Laptop Thief Caught via AOL Login

Mundocani writes "Yahoo (Reuters) is reporting that the FBI has caught the guy who stole computers from Wells Fargo. The interesting part is that 'Investigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers.' Makes you wonder what sort of hooks the FBI has into AOL or other ISPs and what hardware identification is being transmitted at login."

Comments

Mac address perhaps ?

[Anonymous Coward]

Mac address perhaps ?

Re:Mac address perhaps ?

[Anonymous Coward]

Maybe that intel CPU serial number.

Re:Mac address perhaps ?

[kjba]

Couldn't it just be the case that the internet browser's homepage was still set to an address on Wells Fargo's intranet? The wrong http request would be easy to find.

Re:Mac address perhaps ?

[Anonymous Coward]

'cept AOL's integrated IE doens't share settings with normal IE, so that'd mean that Fargo'd have to have been using AOL to access their intranet pages. Seems unlikely.

Re:Mac address perhaps ?

[Jugalator]

Maybe that intel CPU serial number.

Does the Pentium III processor broadcast its serial number when it is enabled and a user is connected to the Internet?

- No. The processor serial number is passive. Thus, it does not transmit or broadcast itself. If a person chooses to enable the feature, then, when visiting a website that can utilize processor serial numbers, the website needs to send software to the PC to read the processor serial number.

Re:Mac address perhaps ?

[Jugalator]

... oh, and even in a case where the P3 processor would send its serial number upon login, this only applies to P3 processors. From intel.com:

Only the Pentium(R) III Xeon(TM), Mobile Pentium(R) III and Pentium III processors support the processor serial number feature introduced by the Pentium(R) III processor. No other Intel(R) processor supports the processor serial number feature.

Re:Mac address perhaps ?

[einhverfr]

Mac address perhaps ?

For those of you who don't know, mac addresses are only valid on the same network segment, which means that the router would drop them, and so it can't be that (unless the login program sends that info). More likely it si something like the intel cpu id, etc.

Re:Mac address perhaps ?

[Megor1]

Windows netbios will share your mac address on the net, simply use nbtstat -a ipaddress On any unfirewalled Windows system. (And then "net send ipaddress get a firewall!")

Re:Mac address perhaps ?

[Anonymous Coward]

You can spoof the MAC address on most network cards.

Re:Mac address perhaps ?

[Anonymous Coward]

yah, like DEAD:BEEF:BABE wouldn't narrow it down.

Re:Mac address perhaps ?

[Anonymous Coward]

Right! And what do you know, there is a good chance that the router is AOL's router... after all, AOL is primarily dialup, and most dialup user's, in my humble estimation, do NOT use a "home" router.

Re:Mac address perhaps ?

[penguinstorm]

Yeah, but why did they care about this case?

There was a story a while ago here:
http://macscripter.net/unscripted/unscripte d.php?i d=12_0_1_0_C

which basically netted very little response, although the guy did get the computer back eventually.

So would the FBI have cared if it had been your laptop?

Re:Mac address perhaps ?

[Anonymous Coward]

why don't just ask AOL?

Re:Mac address perhaps ?

[pyite]

It certainly can be that. If AOL is anything like where I work, they can search for a MAC address at any access layer device and see when it came on, what IP it used, etc.

Re:Mac address perhaps ?

[Epistax]

On a windows box you can change the MAC address by creating a network bridge and adding your network connection to it. On a linux box you probably just have to edit a file called something like
MAC Address DO NOT CHANGE.conf
And then they put it as read only hoping no one learns how to use chmod.

Re:Mac address perhaps ?

[hazem]

If they have AOL, maybe they only have a modem therefore no NIC and no MAC address.

It WOULD be interesting to see what was actually sent and identified wit this laptop.

Maybe when AOL installes, a uniqe ID is assigned to the device. Wells Fargo reports that laptop (and the the name of the person who would normally log in with it) to AOL, who then can watch for the computer to log in. Once it logs in with someone else's ID, they can then look up that ID's financial information, which probably has an address attached to it. They would also have the Caller-ID info for the dial-in line.

Was the Wells Fargo employee using AOL already? Or did the theif install it after the fact?

Maybe Wells Fargo should consider keeping senstive customer information on a central file server so that laptops don't end up with that data on them when they are stolen.

Re:Mac address perhaps ?

[frehe]

Read ifconfig(8) to see how you can do it under Linux. Google for "sea.c" to see how you can do it under OpenBSD.

Re:Mac address perhaps ?

[nyseal]

Oh, and we all believe Intel all of a sudden?

Re:Mac address perhaps ?

[Anonymous Coward]

On a linux box you probably just have to edit a file called something like MAC Address DO NOT CHANGE.conf

That's a bit uninformed.

ifconfig eth0 ifconfig eth0 hw ether 00:12:34:56:78:90

Re:Mac address perhaps ?

[ahaning]

Was that a mistake?

It looks like you pasted in some URL other than the one you intended. The one you posted was fairly interesting, though.

Re:Mac address perhaps ?

[inode_buddha]

I'm reading this thread for the Windows/AOL info, since I use Linux and need more clues about Windows.

That said, the 2.6.x Linux kernels have the ability to mangle and spoof MAC addys, in addition to NAT/MASQ and building firewalls based on MAC. This is in addition to all the iptables godness.

My firewall uses iptables *and* echoes the desired behavior into kernel-space by setting the desired values in /proc with a script at bootup. For ex:

## Disable accepting IP source routing

for f in /proc/sys/net/ipv4/conf/all/accept_source_route; do

echo 0 > $f

done

As far as the chmod goes, one could also use chattr to set the "immutable" bit e.g. "chattr +i foo.bar". Its more potent than chmod since not even root can touch an immutable file; you have to become root and remove the immutable bit first.

Re:Mac address perhaps ?

[llzackll]

It does not transmit, but doesn't mean AOL software can't query it and transmit it..

Re:Mac address perhaps ?

[ZeroZen]

Also, most newer network card have the option right in the network card's settings. You can choose "network address" and fill in a field. In window that is!

Re:Mac address perhaps ?

[SYFer]

He seems to have made a complete dog nappy of himself. Perhaps now he'll lop himself chunky through a waste disposal. Heh.

Mad dogs and Englishmen and all that.

Re:Mac address perhaps ?

[Joe Decker]

Yeah, but why did they care about this case?

They cared because the computer involved had enough information to carry out identity theft on many, many folks, they were probably investigating this as a potential large-scale identity theft case, not just a computer theft.

They say the number of folks involved was "a small percentage ... of Wells Fargo's 22 million customers." One percent would be 220,000 people. I don't know if it was even one percent, but I do know someone (not myself) who got a letter from Wells Fargo about the incident, I thin this was a very big loss of private data.

Re:Mac address perhaps ?

[Anonymous Coward]

This is incorrect. The feature was present in the Pentium II too, just it was kept quiet.

Re:Mac address perhaps ?

[bev_tech_rob]

There are some software companies out there that sell software that will notify the rightful owners when a stolen computer is connected to the net by the person who stole it. Kinda like a software LoJack. Can't remember the name, though....

Re:Mac address perhaps ?

[Anonymous Coward]

Even if you don't have a Pentium(R) III processor , your system BIOS most likely has an "asset number" which can be sent out over the net with certain 3rd party asset management software.

Re:Mac address perhaps ?

[Anonymous Coward]

Bzzt. Wrong. Shut up if you have no fricking Clue. All the MCSE nerbots on slashdot should stop supposing and make way for the few nerds that actually have a clue about networking and protocols and what not.

Slashdot nerds are continually, depressingly clueless about real networking esp once it hits a router.

Asshats

Re:Mac address perhaps ?

[babazaroni]

The thief logged into the owner's AOL account, not his own. http://www.sfgate.com/cgi-bin/article.cgi?file=/ch ronicle/archive/2003/11/27/MNGUO3BN101.DTL

Re:Mac address perhaps ?

[Anonymous Coward]

It's easy enough to sniff the network traffic in/out of your computer. Why would Intel risk being caught in a lie? Do they have a history of this? Most conspiracy theories are far too easy to conjure up, and way too hard to prove.

Re:Mac address perhaps ?

[Anonymous Coward]

_Laptop_

how many laptops do you know about that do not have builtin ehternet these days?

just because he connected over the modem does not mean that the AOL client could not look up and report the MAC address.

Is there anyone who has AOL that can verify if the client sends the MAC address????

Re:Mac address perhaps ?

[bhtooefr]

The Celerons and Mobile Celerons built on the Pentium III don't count?

Re:Mac address perhaps ?

[pmonje]

OK, this is wildly off-topic, but in the first image from the posted link, doesn't the woman on the left look amazingly like Michael Jackson in his arrest photo? I just think that her facial expression is hilarious, what has she been up to with young boys? Sorry, I now return you to your regularly scheduled program.

Re:Mac address perhaps ?

[Anonymous Coward]

So let's say that your computer is stolen, and you know its MAC address.

To recover your computer, you'll need the cooperation of some big ISPs, plus you'll need the ISP of the owner of your computer's new IP address to tell you who they are.

It looks to me like unless you're a bank, you can kiss your stolen computer goodbye whether it turns up on the net again or not.

Re:Mac address perhaps ?

[Crazy Eight]

My ifconfig man page doesn't mention MAC addresses at all.

Re:Mac address perhaps ?

[Eminor]

Some laptops have a tracking system built into the BIOS which will call home once connected to the internet.

Re:Mac address perhaps ?

[Anonymous Coward]

AOL has a tool called sysinfo, if you look into it you may be surprised what info AOL is capable of culling.

Re:Mac address perhaps ?

[ratsnapple tea]

There's a sign in my dorm's lobby for PC PhoneHome (MacPhoneHome), which is supposed to do what you describe.

Re:Mac address perhaps ?

[unitron]

As long as we're off-topic, have you noticed that in his effort to go from being black to being white Michael Jackson has gone from looking like Diana Ross to looking like Joan Crawford? Although I suppose that's preferable to looking like Broderick Crawford ("Whenever the laws of any state are broken...")

Re:Mac address perhaps ?

[einhverfr]

Um....

dialup (PPP) has no notion of MAC addresses. The network segment is restricted to two end-points so this is really irrelevent.

Re:Mac address perhaps ?

[OhioJoe]

The story stated it was the IP address. While the MAC address may have been the simplest form of tracking, it doesn't mean the FBI already had the MAC address of that machine in it's database. Wells Fargo could simply have a software program on all their laptops designed to always send out a notice when they are logged into the Internet. When they get a laptop stolen, they simply await that specific laptop's ID (yes, and perhaps that ID is the MAC address) to be received, and when it is, it alerts the Wels Fargo security division of the originating IP address. Wa-la, they then call the police, who obtain a search warrant for the house that is listed as the address of the user who is/was utilizing that IP address at the time it was logged in.

While it is possible that the FBI has a list of all known MAC addresses of all known users of the Internet, and thus simply tracked that MAC address with no help from Wells Fargo, it is not likely.

Re:Mac address perhaps ?

[reynols]

So would the FBI have cared if it had been your laptop?

No. They only cared about this case because it was stolen from a bank. Anytime there is any kind of crime against a bank, the FBI almost always gets involved, regardless of what kind of information was contained on the laptop. Not that stealing is a bright thing to do anyway, but stealing from a bank is espicially a not-bright-thing-to-do, because of the number of feds that are going to get involved in tracking you down.

Re:Mac address perhaps ?

[Jugalator]

Oh, and we all believe Intel all of a sudden?

*sigh*

After you've put on your tinfoil hat, it's easy enough to check yourself.

Trust no one!!11@

PC call home

[leerpm]

More than likely, the computers had some sort of software built into them to 'phone in' and notify a central location of its IP address. Then they just traced the IP address to his AOL account. Not very fancy detective work, just standard stuff.

Re:PC call home

[tgt]

Nah, more likely FBI already knew who they are going to arrest long before they start any sort of tracing. I'd say they had some info from street ears or whatever about some Kristof guy. Then all they had to do is to look up hist AOL nick, see if he's online and as he (unfortunately for him) was, traced his IP.

Re:PC call home

[Anonymous Coward]

An IPSec VPN configured in the laptop, very possibly. A lot of big companies use this kind of setup nowadays.

When the laptop starts the IKE protocol, it leaves a trace of where (in IP terms) it is.

Re:PC call home

[mental_telepathy]

Actually, I would say that is less than likely. I haven't heard of any company that installs software like that by default, even on laptops. And it would be much easier for AOL to check for a MAC address Wells Fargo provided.

Re:PC call home

[miu]

Nope, the slashdot blurb about him using his own aol account is wrong.

According to another source "He logged onto an (America Online) account that was registered on that computer and we traced it back to his phone number and address''.

It's the 4th item down on the page, under "Suspected thief arrested".

Re:PC call home

[weicco]

You are missing the point. If laptop had phone home - software, it could easily inform it's IP address to "home" when it detects that internet connection is available. After IP address has been received, one can easily trace what ISP computer is using. ISPs usually knows ARP address of computers (network interfaces actually) that are connected to their gateways because DHCP-servers are caching them. I don't have details about this but I'm pretty sure about that DHCP stuff.

So one doesn't have to know MAC address, just IP address and that's enough. And on the other hand tracing MAC address in internet is almost impossible so you need that IP address.

Re:PC call home

[THI]

Read the parent again, slowly. See where it says "software"?

Re:PC call home

[snake_dad]

The app would typically send some kind of unique ID to a server, which can then be used to find the machine's current ip adress. Then a quick look through the ISP's logs, and maybe a call to a telco, and voila, we have the address (if no anonymizing proxies or whatever are used). I think you owe leerpm an apology, and deserve a couple of "-1 flamebaits".

Re:PC call home

[boomer_rehfield]

1.laptop calls home 2.software sends the ip home 3.FBI are waiting and call AOL 4.AOL looks up logon of person that logged on with such and such ip... 5.Queue music from Cops You mac address is useless in this scenario as it can be changed and unless you're on the same subnet on as the thief.......

Re:PC call home

[Zocalo]

Actually, the kind of security software implied by the original poster does work on IPs since you can't track a MAC address back across the Internet. When you log in, the laptop transmits its current IP address back to the servers of the "phone home" application vendor along with an ID. If that ID is flagged as belonging to a stolen system, then that IP is used to identify the ISP, who will then be informed of the situation and will hopefully be able to identify which user was using that IP at the time. Tie that user back to a person and contact details through billing records and you can proceed to make an arrest.

Re:PC call home

[Anonymous Coward]

Doubt it. VPN uses open RDC (or in rare cases open RC) across the net interface, so the IP layer routing wouldn't have worked.

Re:PC call home

[jkrise]

Sincec the current ip address is ALWAYS going to be at variance with the original IP (assuming it was attached to a Corporate network - PHB) what's the big point in phoning home the IP?

If some kind of unique ID is getting transmitted, why at all log the IP? The IP would be useful to trace current location, not to pinpoint the current location of a stolen laptop.

Re:PC call home

[Ewan]

A lot of corporate laptops now have "dial-home" software installed, and if you don't login every x (normally about 14) days without getting authorisation in advance, then the company will consider the laptop stolen and lock out any accounts stored on it.

