanks To Applescript & Timbuktu
el.cerrito.slasher sent in an amusing bit found on MacSlash. This story
is a tale of a stolen iMac that just happened to be running Timbuktu (a remote
control program like VNC I believe). Well the stolen box kept getting
used, and the owner was able to track it down through
a variety of amusing Timbuktu Fu. Funny story.
For those of you who got a real kick out of this thing, you may want to read Cuckoo's Egg. Cuckoo's Egg is a little older (he talks about using the teletype), and follows a real life story of an admin who went and tracked a bad hacker (or thief? -- sorry it's been a while). It has the same sort of "you out-think me, i'll out-think you!" back and forth flavour to it. Give it a read, you won't be disappointed.
I had flashbacks to reading "The Cuckoo's Egg" while reading this transcription. Does anyone else remember reading the commands listed in the book and quickly running over to a unix box to play?
Honestly, I'm not -too- surprised that this happened. My machine runs:
/bin/date | mail
/sbin/ifconfig -a | mail
(Running dyndns would be interesting also.)
on bootup. I originally did this so that I could keep track of my box and identify when it went down and what the current IP was so I could ssh in and look around more comprehensively, although it has crossed my mind that if my machine were to get stolen it might report back to me where it was. I'd happy to see that it's worked out at least once for someone.
Most ISPS keep logs of usernames and passwords on certain ips (especially if they're static/near static as in a cable modem or dsl connection). From there, it's fairly easy for the ISP for connect that back to a real name.
I'd be very intrested to see if this is enough information to get a search warrent.
-- Mike wildcard@illuminatus.org
The article doesn't say the thief was caught. To quote the guy himself: "So the conclusion to the story is: iMac and Lexmark printer recovered, one female pled out to possession of stolen property and got a year's probation.".
Possession of stolen property is very different to theft. She claims to have bought the imac from "some guy". Ok, she might be complicit, but we won't ever know.
ooooooh! What does this button do? - DeeDee, Dexters Lab.
"Computer, update website" (computer executes the 'update website' applescript, which would probably be very similar to the parent post's Applescript"
Since Applescript is easy, powerful, and voice-activated like this, you can do some amazing stuff on the mac with very little effort. It impresses the hell out of other people, too.
(FWIW, the PC emulator VirtualPC is Applescriptable - you can have a LOT of fun with that: imagine the above Applescript, but add the part where the script fires up VirtualPC and loads your webpage in IE for Windows to make sure it looks good on that platform too. All this while you're playing Oni)
What I did on my Windows machine to record the IP address was use a *very* simple set of tools. .bat file, which runs and ends very quickly at startup: .sys file to my hotmail account. And it does so periodically.
.p.
1. I wrote a one-line
ipconfig > c:\windows\system32\ip_ADDR_resolv.sys
to make it look like a system file. All it is really is an output of my local IP address.
2. I used the free StealthMailer program at: http://www.amecisco.com/stealthmail.htm to mail my
3. For added cool, you can use low-level key-logging software and mail out everything that use types and mail it to yourself. Cost is about $79/license.
You can't beat that for peace of mind.
Actually you can most likely do that on a Mac. All of the Macs in the past 5 - 8 years use a BIOS-like system called called Open Firmware. Open Firmware basically sets up the machine to load up the operating system and it does other initialization tasks. It is also used by some other computer manufacturers as it is an open standard.
The neat thing about Open Firmware is that it is programmable. It is written in Forth and you can write additions to it and install them. These additions are persistent across power-downs and can be password protected. So it is possible that you can write some sort of network notification into Open Firmware, I do know that it is aware of TCP and such because you can remotely operate the machine if it crashes in open firmware and you can also use Open Firmware to network boot the machine.
The other cool thing about Open Firmware is that you can set it to require a password at boot. If the password is not entered then the machine will not load ANY drive. This password is much harder to disable than an operating system password or hard drive password lock, although there are a few obscure and involved ways of bypassing it if you are extremely familiar with the system.
This page has some good links on Open Firmware. This site is hosted by Sun and has a ton of very specific and detailed information on Open Firmware. And lastly, Open Firmware is the only firmware standard in existence to have its own song!
Sapere aude!
" ... Probably not admissible in court, I guess. Although using a stolen device for surveillance really *should* be a legal means of admissible evidence, in a perfect world :-) ..."
I'm not so sure it wouldn't be admissable in court. Unauthorized taps are illegal in some, but not all jurisdictions. Also, illegaly obtained evidence is admissible under some conditions; in particular when the illegal evidence is obtained by someone who is NOT a police officer, etc.
Finally, consider this: if you use the phone or use the bathroom, this is an illegal tap. Phones are not recorders and bathrooms are not cameras, there is an expectation of privacy. But a computer can be and is an audio and video recording device, as well as a network data collector. Many computers have built-in microphones and network devices; no reasonable person should assume they don't work. In other words, there is no expectation of privacy; especially if the lawful owner has configured it to act as a remote device.
I'm sure the laywers will eventually hash this out, but I can assure you the evidence would be admissible in my jursdiction; legal or not, because I am not a cop.
Some people have suggested a "real" thief would just erase the HD and start over. And, some might.
But most thieves are dumb, or at least cheap; do you think they are going to erase PhotoShop, etc and go out and buy a copy, and then do that 20 or 50 more times? It isn't much use without apps.
If you don't leave your SW about in an obvious place, they won't have an OS install CD (to boot an iMac or any Mac made since about 1996. A boot floppy is useless; most won't boot with System 7.1, which did fit on a floppy. And if your floppy collection is anything like most people's, there won't be a decent label on it anyway. x86 is, of course, different; boot floppies are pretty easy to come by and they work).
Auto-dial 911 is A Bad Idea; they have enough trouble with users who can't figure out why the cellphone called 911 from a football game cuz the guy sat on it and it auto-dialed with "quick 911" enabled.
A periodic eMail to your own account sounds good; there is plenty of evidence there and, properly done, it doesn't compromise your own security (or risk your own life w/electric keyboards... YIKES! -I don't trust any computer that far).