It operates much like spyware, and hides itself in the same way. This could be what happened here, and after the x number of days the system starts logging which IP address and time the computer logged in at and flags the information for further investigation. Once you have an IP address and a timestamp, it's relatively trivial for most ISPs to find out which user was online at that time.

Ewan

Re:PC call home

[pdbaby]

... IP address isn't fixed to the laptop - mac address is... Sensible stealers could just dump the network card and put a new one - or use a proxy over DSL.

The comment you're referring to said "software phoning home": i.e. nothing to do with the MAC address. It's easy for such software to operate- wait until there's a connection to the internet, send the company's Unique Id For Your Computer(tm) to The Man. If the computer's been reported as stolen, they now know the IP and can track that to an ISP and then an account and a user...

Re:PC call home

[jellomizer]

Though why AOL should be tracking mac addresses to user logins is beyond me.
Its called good administration. AOL is a large ISP if you didn't know. They have a lot of members and non-members trying to send Spam threw them, hack other computers threw them, and hack and Spam their own systems. So when someone puts out a complaint that so and so spam them threw AOL or was being tracked threw AOL and you show them proof then they can check the logs to see when they logged in and if they actually did that, at least coinciding with the login times and the times the incident occurred. I am pretty sure that they are also recording your telephone number that you used to call in as well. This is not a part of some Evil scheme or government plot. It is a way that a company the size of AOL uses to protect its butt. Because if they don't track this information and enforce it, (And yes some times they may need to call the police and some times the police asked them for some information) then they will be getting lawsuits left and right saying your servers attacked my computer, and AOL is not even showing good faith to remedy the situation. System Administration is sometimes public administration as well, especially when the public uses your systems.

Re:PC call home

[boomer_rehfield]

It's very easy to change MAC addresses.

Re:PC call home

[jkrise]

Exactly! So, the incriminating info is not the IP address, it's the unnique id. The parent post said IP address, and I corrected the error.

IP is reqd. after identifying, ,to pinpoint current location - the mods must be crazy!!

Re:PC call home

[Anonymous Coward]

The parent did not say any such thing, it said that the IP address would be used to track the location - stop trying to backpedal and take it like a man.

Re:PC call home

[jjshoe]

No offense, but the /. blurb is not nesecerily wrong. Two quotes about what happend, use your better judgement and pick one.

In short, the point of the story is, yet another stupid criminal gets caught.

Re:PC call home

[Fembot]

Yeah but the only mac address they'd get to see would be for the PPP adapter which im not 100% sure how they get assigned

I guess their custom login software could be sending it though... but thats kinda evil

Re:PC call home

[haunebu]

Why is a Wells Fargo laptop accessing AOL's network? Most corporations (and especially financial institutions I'd venture) require users to access corporate Intranets through a VPN and in turn access the Internet through their proxies. There's no way in hell that laptop should be connecting to the public Internet using an AOL account.

Re:PC call home

[SkArcher]

An IP has to be assigned, and one assumes the ISP either keep logs of dynamically assigned IPs or statically assign IP's to Cable lines (I know my last cable had a static IP). Therefore knowing the IP has at least some chance of determining the theifs location, or at least narrowing the search.

Re:PC call home

[Mattcelt]

There are several software packages including Ztrace and Absolute Software's Computrace which deal with the issue of laptop theft directly. It seems very likely that these computers were protected with one of these type of programs.

Re:PC call home

[miu]

One continuing problem that IT has is locking down computers. It is very common for employees to install their own software and dial connections on laptops.

I agree with you that a laptop with the sort of sensitive data that this one contained should never be connected directly to a public network - but such is the state of data security these days.

Re:PC call home

[Zocalo]

I kind of get the impression, that with this being a laptop and all, it would have been using a modem to connect. Last I heard a modem does not actually have a static MAC address in firmware like a network card. Since this is Slashdot, we might as well blame Microsoft for this confusion since they gernerate a MAC with the vendor ID of 44:45:53 to "internal adapters" such as modems.

Re:PC call home

[miu]

I should state exactly why I felt the Herald version is more credible.

The Yahoo statement:

Investigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers, White said.

and the Herald statement:

"He logged onto an (America Online) account that was registered on that computer and we traced it back to his phone number and address,'' White said.

I felt that the direct quote of Chief White was more credible, and less likely to be subject to an error of interpretation on the part of the reporter.

Re:PC call home

[snake_dad]

Companies server receives the unique ID. Sysadmin: "Hey, Fred just logged in, but his machine was stolen. WTF? Hmm.. what IP did his request come from? Aaaah.. 69.69.69.69. Let's do a lookup.. hey.. it seems to be an AOL modem-pool". Company goes to police, policy goes to judge, police show credible evidence that a crime was committed, judge gives warrant, AOL gives info (login account or the phonenumber that was dialed in from) on who was logged in at that time on that modem in that modempool. Police goes to address, takes laptop, returns it to Fred, jails crook. Fred: "1337!".

Re:PC call home

[leerpm]

No, you are still wrong. The MAC address is not used. The IP address is logged at the time the connection is made and is traced to the subscriber information (that DOES NOT mean it uses the MAC address, it could have been the username/password used for dialing in, it could have been a user/pass for PPP).

Re:PC call home

[Anonymous Coward]

MAC addresses never cross router borders they are used for routing traffic locally

Re:PC call home

[afidel]

The IP address can be backtracked to the leasing POP and from there to the RADIUS server and the access logs. From the access logs you get the idiots phone number and from there their home address. This of course assumes no phone spoofing.

Re:PC call home

[Anonymous Coward]

finally, someone who knows something...

Re:PC call home

[Stephen Samuel]

ISPs usually knows ARP address of computers (network interfaces actually) that are connected to their gateways because DHCP-servers are caching them. I don't have details about this but I'm pretty sure about that DHCP stuff.

Machines which dial in don't use ARP. ARP only applies to Ethernet

. Nontheless, I can easily see a machine with sensitive information wanting to report it's IP address to a central location whenever it connects. Cookies in the web browser might also help identify a stolen machine.

Using the default account and password stored on a machine seems stupid at first, until you consider that the guy had ID theft equipment... I don't use AOL, but I wouldn't be to surprised if you could fetch some ID-associated info by logging into the account of a stolen computer. In this case, the computer was of special interest, so the guy was picked up.

I wouldn't be surprised if more people could be caught by this same method, it's just that police aren't interested enough in following such tracks for 'normal' owners.

Re:PC call home

[RossyB]

And how does one get online to connect to the VPN? AOL is very popular as it has access points world wide, which means that if you give every travelling person an AOL account and a VPN login, they can get to the company network from anywhere in the world securely.

Re:PC call home

[mm0mm]

either way, why did the thief log on to AOL using the laptop he just stole? did he steal it to use AOL??? besides it's a laptop. he could've logged on NOT from his nifty home(built with Home Depot goods), but from elsewhere. is he Beavis or Butthead?

I guess this "38-year-old Home Depot clerk" wasn't aware of the data this laptop contained, and never understood seriousness of the crime until feds knocked on the door. had he known how serious it was, he shouldn't have made such a stupid mistake (and sold the laptop on ebay).

Re:PC call home

[Anonymous Coward]

What a dick. Just admit you were wrong, asshole.

Re:PC call home

[beacher]

Nah.. I have a copy of the evidence right here....

Subject: ME TOO
From: Krastof (Krastof@AOL.com)
Reply-To: Krastof@AOL.com
Newsgroups: comp.laptops.stolen
Date: Wed, 26 Nov 2003 09:18:22 -0500

Re:PC call home

[miu]

I guess this "38-year-old Home Depot clerk" wasn't aware of the data this laptop contained, and never understood seriousness of the crime until feds knocked on the door. had he known how serious it was, he shouldn't have made such a stupid mistake (and sold the laptop on ebay).

Who knows. Sounds like the guy was a small time con man and forger. Had he known what he had he might have tried to do something really stupid - like sell the info or attempt to blackmail the corporation he stole it from. Probably lucky for him he that he didn't know :)

Re:PC call home

[Dawn Falcon]

I'd expect that was true as well. Certainly I have a package like that installed on my PC's.

Re:PC call home

[Anonymous Coward]

Maybe it isn't that common... but I know that the company I worked for added such software to ALL their computers way back in 1998 or so. Laptops, desktops, whatever.

It may not be common, but it does exist.

Re:PC call home

[Anonymous Coward]

You're right - most corporations have their own VPN. But many now have outsoured dialup services... why have a bacnk of modems where there are 1000's of banks of modems that are idle RIGBHT NOW?

So! WF contracts with AOL for dialup services for sales guys on the road (or whatever), and from there the employee VPNs in.

Wow! THat makes good business sense, since AOL is "reliable" as far as dialup goes, "everywhere", and, if negotiated, likely pretty inexpensive (especially versus buying 1000 phone lines and a pool of modems)

Re:PC call home

[cfradenburg]

I have a laptop and if I remember correctly the last time I used a modem to connect was when I was at my grandmother's last time I visited. My parents both have laptops and they would have used a phone line the same place. I can keep listing people including my roommate and many, many frieds. Just because someone owns a laptop doesn't meant they connect with a modem.

Re:PC call home

[Pastis]

Actually companies now have a reason to let employees put software on the company's laptops: they allow to catch you the guy who's going to steal your computers.

Re:PC call home

[gl4ss]

there's also similar kind of programs for gsm phones (mainly the series60 phones, 7650,3650,6600,ngage&all) that can be configured to send and sms with all the knoweledge on the new simcard if it notices that the card gets changed.

now if i wasnt so goddamn lazy i might actually install one of those..

Re:PC call home

[Anonymous Coward]

In order for the user to establish a VPN connection, he must first be connected to the internet. That's where AOL comes in, for the initial internet connection. AOL's an expensive solution, but I guess they do have the dumbest downed dial up available. Must have been some PHB who selected it because of it's "ease of use".

Re:PC call home

[Anonymous Coward]

Well, for example, a company might have installed a PPTP client that will connect when a net connection is detected. That seems quite reasonable, of course you've probably worked for every company at one point.

Re:PC call home

[Theatetus]

Modems don't have MAC addresses.

And, btw, tracing MAC addresses across the Internet is not "almost impossible" but "by definition impossible". Traffic on any internet (but especially The Internet) crosses routers (that's what the "inter" part refers to). Routers kill OSI Level 2 identifiers, like hardware addresses.

Re:PC call home

[lordrich]

But it's got to get onto the internet in order to connect to the vpn. Therefore, presuming Wells Fargo aren't offering it's employees dsl, it has to connect to some ISP. Though granted AOL would be a bad choice.

Re:PC call home

[diersing]

Are you, your parents, your roommate and many many friends all AOL users? I appreciate your comment, but the parent was posting in relation to AOL users, who by and large are dial up users.

Re:PC call home

[diersing]

True, and Wells Fargo is no exception. I once worked for a customer of theirs that when they came onsight there were certain firewall rules we had to lay down to allow them to VPN out.

But, the guy (it sounds) wasn't a full time Wells Fargo users. It sounded more like a contractor working from home. Most corporations will require them to load the VPN software and when connected deny their ISP provided internet access, but when the VPN client is not launched they are like the rest of us.

Re:PC call home

[netsharc]

Of course, but you think the thief was that smart?

Re:PC call home

[El Cubano]

Let's do a lookup.. hey.. it seems to be an AOL modem-pool". Company goes to police, policy goes to judge, police show credible evidence that a crime was committed, judge gives warrant, AOL gives info (login account or the phonenumber that was dialed in from) on who was logged in at that time on that modem in that modempool. Police goes to address, takes laptop, returns it to Fred, jails crook. Fred: "1337!".

Thanks to the DMCA, they can probably skip 3 or 4 of those steps and just demand the info directly from AOL (with no judicial or LE oversight) and then raid the guy themselves.

Were he pirating music, that is probably what would have happened.

Re:PC call home

[PunchMonkey]

Computrace

I know an office that uses this software... it's not bad, it stays quite hidden in the OS (Windows only of course). Login with your ID and you get a list of all your laptops and the last IP they were detected as being logged in from.

Re:PC call home

[gl4ss]

mac addresses are changeable in driver on most windows drivers as well.. which is good because some realtek cards shipped with the same mac on all cards.

Re:PC call home

[allism]

The guy apparently stole three computers, one laptop and two desktops. The banking information may have been on the desktops, not the laptops.

I work in an environment where we have to be concerned about client confidentiality, but I also have a dialup account on my laptop for a couple of reasons - one, because I sometimes have to bring non-sensitive documentation home with me (I store anything sensitive on our network, so if anyone walks off with my laptop, they get nothing), and two, because it really sucks for my ability to get to our network to die when I am on a deadline, so I can use my dialup with my analog line. Not to mention, it's nice when I'm not on a deadline and the network goes down to be able to spend some time goofing off.

The security of this situation depends on the user and his/her computer smarts - maybe you're making some assumptions because the user had an AOL account? But you can't really do much about someone just breaking in and stealing the actual hardware. In this case, it turned out to be a *good* thing that there was a dialup account available.

Re:PC call home

[Anonymous Coward]

AOL offers a more traditional ISP service that almost no one knows about. When I worked at Sun a few years ago, they gave employees access to the intranet via an AOL ISP account. Straight dial-up, no funky client software. This is probably only available to business clients though.

Re:PC call home

[Tux2000]

One continuing problem that IT has is locking down computers. It is very common for employees to install their own software and dial connections on laptops.

At my company, users simply can't change dialup connections, and they can't install software requiring administrative privileges. They are "Restricted Users" in Windows. To select a dial-up connection, a selfmade software running "suid" (or the equivalent of this on W2K) changes a preconfigured and locked dial-up connection. To install more software than the default, they need to connect to a software distribution server in the corporate network. To install other software, they need to hand out their machine and the cdrom to the IT support. In very rare cases (having a high rank or having robbed on knees for a while), the IT support can enable a "24 hours administator" mode, giving the user local administrator rights for 24 hours.

(It might be possible to copy a special program onto the machines to bypass some of the restrictions, but our users don't know that much about computers. Most can't even tell the difference between a power cable and a (laptop) power supply unit, they name both "power cord".)

Re:PC call home

[mess31173]

I work at Wells Fargo and there is a pile of 8 laptops on my desk and the images I apply to them don't have any "call home" software. FYI.

Re:PC call home

[Anonymous Coward]

I worked for a company that used this sort of software. It was stored in an unused area of the CMOS, so even wiping the machine would not get rid of it - and all it looked for was an internet connection (it didn't care what kind).

Re:PC call home

[Zaiff Urgulbunger]

Last I heard a modem does not actually have a static MAC address in firmware like a network card.
Don't modems use "phone numbers" instead?

Re:PC call home

[cens0r]

It probably grew out of compuserve. All the businesses I worked at in the early 90's used compuserve as dial-in service to access the company network. AOL probably just transitioned them.

Re:PC call home

[Anonymous Coward]

You're fired!

Love,
The Big Boss

Re:PC call home

[Anonymous Coward]

Yes but is Yahoo likeley to get the direct quote correct?

Re:PC call home

[Anonymous Coward]

That YOU know of :)

Re:PC call home

[haunebu]

Here's a clue: Corporations don't rely on AOL for their VPN connections. There are lots of companies that most folks such as yourself probably haven't heard of, like UUNET (WorldCom), which offer local dial-ups globally, and exist for just this purpose.

Re:PC call home

[mess31173]

I know this because I built the last image. At least for my department. There is nothing fancy about any of these images. They have the standard sofware packages you'd expect at a conglomo corp. They also have a tunneling package so that you can access the corporate lan. They do not, however, have AOL installed. Most of the people that use these things have access to do whatever they want to them. That's probably the way AOL even got installed as they are not corporate approved software.

Re:PC call home

[DarkProphet]

Depends on the specific business line of WF that you work for. I am at WF Home Mortgage... no there is no software that 'calls home' specifically, but some of the software my business line uses must connect to central mainframe at specific IP / port combinations... of course the firewall does not allow connections from outside the intranet, but it DOES log those attempts ;-) connections from ourside are red-flagged for further investigation

Re:PC call home

[boomer_rehfield]

This specific one, no.... I mean come on, he was using AOL... *grin* But seriously, just because one isn't smart doesn't mean they're all stupid.

Re:PC call home

[Anonymous Coward]

More than likely, the computers had some sort of software built into them to 'phone in' and notify a central location of its IP address.

Yeah, I have something like that set up myself. I have a script that e-mails the IP address every time it changes. This is because I am on a dynamic IP address and it changes every few months. I need it so I know where to SSH to.

So if you're going to steal my machine, erase Linux and put a pirated copy of Windows XP Corporate Edition on it.

Re:PC call home

[Dr. Evil]

Naw, phone numbers only set up the connection, they don't exist once the connection is established. Modems are only capable of a point-to-point connection so the MAC is meaningless.

I assume Microsoft assigns a bogus MAC just because it is easier (== less bug prone) than dealing with special cases in their protocol stacks.

I've always been a bit curious about how they generate the bogus MAC though. Can it be an identifier?

IMHO, if the thief didn't wipe the HDD on the notebook, then they were probably nailed by a cookie as soon as they fired up their browser.

The cookie would give an IP, an IP would give a rack of modems, a rack of modems would give the caller's phone #, and pow.

Or... the cookie would give an IP, the IP would give a provider, the provider and IP would give an account, the account would give a physical address and pow.

BTW, one ISP I was with would create a dynamically generated reverse-lookup DNS entry which contained my MAC address. Pretty clever since my MAC and IP, thus provider and account would be splottered all over ISP logs everywhere. It's not so much a privacy invasion, since the IP and the date/time would give the same info.

Re:PC call home

[mniskin]

There's no need for an address for a PPP adapter, 'cause it's Point to Point Protocol, meaning that it's just one wire between two machines. The purpose of the various addresses (MAC, IP, etc.) is to differentiate between the many peers on a network. At layer 2 on a PPP link there are only two hosts, so no address is needed.

Re:PC call home

[mniskin]

You're saying that realtek shipped a line of ethernet cards that all had the same MAC address?!? That makes absolutely no sense.

Re:PC call home

[Anonymous Coward]

DHCP you stupid nigger. DHCP uses MAC addresses to keep track of leases. Now shut your fucking stupid hole.

Re:PC call home

[Anonymous Coward]

You're stupid. Learn to spell.

Re:PC call home

[canadianjoe]

Yeah, my ISP does the same thing. It's a combinatin of nic mac address and modem serial number or mac addres, depending on the type of modem.

Re:PC call home

[LostCluster]

If any company installed such call home software by default, it'd be a security-concerned company like Wells Fargo...

Re:PC call home

[Fembot]

Strange... i've never really looked into ppp links much, but windows definalty shows a mac address for ppp adaptors

Re:PC call home

[Afty0r]

This is not a part of some Evil scheme or government plot...
Because if they don't track this information and enforce it... then they will be getting lawsuits left and right

Didn't you just contradict yourself? You're claiming it's not part of a government plot, and next minute you're saying the government forced them to carry out their actions?
Laws are enacted by the government to force the citizenry to conform... so when you have to do something to obey the law, you have been forced to carry out that action by the government.
But this has nothing to do with the government, right?

Re:PC call home

[Anonymous Coward]

Oh look, another retarded teenager posting to Splashdork about something he doesn't understand. Insert foot in mouth - then try to make up for it. What a shock.

Tell you what sonny - just shut the fuck up.

Re:PC call home

[Anonymous Coward]

this sounds very interesting, remember what it was called ? I like this kind of low-level hack/spy stuff, like those physical devices you can plug into the ps/2 port inbetween the keyboard and ps/2 port to monitor keystrokes. completely invisible to the OS or antivirus software or whatever

Re:PC call home

[majid]

Most network access servers send Caller-ID information in the RADIUS authentication request. AOL would have that in their logs, and if the thief used caller ID blocking, the FBI could ask the phone company for their call detail records for the ISP number.

A thief that had even the modicum of clue to use Caller ID blocking, let alone spoof his telephone number, would not have been dumb enough to use an AOL account on a stolen machine.

Re:PC call home

[Anonymous Coward]

Civil suits that show damages are not directly "government related."

Re:PC call home

[B747SP]

You're saying that realtek shipped a line of ethernet cards that all had the same MAC address?!? That makes absolutely no sense.

It makes perfect sense: they screwed up. It certainly wasn't intentional. Sum Yung Guy in charge of flashing MAC addresses took a day off, and no-one thought to do his job for him

I struck an even stranger variant of the problem recently, with Asus P4S533-MX motherboards with the onboard SiS 10/100 ethernet. The Windows NT/2K/XP driver for the NIC was broken so that, even though the NICs did have unique MAC's, the driver got it wrong and passed the same MAC up the stack for all of the cards. (Driver version 1.06 fixes it, the driver on the CD is the broken one)

Certainly was an interesting one to troubleshoot :-)

Re:PC call home

[NewWaveNet]

You're claiming it's not part of a government plot, and next minute you're saying the government forced them to carry out their actions?

The government isn't forcing AOL to do anything. AOL is voluntarily doing it so that government laws are pressed upon the correct subjects and not themselves. It's the same reason manufacturers put seemingly obvious warning labels on their products.

Re:PC call home

[Anonymous Coward]

ID == MAC

Re:PC call home

[mniskin]

PPP over ethernet would obviously require a MAC address, but your dialup modem, for example, certainly won't have one. If windows for some reason generates a MAC-type address for PPP then it's not PPP anymore, it's windows-special-proprietary-sorta-ppp-but-not-comp atible-with-the-rest-of-the-world protocol.

Re:PC call home

[bdlarkin]

....are red-flagged for further investigation

Are you sure? I doubt it. Sure its logged, but "red flagged for further investigation"? In a company the size of WF, there are likely large numbers of legitimate users attempting to connect to internal IP's (assuming that internal ip's are even routed to a WF internet premise firewall).

They are just doing it by accident, by trying their application that works just fine in the office from home. "You mean I have to use VPN software to get into the office network? Whats VPN?". Repeat for thousands of users.

Red flagging for reporting to security is likely deemed overkill. Tracing the stolen laptops this way just isnt' cost effective. A single blocked SYN packet doesn't represent a threat.

Re:PC call home

[Anonymous Coward]

yeah great, if only Fred could make it look like the person on the other end was somehow in violation of his copyrights - that way he could strip this right down and skip all the police/judge steps to be:

Freds machine just logged in, but his machine was stolen. WTF? hmm, what ip was it, ahh, well this is copyright violation so i have more rights than the police do, no warrents for me, i'm off to subpeona the owner of this ip address from AOL. Right AOL hand it over, AOL gets details and gives them to Fred, Fred yells "ph34r my m4d sk!||z!"

see no warrents or judges required!

Good vs Bad

[Anonymous Coward]

There may be some good in the fact that they are able to trace someone like this...but the ramifications make me shudder.

That and make me glad I am in Canada..

Re:Good vs Bad

[leerpm]

It not's very difficult. Once you have the IP address, you just do a query at ARIN. That will tell you which ISP the address belongs to, so you phone the ISP and ask them for the information about which subscriber had that IP address at the time you are concerned about. Almost All ISPs maintain this sort of information for auditing/logging purposes.

Re:Good vs Bad

[Anonymous Coward]

It's called a PHONE NUMBER, you freaking idiot. The guy logged in, using the account on the computer, over a PHONE LINE, and they LOOKED UP THE FREAKING ADDRESS FOR THE PHONE NUMBER.

OMFG who knew that the big evil government had the power to look up someone in the PHONE BOOK?!?!

Re:Good vs Bad

[suntac]

Looking at yahoo.com the news report.....

"Investigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers"

He used his own account and NOT a account that was on the computer. So there was NO direct link to the stolen computer by a username or something. Looking from a pure ISP point of view he was just user login in.

There was NO information transmitted talking about that the computer was not his computer except for the MAC adres. This means that a ISP in america must log MAC adresses in combination with dialin information and run those MAC adresses against a MAC-database hosted by the FBI or something like that.

That is the scary part of this story. Think about it,they have a list to lookup what user is when online, dialing from where and using whose computer.

Re:Good vs Bad

[Jugalator]

Exactly, I doubt there was any stranger things going on than this. Especially such large ISP's as AOL most likely keep user logs.

Re:Good vs Bad

[jridley]

Yes, but it's not clear that's what really happened; it appears that the actual info may have been muddled by the reporter. I suggest looking for Krastof in news.google.com and read some other articles.

Here's an excerpt from another article on this matter:

The suspect led the police right to his door when he decided to go online. Gascoyne alerted the police that someone had used his account since the burglary. America Online helped investigators link the dial-up computer connection to a phone number, which SBC then linked to a phone jack at Krastof's home.

This is TOTALLY un-scary. The Wells-Fargo guy apparently has his password cached on the machine. This guy just clicks "login" and logs in AS THE GUY WHOS COMPUTER WAS STOLEN. At this point it's a trivial bit of work to go catch the guy.

Re:Good vs Bad

[Stephen Samuel]

About the only thing that was even vaguely surprising about this is that AOL gets and logs Caller Id (call display) information. Normally that's extra cost from the phone company, but I'm betting that AOL gets a nice bulk discount from their telco.

For my part, if I was going to steal a computer, I think that I'd wipe the harddrive and install a new OS (read: Linux) before I even thought about connecting it to the net. That wouldn't necessarily stop all the call-home tricks that I can think of, but I'm not about to trust my freedom to the computing safety of a stranger.

Re:Good vs Bad

[AllUsernamesAreGone]

" I think that I'd wipe the harddrive and install a new OS (read: Linux) before I even thought about connecting it to the net."

The only problem with that is that this guy was trying to pull off sensitive information from the box. But yes, if he had more than a couple of functioning grey cells he certainly wouldn't have hooked it up to any kind of public network until he had pulled off any useful information, done a thorough drive wipe (not just a format) and installed a new OS.

Of course, the FBI probably likes the less technically inclined computer lifter....

Re:Good vs Bad

[li99sh79]

Of course, the FBI probably likes the less technically inclined computer lifter....

Not every crook can be The Napster, Left-Ear or Handsome Rob. Hell, most of 'em aren't, that's why they're crooks. :)

-sam

Re:Good vs Bad

[gl4ss]

** About the only thing that was even vaguely surprising about this is that AOL gets and logs Caller Id (call display) information. Normally that's extra cost from the phone company, but I'm betting that AOL gets a nice bulk discount from their telco.**

it's not that surprising and i doubt it doesn't cost them any extra. besides, if they didn't keep that information then they could turn to telco for the same information(here's a call, here's a warrant, find it from your pile of shit logs NOW! they got lots of logs and hidden caller id doesn't really 'protect' you worth shit).

dunno, if i had a computer i knew was stolen (and wanted to keep it instead of turning it in) i might put in a seperated network just for kicks.. or just wipe it to be sure(besides, if somebody lets his laptop to end up easily stolen it's quite likely it's full of shit and nachi and whatnot).

Re:Good vs Bad

[Artifex]

Probably most crooks steal for quick money, so would probably be quick to roll over their loot to a fence or something.

On the other hand, there's been a lot of speculation that the rise in airport laptop thefts in particular is partially due to deliberate attempts at corporate espionage. Still, you'd think some contract hacker would be smart enough to keep the machine isolated.

Re:Good vs Bad

[Ewan]

Weirdly, in the UK it's pretty near impossible to dial into an ISP when you have the caller ID disabled on your line...

Re:Good vs Bad

[Anonymous Coward]

Almost All ISPs maintain this sort of information for auditing/logging purposes.

Are you saying almost all to CYA or do you actually know of a few that don't. Please list them.

Re:Good vs Bad

[Anonymous Coward]

Sounds like you need the US's system -- Disabling CallerID only applies to other consumers. Businesses still get the caller's number.

Re:Good vs Bad

[meridian]

Glad your in Canada till you read todays other story about Canada taxes Australia ain't much better with its new spam laws either :) But hey ASIO is already allowed to log into anyones computer without a warrant and modify data on your machine. We aren't too far behind

Re:Good vs Bad

[garbuck]

" I think that I'd wipe the harddrive and install a new OS (read: Linux) before I even thought about connecting it to the net."

The only problem with that is that this guy was trying to pull off sensitive information from the box.

A smart thief would have popped a disk imaging disk or a Knoppix or Lindows CD into the laptop and booted from that, not the fucking hard drive. Then, after copying the hard drive's contents to another machine on his LAN, he would have put the laptop back where he found it! That way, the theft would only slowly dawn on Wells Fargo as he began to make use of his information haul. Indeed, they might never figure out how the info leaked.

hardware id

[neodymium]

I guess the AOL software might "accidentially" transmit the ethernet hardware (MAC) id of the machine...

Re:hardware id

[Anonymous Coward]

Is there any way to stop this?

Re:hardware id

[Anonymous Coward]

Umm, mac addresses are "purposefully" transmitted with every TCP/IP packet out of a computer.
Not by accident.

Re:hardware id

[neodymium]

no sir. tcp/ip does not transmit the hardware id. the ip head contains the source and destination ip address (thats where the name comes from...). the link level packets, which transport ip in i.e. ethernet, contain the mac address, which is resolved by mechanisms as ARP.

Hmmm

[Moderator]

Maybe the computer systems were set up to call a certain IP address in the event that they were stolen. There's software like this for laptops already. If this is the case, all the FBI had to do was contact AOL to find out who was accessing the site, and from where.

could be that he used...

[Toontje]

a dailup account that already was on the laptop? I dont know AOL but would they really be interrested in what kind of unique hardware coonected to their network?

MAC addresses?

[davejenkins]

I would assume MAC addresses of the ethernet jacks/boards/whatever are being transmitted, no?

For a notebook-- this would be built-in, and probably tracable in the inventory. It would be pretty simple for the FBI to wait for a specific MAC address, trace the corresponding IP address, and then narrow it down to a router (now we have the neighborhood/village). It`s simple drive-around from there...

Re:MAC addresses?

[Viol8]

The MAC address goes no further than the first router , in this case his broadband modem if thats what he's using.
If he's using dialup the MAC address doesn't even come into it.

Re:MAC addresses?

[crevette]

Why make it so complex? The computer was reported stolen by Wells Fargo with all the information, so the FBI issued a request to AOL to notify them if anybody logs into such and such accounts. Once it happens, the FBI simply had to check the phone records to know what is the number of the guys connected and voila!

I work at a phone company in a country without secret services and sophisticated hooks into any ISP and we would be able to pull that out in a matter of minutes.

Re:MAC addresses?

[leerpm]

I don't think is how it would happen. I would be willing to bet, they did not even know the MAC address of the computer stolen.

It isn't that simple for the FBI to 'wait around for a specific MAC' address. AOL (and other ISPs presumably too) would have had to configure all of their systems to watch for this. Much more likely, the system 'called home', and let someone know that at a certain point in time the computer has a specific IP address. The FBI would have been notified, they would have asked AOL to check their logs to see which subscriber had that IP at that time. Then they got him.

Re:MAC addresses?

[Anonymous Coward]

Yes, but usually the IP address is obtained via DHCP.

Re:MAC addresses?

[platypus]

Yeah, but if he's using a direct xDSL connection, the MAC address _does_ go out directly to provider equipment.

Anyway, in the thread above there seems to be the real explanation, i.e. the thief used the victims AOL account to log in (how dumb is that?).

Re:MAC addresses?

[Anonymous Coward]

No.
Only IP address is transmitted. MAC addresses are visible only on physically same network. For example if you ask for MAC address of machine in another network (for example behind router) you will get back MAC address of your router. This is way how IP work: From every machine same IP can be masked behind different MAC address.

Re:MAC addresses?

[Anonymous Coward]

Only on a bridged connection, or with one of those weird cards that plugs the ADSL directly into the computer.

For all the routed xDSL connections, it still doesn't get further than the router next to the PC.

Re:MAC addresses?

[Anonymous Coward]

Right! If he's using a broadband router.

Last I checked, not everyone uses a broadband router. So MAC address is still a very good possibility.

But I don't know... I certainly dont keep track of MY MAC addresses...

Re:MAC addresses?

[Viol8]

No it isn't. The MAC address is the address used in the ethernet packet. If he's not using ethernet then the MAC address will never get out
unless a program specifically sends it as data via another method.

Re:MAC addresses?

[tigertiger]

I understand this is not the way this guy was caught, but ATT Broadband uses your MAC address as DNS name of your computer: e.g.

Received: from h000625f6f844.ne.client2.attbi.com (EHLO computer)

So if you steal a laptop, you'd better not connect it to your cable modem...

Re:MAC addresses?

[cpghost]

The MAC address goes no further than the first router

Yes, but the AOL closed-source client application could get this MAC address from the OS, and transmit it to AOL's servers (covert channel). After all, we don't know what this AOL client does.

Re:MAC addresses?

[anthony_dipierro]

Only on a bridged connection

Hmm, I'm not sure exactly what you mean by a bridged connection, but presumably many ADSL connections would qualify. I mean, it's called PPP-over-ethernet, not PPP-over-IP. So the MAC address must be getting passed on, right?

hardware ethernet addresses

[Space cowboy]

I guess if AOL take a note of the hardware ethernet address (not surprising, because DSL lines aren't supposed to be shared, right :-) then just doing a query for the address on AOL's db would be enough to get a (very) shortlist...

Simon.

last thing the thief heard...

[dark_day]

"You've got jail!"

Re:last thing the thief heard...

[Anonymous Coward]

No, no, no. "You've got gAOL!"

Re:last thing the thief heard...

[WCityMike]

Mod parent up, please ... that's pretty damn witty!

Moral of the story...

[jkrise]

1. When you steal computers, don't steal laptops.
2. After stealing a dedsktop PC, even if it has the latest Windows OS and Service Pack, format the disk and load RedHat.
3. If you steal a Linux PC, install Windows on it for a year, then switch back - even AOL can't maintain that big a log!
4. Don't use AOl - switch over to MSN - it's much more secure - instead of the FBI, it'll be the BSA that's after you!

Re:Moral of the story...

[neodymium]

well, that all renders down to one point: IF you steal hardware, rip out every component which allows "THEM" to identify you: cpu (p3 serial #), ethernet (MAC), mainboard (bios serial #), disks, ...

that leaves you with an empty case, maybe also a 3.5" floppy drive.

Re:Moral of the story...

[marko123]

nice try. being the only person still owning a 3.5" floopy drive makes you instantly identifiable. Oh, you mean being the only person who still uses it?

Re:Moral of the story...

[mirko]

3. If you steal a Linux PC, install Windows on it for a year, then switch back - even AOL can't maintain that big a log!

Do you mean there is an AOL client for Linux ?
(this is a question, I expect an informationn, not some lol rotfl or some modding)

Re:Moral of the story...

[mr100percent]

Sort of

Re:Moral of the story...

[vofka]

Yes, there is an AOL Client for Linux - though it's not an 'official' client.

Look at This Tutorial to see how to install the PengAOL Linux Dialer.

I have set this up on both SuSE and Mandrake systems from source for a couple of friends who wanted to try Linux, but who didn't want to drop AOL... It can be a bit tricky to get working, but it does work (in the UK at least).

Re:Moral of the story...

[91degrees]

When you steal computers, don't steal laptops.

Tricky though. Laptops are more likely to be left in an easily stealable position.

After stealing a dedsktop PC, even if it has the latest Windows OS and Service Pack, format the disk and load RedHat.

I think you just need to reformat. Since you'll probably want to sell it anyway, you probably want the OS that people want.

If you steal a Linux PC, install Windows on it for a year, then switch back - even AOL can't maintain that big a log!

They might just log MAC addresses. Not too hard to store for a year. Even easier to store ones that are known to be stolen. Don't use AOl - switch over to MSN - it's much more secure - instead of the FBI, it'll be the BSA that's after you! Or don't use the internet. Sell the thing anfd buy yourself a legit machine.

Re:Moral of the story...

[bogidu]

This is just wrong . . . wrong wrong wrong!

Re:Moral of the story...

[gooman]

This is /. You forgot step 5...

5. Profit?

Re:Moral of the story...

[HansF]

Or you could just surf behind a router...

Re:Moral of the story...

[cgenman]

5. When you steal a computer, put yourself under citizens arrest.

Re:Moral of the story...

[Anonymous Coward]

It's much simpler than that. When you steal a laptop, don't steal it from rich analysts that work for large corporations (who can offer $100,000 rewards). I've known people who have gotten their laptops stolen, and there's no way the FBI was going to get involved. The local police didn't even do any real investigation.

Re:Moral of the story...

[Vlad_the_Inhaler]

• I thought you could turn the p3 serial-no off via a bios option (not that I have one)
• is the mainboard bios serial # really transmitted?
• Now to MAC Address (the article said IP-Address but we can ignore that), what is to stop you putting another pcmcia card in there? If the original ethernet was a pcmcia card, dispose of it as anonymously as possible and if it is internal, use it for an internal network only. Disable wireless lan.

On the other hand, if the thief had known what he was up to and what the risks were, he would have known enough to be able to get a half-decent job anyway.

CPUID is your friend

[isa-kuruption]

Once in a while, yes, it is your friend.

But then again, AOL probably has other ways to track computers for marketing and such... to determine what PCs are being used how much to access AOL services, etc...

Re:CPUID is your friend

[Anonymous Coward]

Yes, but you also have much more stuff in your computer that can identify your computer.. For instance hard drive parameters, mac address, hell, you can even save stuff on the hard drive in sectors that are not normaly accessible by the operating system.

You shouldn't rely on the CPUID alone. If you do, you're computer will be lost if (or when) the CPU's changed. Most tech-heads are aware of the CPUID, and may intentionally change the CPU right after a theft.

If you rely on all sorts of information combined, the thief will have to change all the hardware, and in that case.. what's the point?

Re:CPUID is your friend

[isa-kuruption]

mac addresses nor hard drive specs are unique.... however, CPUIDs are... and on XP, it would be difficult, if not completely impossible, for a program running within XP to write directly to the hard drive since XP protects against such activities (all cracks about windows being insecure aside).

Most tech-heads do not steal laptops, that would be stupid, and most tech-heads are not stupid. The people who do steal laptops are idiots like the one who got caught. And, replacing a CPU on a laptop is extremely difficult. However, replacing a hard drive is a lot easier.

If you rely on all hardware, then if any of the hardware is changed, you'd have a different configuration... and therefore would not match since it is likely for another machine to have the same hard drive and similar MAC address... especially from companies like Dell, HP/Compaq, etc where they all use Intel NIC cards and Hitachi hard drives.

Customer data security?

[Anonymous Coward]

Isn't it totally shocking to see how less companies take care to protect customer's data. Somebody should tell them that there's sonthink called encryption

Get over it

[marko123]

The line between being able to trace crooks and being able to maintain your privacy has always been small. You know what to do if you want privacy, and everyone else should not ever assume they are private just because noone else is in their lounge room.

This is a valuable education, and it will help the regular user understand how unprivate their internet communications are.

No-one loses here. What's the story?

Re:Get over it

[Anonymous Coward]

> No-one loses here. What's the story?

It's `if you're going to steal a pc, best wipe the hd and re-install before using it on a public network`, I think.

...or maybe...

[cnelzie]

Well's Fargo is using some cool 'Phone Home' software that was described on Slashdot several times that MOST everyone thought was a good idea...

Why is it a good idea when it will protect your laptop or employer's laptop, but suddenly, the FBI has some nefarious hooks into AOL when they publish that they captured a laptop thief because the thief logged into AOL?

Anyone care to give that answer that?

Re:...or maybe...

[i_really_dont_care]

Well's Fargo is using some cool 'Phone Home' software that was described on Slashdot several times that MOST everyone thought was a good idea...

Why is it a good idea when it will protect your laptop or employer's laptop, but suddenly, the FBI has some nefarious hooks into AOL when they publish that they captured a laptop thief because the thief logged into AOL?

So when I can be sure that it really is the "cool phone home" software then everything's alright.

But who really knows?

Re:...or maybe...

[Lars T.]

You are absolutely right. According to the article (does anybody RTFA?), the nefarious hook into AOL was "to connect the computer's Internet Protocol address, a number that identifies a computer on the Internet, to Krastof's home address through his AOL account". IOW, they asked AOL "Who used this IP address at this time?" Whoooh, scary stuff. Using an IP address and a date as an GUID. Next thing they'll be able to trace back my phone calls.

Re:...or maybe...

[Anonymous Coward]

The answer is that you just whored 5 karma points by using the same old Slashdot-straw man argument that dozens of other retards have also fell for. Congrats!

Re:...or maybe...

[blang]

It doesn't need to be a very funky piece of software, though.

Simpy set the home page of your browser to an URL such as www.mydomain.com/secret_index.html, which is simply a redirect to your regular home page.

If the computer disappears, simply wait for a hit to that URL.

You know...

[mental_telepathy]

I hate to say that Slashdot readers have obvious biases, but why is it that when the police do something smart with computers, you get:
Makes you wonder what sort of hooks the FBI has into AOL or other ISPs and what hardware identification is being transmitted at login.
And when they can't solve a computer crime case, you get 100 posts about how the police are computer dummys. I'll be honest, I'm not too worried about my ISP having my MAC address, or even the make and model of my video card if they are interested. It's just nice to see a criminal get busted

Re:You know...

[marko123]

nice. slashdot is the hot kitchen. You will have -1, Insightful by the end of this, but posts about how people post are not really insightful. not here. I liked your actual point though :)

Re:You know...

[Anonymous Coward]

this is not about technology (tracing that guy down is technically not much of a problem) but about the connection between aol and the police.

Re:You know...

[Anonymous Coward]

It's because the police are generally evil, or rather, they do the evil bidding of the government. And if you don't think governments are evil, then you've not been paying attention. Unless you think starting wars, stealing land, testing deadly gasses on civilians and members of the armed forces, planning 9-11 style attacks on civilians to justify a politically inspired war against cuba etc etc are ok.

Re:You know...

[inerte]

Because the end does not justify the means.

Re:You know...

[jkleid]

"I'll be honest, I'm not too worried about my ISP having my MAC address, or even the make and model of my video card if they are interested."

Authorities now have a sizable fraction of the technology possessed by big brother in the book 1984. Whether or not to fear that power is a matter of trust.
_______

Re:You know...

[gl4ss]

'authorities' have had the same power on purely personal surveillance through using people as spies for centuries(east germany & all.. talk to some people who lived or visited it. most people in europe are aware that such a system majorly sucks balls even the one's that would like more control recognize that it was just plain _evil_ and should not be done, getting thrown into jail because your kid accidentally snitched you out at school). it's a people problem, not a technological one.

Re:You know...

[Anonymous Coward]

You are a prick.

Re:You know...

[Alsee]

why is it that when the police do something smart with computers...
And when they can't solve a computer crime case...

Because the issue is how they do it. News items appear slam the police for success and ridicule them for failure simply becuase news items are not a representitve sampling of reality! The police have a hundreds of successes every day, but who cares to write about them or read them? It only becomes a news item when the police have a success AND they did something wrong or controvercial in the process. The same goes for their failures - it only becomes newsworthy when someone really screwed up.

As for this particular story it is all about how the police caught the guy. It appears that Slashdot botched the story in this case. Another news site reports that the guy did NOT log into his own AOL account, he logged into an AOL account belonging to the owner of the machine. If that's the case then there really isn't any story here. If some moron steals my wallet and then shows up at bank trying to use my safety deposit key then there's no problem grabbing him and throwing him in prision.

I was going to continue with an example of police methods that would not have been acceptable, but lets skip arguing over specifics. Suffice it to say that there *are* a wide variety of unacceptable methods. If you don't agree with that then you are a far greater threat to this country than any terrorist with a bomb.

-

Re:You know...

[GoofyBoy]

>Authorities now have a sizable fraction of the technology possessed by big brother in the book 1984.

And we have tools to counter their tools to effectively make "1984" highly improbable. The authorities are just trying to keep up.

Re:You know...

[DataCannibal]

I hate to say this, but have you ever considered that he people who are saying "Makes you wonder ..." may not be the the same people who are saying "The police are computer dummies ..." or has there been a Slashdot poll to find out the official Slashdot politburo party line on this subject and I missed it.

Parent insightful? Pah!

Re:You know...

[DataCannibal]

Admit it. You haven't read it have you ?

Re:You know...

[crashnbur]

If we all trusted the system and took part in making sure it worked as it should, then it would work better than it actually will (because most of us will never put in that effort). The biggest problem I have when it comes to trusting the government is its bureaucracy -- none of our elections have any control over thousands of Washington's bureaucrats, so they're free to do whatever they want (within reason) at their own pace. It is when our votes stop controlling the government when the government starts doing what it wants with disregard for its people.

This is not a government for the people any more. We only influence the sugar-coated topping. Everything else is far removed from the average private citizen...

1984 is not upon us, because we still have the illusion of our freedom -- but perhaps that's worse, in the long run.

Re:You know...

[Anonymous Coward]

>You are a prick.

Yeah, but you're a bigger prick (uh..maybe that should be `smaller`) if you think Bush is making the world a safer place.

tin foil hat...

[mirko]

If the guy tell the fbi his laptop got stolen, he may laos have given them some info about a recent internet connection which would have allowed them to find his mac address which was then looked for in some isps' logs until they found out who did it.
I guess it's more optimal for the fbi to do it this way than to just store whichever information thanks to some software backdoors.
we have some reasons to worry about our Freedoms but it is not a reason to imagine we're always being spied on.

Re:tin foil hat...

[arth1]

If the guy tell the fbi his laptop got stolen, he may laos have given them some info about a recent internet connection which would have allowed them to find his mac address which was then looked for in some isps' logs until they found out who did it.

While this is possible, I find it unlikely.
Why? Because the feds would not put down investigative resources on a simple theft, especially from a private person.
I find it more likely that the original owner pleaded with AOL into checking whether the account had been used after stolen, and then again pleaded with them to give that information to the detective assigned to the case.
Which would be a perfectly normal story, if it had been a small ISP. The story here is that someone actually got a big ISP to check their logs and cooperate with the customer in informing the police, instead of just reading scripted responses from a call center in Bangalore.

Regards,
--
*Art

Re:tin foil hat...

[LostCluster]

There's no proof that AOL voluntarily cooperated here. Again, if Wells Fargo had installed a "report the IP whenever connected" software and the thief was too dumb to have not completely wiped the machine, then Wells Fargo would have instantly had the IP address, which they could quickly determine was assigned to AOL. Having a timestamp and an IP address is enough to get a search warrant for AOL's records... and that leads to the theif's screenname, real name, and billing info if it was his own accout, or at least a caller ID phone location if it was the one stored on the computer, which.

This was a case where the system worked. The theif slipped up by connecting to AOL and the laptop was able to broadcast it's identity as belonging to Wells Fargo.

You'd think that a thief

[xirtam_work]

would be a little more aware of using big a company for his ISP due to tracability, etc.

Also the first thing I'd do is reprogram the MAC address (and ensure that the BIOS had CPU serial number feature disabled - if possible?).

I'm no thief, but I I were to try something illegal I think I'd plan it out a bit better first.

Did this machine have 'phone home' software installed?

Also, aren't most stolen laptops (and other computers) quickly sold on anyway? the perp is a total idiot for keeping it and using it. If you sell something in an untracable way, say to a guy in a bar for cash, then you're less likely to get caught.

Re:You'd think that a thief

[marko123]

only dumb* people get caught.

* people who don't do their homework. See many geeks in jail? Is it because they phear the law, because they are not so hardcore, because they are not so stupid, or because they are not teh ghey? Your pick...

Re:You'd think that a thief

[Anonymous Coward]

I told the FBI that I got it from a guy in a bar but they wouldn't believe me!!!!

Re:You'd think that a thief

[Anonymous Coward]

Little from column A, little from column B. None from C or D.

Ugh... Grammar not good...

[cnelzie]

...this early in the morning...

That last line should have been...

"Anyone care to give that an answer?"

Which I had thought to change to...

"Anyone care to answer that?"

Re:Ugh... Grammar not good...

[Anonymous Coward]

Which I had thought to change to...

It's getting better, but still not quite there yet.

One more argument for adoption of open standards

[ezh]

I know sometimes obscurity can be useful, but I still believe it is violation of privacy. Which means the thief should be set free since the methods that were used to trace him were unlawful.

AOL Id is in the install

[acomj]

When you install AOL it knows your "Master account" name. From there you can pick one of the other account names or use the "Guest" login feature.

My guess is that when the theif loged in they use the guest feature.

AOL probably had the account flagged as "Stolen" so the theif couldn't buy AOLL stuff through the account on the machine

Re:AOL Id is in the install

[Anonymous Coward]

Why would he login as a guest on his own account and get it flagged stolen? Did you even read the article?

Re:AOL Id is in the install

[fliptout]

I dont think that is what the poster meant- I think what he is saying is that the *installation* of AOL has an embedded name. When ever anyone logs in from that copy of AOL software, it sends the embedded name and the login name of whoever... Or maybe i understand him wrong.. Which is likely :)

MAC Address? Proc Serial? Magic Lantern?

[tintruder]

Nobody ever talks about the MAC Address being a unique serial number for a PC. But if a company uses a management tool like OpenView, Tivoli, Spectrum etc., the MAC is certainly one of the parameters collected and recorded as part of the inventory.

So if this guy installed his own software or OS on a stolen box and then got caught, that leaves precious few other options.

Processor Unique ID?

WindowsXP Phone Home?

Keystorke Logger?

In any case, it certainly appears that some "known" piece of identifying data was present and easily flagged.

I for one would like to know more about the exact method used, because if there is indeed some kind of government back-door that has the potential to circumvent encryption or anonymity, we ought to find out.

Maybe the FBI's "Magic Lantern" is a 2-piece system with 1/2 on the network, and the other half in the OS or the Silicon?

Maybe all the bank employees are being spied upon without their knowledge?

Maybe Patriot Act rears its head in the authorization of certain methods and practices?

ipv6

[eddy_crim]

If im correct ipv6 stores your 48 bit mac address in the last 64bits (wasteful) so that should make the fbi's job nice and easy

Re:ipv6

[seite-f00f]

you are _not_ correct
and btw. changing mac addresses is trivial
(if they get transmitted at all -> think NAT)

Re:ipv6

[Anonymous Coward]

You _are_ correct, but only partially.

Automatically generated IPv6 addresses typically use the mac address split in two with "fffe" inserted in the middle.

It is, however, optional - any random number (which will be verified by the IPv6 stack to be random enough) can be used.

However, who really gives a damn? If they still need to get the ISP to tell them who owns the IP (and possibly the MAC) in order to find the actual PC - and MAC's can often be reprogrammed anyways, so I'd assume that it is a worthless piece of evidence.

If you want to be untraceable, disconnect and move to Mexico.

Re:ipv6

[zhenlin]

While true, I think this is only a temporary address, akin to the IPv4 169.254.*.* addresses. These are self-assigned. Whatever for, I have no idea...

Obviously, you can't be having your MAC address as part of your address, you'd rather have something simple like dead:beef::1.

Re:ipv6

[Skapare]

IPv6 does indeed have a nice link local address space. And the MAC address is included in it when it makes up its own address. I already use 169.254.*.* with the low order 16 bits of the MAC address to get a somewhat similar effect in IPv4 space (although I basically just use it as a backdoor address in case I fubar a config on a remote box).

However, I have seen machines that do not have a specific IPv6 address configured automatically get one in a "public" (I think it was on 6bone, in this case) address space, and it still had its MAC address in there. Things like DHCP won't need a MAC to IP address map or lease database anymore. All that the machine will need to get is the high order address prefix and then it's online.

This is an option for everyone!

[Anonymous Coward]

If you have a laptop, or any computer, for that matter, you should register it.

It just takes a few seconds, and being able to get it back in the event of theft is great peace of mind.

I use RegisterForFree. Better safe than sorry.

Re:This is an option for everyone!

[Anonymous Coward]

Sounds a lot better than registering with the manufacturer. An OPEN registration process for machines and users of all types. It's about time!

Wrong Guy

[Anonymous Coward]

Not that this guy isn't a scumbag, but WF customers should be asking themselves how this breach of security could take place. Information like this should NOT reside on an unprotected laptop. Someone at WF is VERY dumb.

Re:Wrong Guy

[Anonymous Coward]

Many banks outsource work, and that was apparently the case here. For example, smaller banks outsource their mainframe/minicomputer work to a company that specializes in that work. In this case, it only dealt with certain type of customers. Wells Fargo should have a standard contract with them that requires the outsource provider to meet certain standards of data security. Having a laptop that was stolen from a locked firm probably isn't something the company can protect against. Geeze, I hate this, I'm defending them and I don't agree with the policy, but that's the Government (OCC) for you.

Wait a minute...

[cnelzie]

How was this thief even able to use this stolen laptop? Were they not running a password protected operating system, at least Windows 2000 or Windows XP?

I know that if ANY of the laptops and roughly ALL of our desktop PC's would be useless to any thieves unless they format each and every machine, since there isn't a single account that doesn't have a password that isn't controlled by our Domain Controller...

I am not so happy about Wells Fargo's apparent disinterest in keeping things secure...

Re:Wait a minute...

[leenoble_uk]

Running Jaguar I set up a fake account with no password on purpose. If my laptop was stolen I WANTED the thief to use it to get online. My real accounts were hidden from the login screen and my home folder was invisible. I had a penny-per-minute dialup ISP set up to make it easy for the thief to get connected. Using DNS update software I would be able to see the IP address at Dyndns.org if it was ever used.
If the thief was to find the computer locked down from the start then they'd be far more likely to wipe and restore making this a lot more difficult.
Unfortunately, now running Panther and making user account invisible makes the fast user switching a buggy nightmare. So in spite of the extra security features like FileVault I think it less likely I would ever see it again if it were stolen. I liked my security through obscurity.

Re:Wait a minute...

[caluml]

Why not everytime the nachine boots, it sends out an email - that way you can get the whole SMTP path in the headers.

Re:Wait a minute...

[Anonymous Coward]

Umm .. win2000 or winxp password "protection" is absolutely useless once a person has physical access to the device.
Just type in google "lost password win2000" and you will see how easy it is to reset the administrator password.

Re:Wait a minute...

[Anonymous Coward]

Were they not running a password protected operating system, at least Windows 2000 or Windows XP?

Usually people run *from* "password protected" Windoses.

Re:Wait a minute...

[leenoble_uk]

I thought of that first.
Where's the SMTP coming from was the sticking point.
Couldn't use sendmail running on the laptop.

That's not the point I was making though. I still needed them to get online for either method to even work. And I needed them to get online with my settings intact, hence the no-password-needed account.

Re:Wait a minute...

[mydigitalself]

local admin password = blank. the number of companies i've worked in that failed to set local account passwords is frightening. although if your shared knowledge (network data) is well protected with ACLs this isn't as much of a threat as one would expect.

Re:Wait a minute...

[HeghmoH]

If you do want to implement e-mail, it's very simple. You don't need a local MTA; SMTP is very simple, and a server will accept a message for a user at its domain, no matter where you're connecting from. (Or nearly so....)

So all you have to do is know the SMTP server for your e-mail address, and a bit of scripting with netcat does the rest. Just make a file with:

helo phone_home@domain.blah
mail from:phone_home@domain.blah
rcpt to:phone_home@domain.blah
data
Subject: subject

contents go here
.
quit

Then you can send it with 'nc smtp.isp.blah 25 file'.

I do this for my phone-home program. It doesn't send mail by default, but it checks a private page on my web site. If it finds the right command on that page, then it will send e-mail. I can also have it execute commands and open up an ssh tunnel so I can ssh in.

Of course, like a dumbass, I don't have an easy way for them to get online unless they have a wireless network. Do you have a suggestion for how to do that without having a password-free admin account? I don't want random people to be able to do nastiness on my machine.

Re:Wait a minute...

[rhild]

In addition to resetting the admin password there are tools like this one which I've used many times to recover passwords from NT boxes.

Re:Wait a minute...

[Hangtime]

I will go one step further, why was confidential client information on his laptop to begin with and not encrypted. Working for a financial institution myself, I sometimes have to do work from home. However, when I do leave the office all of my files are encrypted. We actually use a package called Entrust to do the encryption. Therefore, even if my laptop was stolen the information on it would be useless to a thief. We are very anal about client confidentiality and if you get caught with unencrypted client information you are in trouble.

Re:Wait a minute...

[Bobman1235]

How was this thief even able to use this stolen laptop? Were they not running a password protected operating system, at least Windows 2000 or Windows XP?

Unfortunately Windows2000 and WindowsXP have an option that most people un-select which says "users must enter a name and password to access this system". It pretty much defies the use of HAVING a name and password when the computer automatically boots through it. The worst part is this is the default configuration. So most users never really even SEE that Windows has a password.

And AOL lets you SAVE the password on your computer, which is equally foolish.

Re:Wait a minute...

[MAFIAA]

Maybe they just opened the lid and it unsuspended? Not much mystery there now, is there? I have my laptop just resume from where it left off when running XP - that 'click to resume your session' crap was way too annoying to leave in place. Then.. my laptop's never left unattended in any place except my own home...

Re:Wait a minute...

[cnelzie]

In our office, if a user does that, the laptop 'locks' and can only be unlocked by a local/network administrator or the user that was logged into the laptop.

Because of that, I am not so terribly concerned if one of our laptops are stolen. It would be a minor financial blow, but it wouldn't be the end of the world.

Re:Wait a minute...

[jc42]

That isn't properly called "security through obscurity".

It's called a "honeypot".

There's a big difference in the security implications.

Re:Wait a minute...

[nolife]

Your method makes sense for an individual who puts more value into the physical laptop then what is stored on the HD. I don't think Wells Fargo really cared about the laptop iteself when the data on it was easily worth 1000 X more. It was nice that they got it back and found the culpruit and can now make an assessment of the damage but is making the laptop accessible to guest worth the risk to the data? I don't know. It's not like a common criminal or even this somewhat "above average" criminal has the forensic knowledge to easily defeat encryption or read data directly from a HD's platter and this was not a sting operation with fake data. Someone needs to make a risk assessment for these situations and be able to justify it when the shit hits the fan.

Re:Wait a minute...

[crashnbur]

See, this is exactly why our laptops/workstations are NOT password protected. Theft is a mild problem here (we have had some $5000+ projectors and other equipment stolen in recent years, so laptops aren't all that safe), so with that in mind, we would rather someone be dumb enough try to login using our computers so we could find them than simply invite them to delete every trace of the computer being ours.

Sure, we have an obligation to protect some of the information on some of those machines, but I guarantee you that the people in my office would be much more disturbed about stolen machines than the data on them. It's not like we work with Swiss bank records.

Re:Wait a minute...

[g0hare]

Oh, I got legal tools that would let me crack the local admin password in seconds if I have physical access. NOw, if you password protect the bios & disable boot from floppy & cd, you might have a start but again if I have physical access I know I can reset the desktops. Laptops might be harder, but I'll get there. Encrypt the critical files & remove the local admin from the recovery agents (not there by default if it's XP on ad domain member, and your data should be safe.

Re:Wait a minute...

[Anonymous Coward]

I know that if ANY of the laptops and roughly ALL of our desktop PC's would be useless to any thieves unless they format each and every machine, since there isn't a single account that doesn't have a password that isn't controlled by our Domain Controller

The thief can still get the local password and log in, regardless of network passwords.

Re:Wait a minute...

[Anonymous Coward]

That isn't properly called "security through obscurity".

It's called a "honeypot".

There's a big difference in the security implications.


I think he ment that he is the only person in the world that would actually use a lame ass buggy mac laptop, so even if someone stole it they wouldn't know what to do with it, or wouldn't want to do anything with it. Maybe they could use it as a doorstop, or as a decoration. Those things do LOOK good.

Re:Wait a minute...

[cnelzie]

IF and only IF, the thief is inteligent to know how to locate and use such tools. In this case and most other cases similar to it, the thief was/is likely nowhere near inteligent enough to have even known such tools existed.

If that thief knew of such tools, it would also have been likely that the thief would have been smart enough to know that he could easily be caught using AOL without drastically altering the laptop. He would have removed what data he thought he needed, wiped the machine, wiped the BIOS, flashed the NIC to change the MAC Address, installed his own Operating System, disabled the Intel CPUID thingy (Which is already disabled on most systems by default.) and then went off on his way.

If all of that happened, well, we wouldn't be talking about it. Of course, he wasn't that technically skilled. Soooo we are talking about it.

You can't expect all laptop thieves to have the same skills and knowledge that you have. (Note: I am not calling you a thief or even suggesting that you are someone with dubious moral values.)

Re:Wait a minute...

[leenoble_uk]

It's called a "honeypot"

So are you suggesting that the thief could get some highly paid lawyer to prosecute me for entrapment?

Well, I am in Britain, so they could probably do it with financial aid and I'd end up behind bars.

Re:Wait a minute...

[mess31173]

+5 Insightful? You've got to be kidding me. Let me guess you are fresh out of MCSE school right? If you think that your desktop/laptop is secure just because you are running XP/2000/NT you are vastly overrating the security of your OS. Try reading securityfocus.com for a couple of weeks and then get back to me rookie.

Needless to say that any machine that someone can get physical access to is not secure. Whether you like to think so or not. And all of you mods who modded this guy up are living in a fantasy world.

And FYI I work at Wells Fargo and we use Windows 2000 Pro.

Re:Wait a minute...

[IM6100]

Most people who use that option to bypass having to enter the password every time they turn their computer on have their computer situated in their home. Nobody can physically access the computer unless they break and enter. In most such circumstances it's highly unlikely their computer will be 'broken into' because of the no-password-needed feature, at least not before far worse things have happened to their property.

Security-freak geeks are on the wrong side of public sentiment on this one. People don't want nor need draconian security features on computer systems they have in their own homes. There's a notion out there that they should be chastized for lax security practices that reeks of smug zeal.

Re:Wait a minute...

[Anonymous Coward]

> worst part is this is the default configuration

In a corporate configuration (member of a Domain), Windows will require a password to startup.

Re:Wait a minute...

[cnelzie]

+5 Angry Psychotic?

Would the laptop have been 'secure' against you?

Nope. Because you have technical skill.

Would the latop have been 'secure' against this thief and most people? (Based upon the assumption that most people aren't technically skilled.)

Definately. At best, this thief should have been forced to take the stolen laptop into a computer store to have the employees there install a new Operating System. (Which probably should have gotten the thief arrested anyway.)

Why should taking that laptop into a computer store get the thief arrested anyway?

Well, a good security conscious organization would 'permanently' mark their computer systems with identifying information that is 'permanently' attached to the physical unit. Perhaps support numbers, theft reporting numbers and the like.

I know that when I used to work in a computer store and a laptop came in with such markings, I would definately contact the numbers listed on the back. Since the laptop obviously should only be supported by the corporation that issued it.

Did you just complete a degree in poor flaming? I thought so... You should take the enhanced courses that cover using your mind's ability to use logic before spouting off.

Re:Wait a minute...

[Anonymous Coward]

Does SSID linksys ring a bell...

Re:Wait a minute...

[anthony_dipierro]

Foolish? What, do you encrypt your hard drive? Because if not, your security is just as foolish against an attacker with physical access to the computer.

Re:Wait a minute...

[intermediate_represe]

The data can be obtained even without a password by someone willing enough to take the trouble of removing the hard disk, attaching it to another machine as a second drive, mounting it under any OS that can read NTFS/fat32, and simply reading the data.

Elmetarny, my dear Watson.

[Anonymous Coward]

Using a GUID or UUID you can track specific computers/users. A little more reliable than a MAC address as far as AOL's software goes (since the guy could have just changed modem/network PCMCIA cards or something). Not to say spoofing isn't a possibility, but the fucker used AOL. How likely is it he knows what the word "spoof" means?

cached Google description of GUID

Dial-up/Broadband bound to windows login?

[trystanu]

It just be something as silly as the dial-up/broadband connection being bound to a windows login through a domain server. As soon as thief logged into AOL they get a Username and Password prompt for the Walls Fargo domain. For all we know, he could've paniced and accidentally hit OK.

An invalid password for a user whose laptop was nicked from a whacky AOL IP address sure sounds suspicious to me.

so how did they get his addy?

[mOoZik]

I know they can trace the IP to a general area, but how were they able to find his street and address(even assuming they had the MAC)? Just curious, that's all.

Re:so how did they get his addy?

[Zocalo]

Logs, logs, and yet more logs. The process works like this (although not in this case, since apparently Yahoo is wrong and Krastoff actually used the original owners account):

1. Use WHOIS to find out which ISP owns the IP address
2. Get the ISP to look at their logs to determine which dial-up session was assigned that IP at the time.
3. Look at the logs for the access platform to identify the caller's line ID. This is usually the same as the telephone number, but not necessarily, and is *always* known to the remote system, even if you withhold you phone number because it's used in call setup.
4. Take that number to the Telco that owns it and look at *their* logs to give you the physical location of the phone that made the connection (or owner of the mobile).
5. Arrest the perp.

While that glosses over the paperwork, and assumes that the ISP maintain sufficiently details logs of calls and authentication, which many small ones don't, that's pretty much it.

Re:so how did they get his addy?

[Detritus]

If he used dial-up, AOL can get his phone number from Caller-ID or the telephone company's logs. With the phone number, its easy to get the name and address of the subscriber.

On broadband, the ISP can look at their logs to see what physical port was associated with the user's IP address.

Re:so how did they get his addy?

[shri]

Think Caller ID ....

Re:so how did they get his addy?

[manon]

If I'm not mistaking, ISP's have to keep the logs for several years by law (at least in Belgium they have to). That way they can still trace a cracker/scriptkiddy or a stupid thief like the one in the story months, even years after their actions.
In the federal building I used to work, we even needed to keep the proxy log (with date/time, login-id and visited sites)for 5 years... go imagine.

Re:so how did they get his addy?

[Anonymous Coward]

If you have an IP address and the cooperation of the service provider you can get access to all that information and more. *shrug*

"Hello ISP this is the Government... WE have this list of MAC addresses reported as being on stolen laptops from theft that was in ALL the papers - could you check to see if they are on your network? Yes? Great! WE'D appreciate your help in their recovery... And you can provide the phone number it's calling in from? GREAT! Does that phone number match up to where that user normally logs in from? IT DOES? GREAT! We'll get the appropriate paperwork around to you right away to get that information from you - Thanks!"

Folks, anything that the phone company provides (i.e. caller ID) is logged if nothing else for billing issues.

If it's done via a broadband carrier and connected direct to a cable modem - important information is available that way too...

Re:so how did they get his addy?

[Anonymous Coward]

In the US, the government cannot force an ISP to keep a log for any amount of time. It is illegal for an ISP to delete logs if they know they are going to be used in an investigation. But there is no logging requirement.

America's Dumbest Criminals

[DNS-and-BIND]

An identity thief...and he uses AOL?

He logs in to his AOL account, in his real name, from a stolen laptop?

Man, I would have just removed the hard drive, imaged it, and put the image up on Kazaa or Limewire or what have you. But then again, B&E at a bank was never exactly my style.

Re:America's Dumbest Criminals

[Anonymous Coward]

The B&E was done at another site, NOT at Wells Fargo. The analyst was doing research at his firm, one that Wells Fargo outsourced the work to.

what the hell?

[Anonymous Coward]

what IT idiot at Wells Fargo let users run AOL from within the corporate firewall?

stupid if you ask me.

By what right is AOL stealing personal info?

[Anonymous Coward]

Anyone prosecuted as a result of this could probably claim that the information was obtained unlawfully from the PC, unless the AOL EULA actually states that certain items of personal information will be collected by their software during login.

Read the article

[Anonymous Coward]

"Makes you wonder what sort of hooks the FBI has into AOL or other ISPs and what hardware identification is being transmitted at login."

Same old stuff, user account, billing address, name on the acount, shit you dumb fucks! Did you not read the article? Phone home stuff? Hardly, simply stupid user error from a thief. Hardware identification??? Get real. Sure it can be done, and MAC address might a part, yet you can spoof a MAC address. Come on you technoweenies. Read , Research, and stop posting drivel.

Re:Ask Slashdot

[Anonymous Coward]

US 6 5 3 4 1 2

What about the information?

[xirtam_work]

Customer information should not have been kept on the HDD of the laptop, ever!

If a company is stupid enough to store customer information as sensitive as this on an easily removable (i.e. stealable) machine it should be heavily encrypted.

Maybe if they used Apple Powerbooks and OS X they could use the 'File Vault' feature. As well as this similar features as available for Windows and Linux. What do you think?

Re:What about the information?

[Anonymous Coward]

IBM policy for example makes all the hard-disk laptops protected by a passwords on the hard-disk.

corepirate nazi execrable foiled by gnu millennium

[Anonymous Coward]

that's right. this stuff is unbreakable, & wwworks on several (more than 3) dimensions. it's a real nightmare for those involved in unprecedented evile.

creators want compensation for planet use/damage? (Score:mynuts won)
by Anonymous Coward on Friday November 28, @06:57AM (#7581317)

not really? they just want US to stop wrecking it/killing innocents.

they're not just kidding about that.

the daze of the felonous ?pr? ?firm? scriptdead payper liesense georgewellian fuddite corepirate nazi softwar gangster stock markup execrable FraUDsters, is WANing into coolapps/the abyss, at the speed of right/light.

consult with/trust in yOUR creators.... almost all of us will be seeing the light.

Spyware

[Anonymous Coward]

Makes you wonder what sort of hooks the FBI has into AOL or other ISPs and what hardware identification is being transmitted at login.

This is just the stuff you can see, in
Program Files\Aol 8.0\SysInfo.ini

God knows what's being transmitted behind the scenes. And no, I would not have been using this evil poison code if I had had any choice :(

Sensitive info deleted. And some that probably wasn't sensitive is obfuscated, but hey, I'm paranoid...

[SYSTEMGOTO]
TotalDiskDrives=TotalDiskDrives=7
DiskDrive0=DiskDrive0=Floppy Drive A:
DiskDrive1=DiskDrive1=HardDiskDrive C: FreeSpace: 2345 MB , TotalSpace: xxxxx MB
DiskDrive2=DiskDrive2=HardDiskDrive D: FreeSpace: 189 MB , TotalSpace: xxxxx MB
DiskDrive3=DiskDrive3=HardDiskDrive E: FreeSpace: 8325 MB , TotalSpace: xxxxx MB
DiskDrive4=DiskDrive4=CD-ROM Drive F:
DiskDrive5=DiskDrive5=CD-ROM Drive G:
DiskDrive6=DiskDrive6=CD-ROM Drive R:
AppPath=AppPath=C:\Program Files\AOL 8.0
AppVersion=AppVersion=AOL xx.xxxx.xxx gb (a)
Processor=Processor=x86 Family 6 Model 8 Stepping 3
PageFileUsage=PageFileUsage= 98% free
Memory=Memory=448 MB total ( 48% load)
OS=OS=Windows xxxx
Video=Video=800 x 600 , True Color (32 bit)
Browser=Browser=Microsoft IE Build 6.0.xxxx.xxxx
Multimedia=Multimedia=CD-ROM , Sound
AppSerialNum=AppSerialNum=
[STATUS]
NumSessions=NumSessions=1, 2, 1
NumAbnExits=NumAbnExits=100.0%, 0.0%, 0.0%
InstallDate=InstallDate=xx/xx/xx
OrigVersion=OrigVersion=xxxx.xxxa
SessionSpeed=SessionSpeed=32000 bps
[ERRORLOG]
Error1=Error1=23:22:22 7/20/03 Address Book Sync Checker Timeout
Error2=Error2=22:22:22 7/20/03 ABSyncError:233
Error3=Error3=22:12:33 7/20/03 You have not completely filled out this form.
Error4=Error4=21:47:24 7/20/03 The modem has reported that there is no dial tone.
Error5=Error5=18:56:28 7/20/03 Attempt 1) [Modem: xxxxxxx-SM PCI Modem on COM3] The modem has reported that there is no dial tone.
[CACHE]
CURCACHE=CURCACHE=0 KB
MAXCACHE=MAXCACHE=1024 KB
[NETWORK]
CPUMake=CPUMake=Intel Celeron
CPUSpeed=CPUSpeed=xxxx
USB=USB=Detected
NIC=NIC=Not Detected
Adapter1=Adapter1=Name: WAN (PPP/SLIP) Interface, IPAddress: xxx.xxx.xxx.xxx, SubnetMask: 255.255.255.255, DefaultGateway: xxx.xxx.xxx.xxx
Adapter2=Adapter2=Name: Realtek RTLxxxx(AS)-based Ethernet Adapter (Generic), IPAddress: xxx.xxx.xxx.xxx, SubnetMask: xxx.xxx.xxx.xxx, DefaultGateway: xxx.xxx.xxx.xxx
Plugin1=Plugin1=Name:Viewpoint, Version:xx,xx,xx,xx
Plugin2=Plugin2=Name:Direct Draw, Version:xx.xx.xxxx.xxx
Plugin3=Plugin5=Name:Shockwave Flash, Version:xx,xx,xxx,xx
[CONNECTIVITY SUMMARY]
Device1=Device1=TCP/IP: LAN or ISP (Internet Service Provider)
Device2=Device2=Modem: xxxxxxx-SM PCI Modem on COM3, Default Device, ModemSetupString: Axxxxxxxxxxxxxxxxx,x;xx4xM, PPPSetupString: , AlwaysReconnect:
TotalLocations=TotalLocations=1
Location1=Location1=TotalConnections: 3, Name: Home, Tries: 5,Current Location
Connection1 at Location1=Connection1 at Location1=Name: xxxx xxx xxxx (1) xx Customers - Freephone (V90), Tries: 1, Device: Modem: xxxxxxx-SM PCI Modem on COM3, Number: xxxx xxx xxxx, Network: AOLnet, ClientPPPReady: 1, NumberPPPReady: 1, Speed: 115200, Touchtone: 1, OutsideLine: , CallWaiting: 0, AlwaysReconnect: 0
Connection2 at Location1=Connection2 at Location1=Name: xxxx xxx xxxx (2) xx Customers - Freephone (V90), Tries: 1, Device: Modem: xxxxxxx-SM PCI Modem on COM3, Number: xxxx xxx xxxx, Network: AOLnet, ClientPPPReady: 1, NumberPPPReady: 1, Speed: 115200, Touchtone: 1, OutsideLine: , CallWaiting: 0, AlwaysReconnect: 0
Connection3 at Location1=Connection3 at Location1=Name: xxxx xxx xxxx (3) xx Customers - Freephone (V90), Tries: 1, Device: Modem: xxxxxxx-SM PCI Modem on COM3, Number: xxxx xxx xxxx, Network: AOLnet, ClientPPPReady: 1, NumberPPPReady: 1, Speed: 115200, Touchtone: 1, OutsideLine: , CallWaiting: 0, AlwaysReconnect: 0

Re:Spyware

[Moblaster]

The "DEFAULT GATEWAY" under one of the ethernet adapters could be unique "enough" to identify this computer out of many others -- especially if AOL is being accessed outside of that subnet. That may be a powerful enough clue by itself, especially if you know what you are looking for.

hooks? that's easy...

[penguin7of9]

Nothing particularly sinister. The "hooks" they have is probably caller ID on the modems. If he connected via DSL, they have the port he connected from (via the IP or MAC address). AOL is probably completely free to give out that information, with no need for wiretap authorization.

Re:hooks? that's easy...

[Anonymous Coward]

Assuming that AOL use a RAS architecture similar to the ISP architectures that I have seen, the RADIUS auth protocol has a field in the ACCESS-REQUEST packet called CALLING_STATION_ID, i.e. the phone number that was used to make the call, add that to the stolen AOL account and Bob's your aunt's live in lover.

damnit.

[fuckfuck101]

That's the last time I steal a computer to login to AIM again.

There is no story here

[Mr_Silver]

From SFGate:

Investigators knew where to look for the gear not because of unusually intrepid sleuthing but because Krastof allegedly used the computer to log on to an AOL account belonging to the system's owner, Peter Gascoyne.

Please remove your tin foil hats, the idiot logged onto the AOL account of the person he stole the laptop from. The police and AOL merely traced it back to his house.

Re:There is no story here

[trystanu]

... and even then AOL didn't help *that* much:

White said investigators had asked AOL as a routine precaution to watch for any log-ons in Gascoyne's name. He said the world's biggest online service had reported a hit earlier this month but then dragged its feet in providing information about the phone line used in the connection.

Re:There is no story here

[Vlad_the_Inhaler]

Your article contradicts the other one, quoted below.
Some of the stuff in the Yahoo one is obviously flawed, or do Yahoo allow fixed IP Addresses based on the MAC Addess? The SFGate article is more detailed and contains no obvious mistakes, but I don't understand why the fool would have logged into someone else's AOL account when he seemingly wanted to do his own home-office thing on the net. Surfing would be possible, but he seems to have had no interest in the 'you have mail for someone else' side of things.

Investigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers, White said. That enabled authorities to connect the computer's Internet Protocol address, a number that identifies a computer on the Internet, to Krastof's home address through his AOL account, White said.

A more detailed version of the article

[claq]

I found this version posted on www.securityfocus.com. It says the thief used the laptop owner's dial-up AOL account, which the FBI had asked AOL to monitor.

Re:A more detailed version of the article

[A1tha1us]

"Krastof told investigators that he had no idea the stolen computer in his home contained a treasure trove of customer data for anyone interested in ripping off people's identities." Wow, really? how suprising, when caught with a stolen laptop (for which he presumably had to go to some lengths to steal from an office (mine has cameras, motion sensors, gaurds etc)) he admits the theft (hard to deny it) but not that he intended to use the information...becuase it must of been SUCH an opportunistic crime, just happened to be walking past the building.. no idea what they do..and I tripped..stumbled past reception, up 10 floors and round a bend, where I just lent on a door (to catch my breath) and blow me if it didn't just swing open...and there on a desk was the laptop, which I admit that I stole (now you've found me with it) but all that data? which any normal theif looking for hardware would of just formatted away? nope I had nooooo idea...

oh please

[warren69]

" Makes you wonder what sort of hooks the FBI has into AOL or other ISPs and what hardware identification is being transmitted at login."

That is a bit of a conspiracy theory. It is just the PC Call Home software such as http://www.absolute.com or any of the others.

My only suggestion for laptop owners is to get the most difficult to remove laptop security software. There is none that is impossible to remove, but stuff that resides in the MBR, etc will make life much more difficult for the thief...

That's not needed

[Mr2cents]

You don't need the hardware information if you already know the owner's account name..

he did not change

[linuxislandsucks]

his Mac address and machine name.. what an idiot

Re:he did not change

[Anonymous Coward]

Wrong! It is even worse than that: as was already pointed out in many comments, he used the AOL account that was already on the machine. No need for MAC address or whatever. The thief was stupid and got what he deserved.

Re:he did not change

[Jugalator]

The thief was stupid and got what he deserved.

Yeah, as opposed to smart thieves who steal computers, won't use existing accounts, and who don't deserve to be caught.

*sigh*

a work-around for this?

[JackRabbitSlims]

Answering cnelzie I'd say that you just have to format the HD and install the OS to have a new fresh machine. But this broght me some though: 1) a fresh new install would also inform AOL the computer's MAC address? 2) does AOL maintain a database of USER_ID - MAC addresses? if so.. what for? 3)I don't believe the idea the WF keeps the MAC address of every computer the sell.. If doing so.. what for?

Used SMBIOS perhaps ?

[Anonymous Coward]

Perhaps they used the SMBIOS Serial number

SMBIOS fields such as make, model, serial number and chassis type are populated on pretty much all tier 1/2 machines these days.

SMBIOS table method extraction is really safe, really fast, non-intrusive and can be performed with basic level user access (doesn't require local administrator) on any Windows box without any resident drivers or services (unlike DMI).

Moving one step futher - The collection of SMBIOS information by a large ISP such as AOL would allow for some pretty sophisticated profiling for future service provision.

From a big brother perspective, SMBIOS will not tell your ISP your name, your credit card details or what you've been doing since your last online session.

For example, they could profile users by processor type, or memory capacity, they could even send out email offers to users who had free memory slots.

Back to the point - It would be relatively easy for ISPs to be given a 'stolen' list to compare detected serial numbers against, customers just need to use decent Asset Management processes so they know what was stolen........

I bet they tracked him down by IM

[H8X55]

Makes you wonder what sort of hooks the FBI has into AOL or other ISPs and what hardware identification is being transmitted at login.

i bet it wasn't that complicated.

fbiAgentd00d99: Yo man, what's up?
LaptopThief2310: Not much, i just ripped off some computers! HA HA WOOT!
fbiAgentd00d99: SWEET!
LaptopThief2310: Yeah I rockxxorz. Now I'm takin' a pic of me, an all the computers i stoled w/ a sony cybershot i "found".
fbiAgentd00d99: You pwn3! Send me that pic! I'm gonna put it on my website!

There we have it folks, probable cause, as well as an IP address.

Computrace Plus or similar product?

[Dynamoo]

It *might* be something like Computrace Plus which sits on a laptop and silently transmits audit information back over whatever IP network it connects to. They've got some case studies that show how the product actually works.

Basically, it's legitimate spyware. I've personally never used the product, although we are about to evaluate it.

You people are too smart

[sjasja]

You start thinking MAC address tracing and stuff.

The guy dials AOL. Opens Mozilla. Mozilla sends cookie PREVIOUS_LOGIN_NAME=WellsFargoLaptop. AOL admin greps log. Calls police. Police does phone caller id trace.

No sinister government MAC tracing conspiracy required.

Re:Password protected?

[rduke15]

Were they not running a password protected operating system, at least Windows 2000 or Windows XP?

You must be kidding, but I'm not sure.

It takes only a few minutes to change the administrator password on a Windows box with a Linux boot floppy.

Done it a couple of times (on Windows 2000), for users who didn't know the admin password.

First of all.

[Raven42rac]

First of all, what kind of idiot steals a laptop? Those things are usually laden with security software and things. Second of all, this guy is a idiot for dialing up HIS AOL account on a STOLEN computer. That is just retarded. I mean, it is tied to your credit-card number/other personally identifiable information, IIRC. Third, it is most likely an ANONYMOUS hardware identification system, like the VIN for cars, only anonymous. This does not bother me one bit, no one knows about the number until your stuff gets stolen. Good idea, that would probably cut down on insurance fraud of people claiming to have their laptops "stolen", when in reality they just kind of hide it for a while.

Re:First of all.

[gl4ss]

** First of all, what kind of idiot steals a laptop?**

of all computer equipment they're pretty much the easiest devices that can be sold easily for a fair amount of cash, used laptop prices are at ridiculous prices around here at least(almost at same prices as new! which is just silly). laptops are also much easier to steal(smaller, lighter, lugged around) than desktop equipment.

using the account was just plain stupid though, heck using the software that it got stolen with was insanely stupid.

Take off your tinfoil hat

[brunes69]

If this is anything like 95% of the windows laptops I know of, it was littered with bonsai buddy and RealPlayer and Windows Update and tons of other calling home crap. And more than likely, this bozo didn't format the PC or anything else. All the FBI would have to do is find out whats on the PC, and contact these companies for that software's unique IDs.

Not spyware. The story is much simpler than that

[Raphael]

There is no need for any "Phone Home" software or anything sending the CPUID to AOL. The story is much simpler than that and rather low-tech:

• Thief steals computer.
• Thief tries AOL account found on stolen computer.
• Account is known to have been compromised.
• Connection type = dialup = phone number.
• Phone number = address.
• Address = thief gets caught.

Nothing exceptional here. The FBI does not need any strange hooks into AOL. They only need stupid thieves. Case closed.

Because there is nobody to guard the guardians

[Anonymous Coward]

It's simple. Everybody wants thieves to be locked up, but nobody wants to live in a police state. This means that we applaud whenever the authorities apprehend a baddie, but we boo whenever they give themselves even more powers and so bring the darker possibilities one step closer. There is nobody to guard the guardians, so we defend ourselves as best we can, by trying to postpone the day when their control might become total.

The two things are directly related, inasmuch as in a police state there would certainly be much less crime, since freedom cuts both ways. What you see as a conflict is just a reflection of this inter-relationship. We have to do both if we wish to safeguard both our present and our future.

Re:Ask Slashdot

[Anonymous Coward]

Canada, 3 6 5 4 1 2

Similar Experience

[Lieutenant_Dan]

I had one of my notebooks stolen at the LA airport. I had one in my suitcase (there's only so many I can carry) because of a conference. One of the baggage handlers must have helped himself to my notebook.

The funny thing is that the notebook was my personal, and because I did travel a lot at the time, I had an AOL account for convenience. Out of a whim, I called AOL and asked them for a log of my sign-ins. Lo and behold, turns out whoever stole my notebook was using my AOL account to surf! I pleaded with the tech person to at least give me the IP address so I can track the thief down. He sympathized with my problem and passed me to one of the network engineers who was very keen on helping me. I got the IP address and the phone number that he used to dial-in. He said that the Telecom department could give me the number that was used to dial in to AOL but I would have to get law involved as certain FCC regulations prevented him from sharing that info.

So I collected all the info and sent the report to the security officer at the Airport, a copy to the LA sherrif's dept and another one to my insurance company (who I had hoped would be keen to solve the problem). After a few calls, I got nothing. Turns out that theft like that happens a lot at the LAX and the LAPD is way too busy with serious crime to investigate a crime committed to an out-of-towner.

The good thing is, my home insurance covered the theft, so I got a better model for basically the amount I paid for my notebook a year prior (minus deductible).

This was pre-2001 btw ...

Re:Similar Experience

[Lieutenant_Dan]

got the IP address and the phone number that he used to dial-in

I meant the AOL number that he used to connect to AOL, not his personal number.

Sorry.

Re:Similar Experience

[qtp]

If you had demonstrated the common decency to be a large financial institution, as Wells Fargo so considerately did, then the police would have been more than happy to help you.

The absolute gall that you demonstrated by being a lowly private citizen cannot be tollerated and our law enforcement agencies cannot and will not encourage such anti-social behavior.

Re:Similar Experience

[isorox]

LAPD is way too busy with serious crime

Like that in the UK. The Police are too busy catching people doing 80mph on the motorway to bother with the boring stuff like murder and gangland shootings

Re:Similar Experience

[Anonymous Coward]

Damn right... it should be ILLEGAL for private citizens to use law enforcement and judicial services.

These services cost big bucks, and should only be used for serious matters of corporate significance.

Re:Similar Experience

[bluGill]

Remember that next time you vote... Not sure what you can do about it, I'm not nessicarly fond of tough on crime canidates. At the very least next time someone brings up tough on crime you have some tough questions to ask. (Why isn't my crime important. As compared to speeding and so on...)

Re:Similar Experience

[crashnbur]

...the LAPD is way too busy with serious crime to investigate a crime committed to an out-of-towner.

It's sad, really... but police officers have essentially been reduced to insurance claims officers when it comes to theft or vandalism. Unless someone is in clear and present danger, the police often can't or won't act because there is just too much crime.

I read a sociological report about persons who have committed felonies recently, and the results shocked me. The statistics in particular that got my attention:

Of all the grand theft (generally $500+) that occurs in the US, only 6% of it is even reported.

Of all the grand theft that is reported, only 1% of the thieves are ever caught.

Of course, you have to understand that sociology isn't the most exact science in the world, and that these stats most likely include career thieves who only get caught once. I guess you can tell any story you want if you've got the stats to back it up.

But still, according to these numbers, 99.94% of all thefts of $500 value or more are lost causes for the theft victims, because either the thieves are too good or the police forces are not good (or willing) enough to catch them.

Re:Similar Experience

[Anonymous Coward]

After a few calls, I got nothing. Turns out that theft like that happens a lot at the LAX and the LAPD is way too busy with serious crime to investigate a crime committed to an out-of-towner

the sad part is we all (err americans at least)pay for the police dept with our taxes. However the police always take this for granted. Sure wells fargo gets their laptop back, but they don't give a shit about you. Think about that the next time you see a cop sitting around doing nothing. It's sad example of how our criminal justice system is failing.

Re:Similar Experience

[Skyshadow]

If you had demonstrated the common decency to be a large financial institution, as Wells Fargo so considerately did, then the police would have been more than happy to help you.

In fairness, this laptop represented a pretty serious amount of crime potential.

The laptop was stolen from a Wells Fargo contractor, and if contained a whole mess of Really Important customer data (social security numbers and what have you) that would have enabled any halfway competent identity thief to get all they needed to start opening credit lines.

The real issue here (which nobody's talking about) is how can Wells Fargo get away with this? Seriously, they left a mess of Real Important confidential customer data unencrypted on a highly mobile computer. Talk about negligence! This'd the the same as if they had customers dropping their night deposits into a large suitcase they left outside the front door of the bank (except in that situation all you stand to lose is one deposit).

Is it so much to ask that institutions who have our Really Import Data take some basic steps to protect it? This whole thing could have been rendered moot with something as simple and easy as an encrypted filesystem.

But nobody, nobody is talking about it. So they'll continue putting customer data on laptops, HMOs will keel putting patient records on tablet PCs or shipping it overseas for testing or whatever... I wonder what it'll take to change it...

Re:Similar Experience

[_Sprocket_]

Is it so much to ask that institutions who have our Really Import Data take some basic steps to protect it? This whole thing could have been rendered moot with something as simple and easy as an encrypted filesystem.

But nobody, nobody is talking about it. So they'll continue putting customer data on laptops, HMOs will keel putting patient records on tablet PCs or shipping it overseas for testing or whatever... I wonder what it'll take to change it...

Hey now. Wells Fargo did put out a memo that may have something to do with this case. Obviously, its all been covered and taken care of.

Or not. As the article implies.

Re:Similar Experience

[IM6100]

The only social risk that 'gangland shootings and murder' represent is that decaying dead bodies of gang members represent vector points for the breeding of virulent bacteria and disease. If those folks killed themselves all off cleanly without leaving decaying bodies, I am sure the police would be none too pleased. It's a waste of police resources to try to prevent, or arrest the perpetrators of gang-on-gang crime. Let 'em rip free and wild and let Darwin do his work. Pinch the most successful 'winning' killers after they've cleaned up their underworld for us.

heh

Re:Similar Experience

[Ath]

Sorry, but that's not my experience with LAPD. Perhaps that was because I was a resident. A couple of years ago, someone broke into my house in LA and stole my computer. LAPD, surprisingly, even came out and dusted for fingerprints. My reaction at the time was a bit of shock, as I never expected such "service" for a $2000 theft in LA.

I think that police departments in big cities don't have an automatic reaction as to how they deal with such situations. It seems to be luck of the draw on who is willing to take the time.

Re:Similar Experience

[Thng]

common decency to be a large financial institution

Oh get over it. It's probably not about getting their $2000 laptop back... that laptop probably had lots of nummy information about people... names, addresses, SSNs about lots of people.. oh, people kind of like you, probably. This theft could have been a lot more than $2000, when you realize that the kind of information possibly stored on there is worth much more than some crappy laptop.

Re:Similar Experience

[qtp]

It's probably not about getting their $2000 laptop back

But that is the isue to the individual who owns a $2000.00 laptop. And who's to say that what is on the disk of that individual's laptop is not worth more than the $2000.00 in insurance he might have on it. Especially if he is at the end of a long business trip, he might also have the same kind of sensitive information, or perhaps several hours of his own work that he has not yet backed up (I know, that's his fault, yadda yadda...).

The issue I'm addressing is that the protection provided by law enforcement is not equal. Law enforcement is more than happy to go out of thier way to provide services to companies, celebrities, and upper-income individuals, but if you are a working stiff, chances are that you're shit out of luck unless you could fork over the bucks for piddly insurance that will be hell to collect on and only covers the materials lost, but not your lost work.

Re:Similar Experience

[kettch]

I have seen some companies get these for their laptops. You put the plate on the laptop, but I prefer putting the red deterrant on the outside of the laptop bag itself. Otherwise they grab your bag, walk off and when they see it has a id plate, into the dumpster it goes. With the red label on the outside hopefully thieves will be put off by it.

Of course there is the BOFH method: Faced with never seeing the laptop again, have something that looks like a CDROM drive in one of the bays. Embed in it some explosives and some cell phone parts. If it goes missing, and isn't quickly recoverable, simply make a quick phone call. I guarantee that particular thief won't be stealing any more laptops (or eating solid foods).

Re:Similar Experience

[Anonymous Coward]

This would never happen if Wells Fargo Migrated to Powerbook G4's running Mac OS X 10.3.1. They just have to turn on filevault and voila their home directory is encrypted, so that if they get their laptop stolen no big deal data is encrypted.

Re:MAC addresses? WRONG!

[Anonymous Coward]

You are wrong. Read the story and the many comments posted here: the guy was using dial-up with a stolen AOL account. That means no MAC address, but a phone number instead. And a phone number means a home address. Then he got caught. What a surprise!

Re:Get over it - This is NOT about privacy

[Anonymous Coward]

Did you read the article? There is nothing related to privacy in this story. No stealth software allowing the laptop to be traced. It is much simpler than that: the thief used the AOL account found on the stolen computer and connected to AOL using his own phone. The phone call was traced back to his home, and then he was caught.

There is no story, and no real need to bring privacy into the picture. Sure, all you wrote is true. But it is irrelevant for this story.

am[a|u]zing how far speculations can go...

[Maresi]

...when almost nothing is known about a topic...

(I dont want to be Jacko at the moment =;-D)

User account data on the guy's laptop??!!!

[Cragen]

A subject not considered yet is the idea that the guy had sensitive customer data on his laptop. Why is that not immediately considered a problem by everyone? Especially by Wells-Fargo security people? I am not a security ace, but when did that become ok? *cragen

Re:hardware ethernet addresses - WRONG

[Anonymous Coward]

You should read this comment or that comment. Both of them explain what happened. No MAC address involved.

AOL Likely Got a Subpoena; No Need For Paranoia

[reallocate]

Contrary to the Luddite tone of most reaction here, I suspect the only "hooks" the FBI had into AOL was a subpoena. I lived for several years near AOL in Loudoun County, Virginia. Law enforcement officials looking for info from AOL routinely sought subpoenas from judges in that jurisdiction. Sometimes they got them, sometime they didn't.

Of course, AOL can tell that a customer is dialing in from a computer with legitimate AOL account info and software on it. If a court tells them to, they'll record that info and release it to the people who got the subpoena. This time it was the FBI. Next time, it might be you and your lawyer chasing down someone defaming you online.

The assumption that the FBI has "hooks" into AOL is simple bush-league cynicism from the wanna-be poseurs. Why would anyone decide that it's wrong for AOL not to help capture this thief?

Re:AOL Likely Got a Subpoena; No Need For Paranoia

[Alsee]

I suspect the only "hooks" the FBI had into AOL was a subpoena.

That isn't the issue. The Slashot story erroneously reported that this guy logged into HIS OWN AOL account. Lets pretend the story was correct. How could the police have known that the thief had an AOL account? How could they have known he logged in? How could they have known which account belonged to the thief?

The police can subpoena AOL until they are blue in the face getting information on umpteen-million AOL accounts. It does them absolutely no good unless they they already know what information they need to ask for.

In this case the thief logged into the owner AOL account. The police subpoena's the owners account information. If the thief logged into his own (and UNKNOWN account) then he's just another random AOL account. The ability to do that would potentially raise signifigant privacy and tracking issues.

-

Re:AOL Likely Got a Subpoena; No Need For Paranoia

[reallocate]

It was obvious the /. story was wrong. Slashdot -- which trumpets its unwilligness to use editors and do basic fct checking -- seems to be run by 12-year-olds for 12-year-olds.

Even allowing that, it isn't necessary to imagine the FBI going on a fishing expedition. Why get paranoid imagining all sorts of terrible things prompted by a bogus piece posted on a website pretending to engage in journalism?

I don't see any privacy issue here. Some guy has his laptop stolen. He reports it to the police. Police collect info about the laptap, including the fact that there's an AOL account on it. He calls AOL and tells them his laptop with a configured AOL account on it has been stolen. AOL gives him a new account, keeps the old account open but puts a flag on it. Sure enough, the thief tries to use the laptop to dial in to AOL. The flag goes up, and email is generated to some AOL security officer, and pretty soon everyone knows where the laptop is.

In fact, there's probably no need for a subpoena, but it seems to me that knowing the stolen laptop was configured for AOL does justify getting one in the unlikely event that AOL refuses to volunteer the info. The police would simply request notification if the laptop account was used and the phone number used in the attempt. It's analagous to tracking use of a stolen credit card.

Re:AOL Likely Got a Subpoena; No Need For Paranoia

[IM6100]

It's more accurate to say that Slashdot is run by trolls for trolls. There's lots of banner revenue in trolling suckahs, ya know.

Slashdot is at best neo-yellow journalism.

Re:AOL Likely Got a Subpoena; No Need For Paranoia

[sfjoe]

I don't think "Luddite" is the word you wanted to use.

Re:AOL Likely Got a Subpoena; No Need For Paranoia

[Danny Rathjens]

Getting a subpoena is apparently not a big deal anymore since they no longer need a judge to issue one:
Congress Expands FBI Powers

Those darned checks and balances are always getting in the way.

Re:AOL Likely Got a Subpoena; No Need For Paranoia

[grozzie2]

Lets pretend the story was correct.

Why pretend it's correct, when it's NOT? That's called 'manufacturing the news', and it happens all the time. The latest craze in news manufacturing is the online poll by sites such as cnn etc. They run an online poll with some stupid question like 'do you think xxx is guilty?'. Then, they tally up the results, and report it as fact.

Public opinion is easily molded, especially when the public is a clueless public. This story and it's commentary here on /. just goes to show, joe average gets his 'information' from the headlines, and the headlines are often just blatantly WRONG. /. is supposedly a home for intelligent geeks. Amazes me how many of those supposed geeks are totally clueless about simple things like mac addresses and networking, goes to show just how uninformed the masses really are.

Pretending that a misrepresented news item is correct accomplishes nothing but the sale of more tin foil hats to the clueless. The world would be a much better place if that energy was instead spent on doling out clues, rather than preying on the lack thereof. The cluestick is a powerful beast, but sad to say, society today seems to be driven totally by the fact that the masses have never reached into the cluebox and actually grabbed one, and those that have a few to spare seem to be hell bent on keeping them, rather than pass a few around and make the world a better place.

Re:AOL Likely Got a Subpoena; No Need For Paranoia

[Anonymous Coward]

Please stop saying "joe average". It makes it sound like you are trying to be clever (pretentious).

Re:AOL Likely Got a Subpoena; No Need For Paranoia

[Alsee]

Why pretend it's correct, when it's NOT?


Because I was answering the parent poster. I did point out the story was wrong, but still I wanted to answer his post. If the story was correct (as he thought it was), then I wanted to explain why it was an issue.

Don't yell at me about it, I DID point out the story was wrong. Lousy waste of time story. But based on what was written there was reason for people to think there were legitimate concers.
-

What Kind Of Moron?

[Anonymous Coward]

What kind of moron steals a computer, hooks it up the internet without first 1. formatting it. 2. installing a firewall. 3. resetting the rule on any installed firewalls to only allow certain programs you know access to the internet. 4. uses someone elses account when it's just as easy to get a "new" account with AOL 5. uses AOL 6. Does it from their home. You would think that if this dipshit did this stuff for a living he would be better at it. Maybe he was fired from his job at the RIAA.

Re:What Kind Of Moron?

[Crash Gordon]

What kind of moron steals a computer, hooks it up the internet without first...

An "arrested" moron, apparently.

Several cans of worms....

[TygerFish]

No matter how the guy was caught, simple or complex, the fact that the story comes up at all opens several interesting cans of worms.

We give ourselves, our populace and our government, a lot of credit. We walk down the street trusting people we wouldn't let drive our cars to make an intelligent decision on who should enjoy personal control over a powerful army and a large nuclear arsenal.

We live under a government made up of mostly of obscure appointed functionaries. During the last election, John Ashcroft was a man so despised by the people who best understood his personality and performance, that his first contribution to U.S. history was losing an election to someone the electorate knew to be deceased. Michael Powell first broke the surface as chairman of the FCC by vociferously supporting measures to further consolidate ownership of America's broadcast media.

We trust faceless strangers to *NOT* use terrorism as an excuse to pass nasty laws that sidestep the principles which define us as a people.

Now, it is perfectly possible to imagine that the person who stole the laptops was the kind of (darwinian) mastermind who *would* log on to someone else's AOL account, using their stolen computer from their home connection and leaving us to ask, 'Hey, why not just turn yourself in...?'

Be that as it may, as some pieces here and elsewhere have shown, at all levels, governments are happy to adapt law and technology to purposes that civil libertarians dislike with good reason. This time it was nothing, but one day, it could very well be something that makes us all wish we could go back to telephones and paper.

The point that started this thread might very well be moot, but unless you are completly satisfied with whom we have in office and whom they have appointed to positions of power most of us are scarcely aware of, you have to wonder what things will be like when things are different.

Re:Several cans of worms....

[praksys]

...John Ashcroft was a man so despised by the people who best understood his personality and performance, that his first contribution to U.S. history was losing an election to someone the electorate knew to be deceased.

Ashcroft was leading in that race until his opponent died. All this story shows is that the only Democrat who can get elected these days is a dead one.

Re:Several cans of worms....

[IM6100]

Thank goodness Paul Wellstone's corpse didn't win.

Real Lesson: Stupid Laptop Thief

[reallocate]

It seems this guy used an AOL account already set up on one of the stolen laptops to dial in to AOL. All AOL had to do was check the records for that account to identify the telphone number used to make the call.

This is equivalent to stealing someone's credit card, using it to fund a trip to Las Vegas, and being surprised when the police knock on your hotel room.

IPspoofing

[unic1]

Time to start using IP spoofing. Even if your on a Windoze you can do it thanks to raw sockets.

Re:IPspoofing

[Predius]

Spoofing doesn't do you any good when my network has anti-spoof filters on all edges. : )

Fortunatly for the world, the number of networks doing the same is rapidly increasing.

True...

[jonr]

This is the first thing that popped into my head. What the hell was the employee doing with sensetive client customer data on his frigging laptop? With a AOL client software? If I were his boss, he would be hearing some well chosen words from me...

Re:True...

[fuzzybunny]

That's not uncommon at all (although yes, I agree with your likely reaction, that it is questionable.) A lot of banks have client advisors who visit customers, roaming users, etc. In fact, although this doesn't really apply to Wells Fargo, a lot of international private banks maintain some extremely sensitive information on laptops.

The logic behind this is that, if Mr. Rockefeller wants to look at his accounts, Mr. Rockefeller does not stand in line at a counter; he is either picked up at the airport and given whiskey and cigars in your plush office while your assistant takes his wife shopping on Bahnhofstrasse, or you fly to Mr. Rockefeller's mountain ranch to discuss his finances with him and his accountants.

A lot of the tech you see for securing and obfuscating data on laptops (biometric ID, chipcards, boot sector HD encryption, etc.) comes out of this sort of requirement--it's a big reason why the UK's plan to install 'data suckers' at airport customs, which would vacuum all info off your hard drive to look for things like kiddie porn, died a very silent and quick death when it was proposed.

So, note that it's not mentioned what additional security mechanisms actually exist on their machines, although given Wells Fargo's typical customer demographic (not many Mr. Rockefellers, I assume) I wouldn't bet too much money on them having put too much thought into it.

The guy deserved to be caught

[Anonymous Coward]

The guy obviously didn't know what he had, he didn't steal it for the information.

More likely in real world...

[badzilla]

Company goes to police, police call ISP and demand info. ISP refuses, citing numerous data protection laws. Police remind ISP that hey we're the police shithead and by the way looks like your car's illegally parked. ISP caves in and gives info.

Still it's amazing that the computer actually was recovered, I can't honestly imagine myself being taken seriously when reporting a theft then trying to explain how IP address tracing could help.

Re:More likely in real world...

[Anonymous Coward]

What's more likely to happen is this:

Company goes to police, police go to judge, police go to ISP with court order, police seize laptop and throw it in impound, "process" crock (detain, fingerprint, release), Fred gets his laptop back 3 years later. Fred says, "Oh you fucks, if I had known it would've stayed stolen I'd have let the thief keep it!"

Re:One more argument for adoption of open standard

[larien]

Er, I'm all for due process and privacy, but I don't believe this is an issue here. I'm pretty certain the laptop had something on it saying "By using this computer you are acknowledging to have actions logged" etc and likewise for AOL. In short, he received due warning (legally) that his actions would be logged. There's nothing in that which isn't "open standards" and I fail to see the link here.

In relation to setting him free, I've heard of at least one case where someone walked free from a murder case due to the DNA evidence being invalidated; the DNA sample the police used to track down the killer was held longer than it should have been. In short, the guy definately killed someone, but legally the police shouldn't have been allowed to present the DNA evidence which convicted him (IIRC, he got off on appeal). Is it fair that a murderer walks free because police kept evidence for too long? Procedures are all well and good, but in my mind, justice should override that.

Do this with yahoo auctions

[adzoox]

I have done something similar with yahoo auctions. At auction end I type the seller's name into my IM client. It registers that name under all IM clients.

I always request a phone number and email address if I pay by Paypal or PayDirect. If they don't give it to me and I can't validate it, I don't send the money.

I have sent money in the past; rather blindly. I have been able to catch two sellers by just pretending to be girls interested in them, through IM. I got their actual phone numbers and even got one ready to pick me up and meet me for a "date" LOL.

Of course it was a lot of hassle.

If you can catch a criminal at their own game - that's justice.

I wish eBay wouldn't have eliminated the contact information request without having a transaction with the othert party. Most sellers that cheat me on Yahoo, also have aliases identical on eBay.

Re:Do this with yahoo auctions

[Anonymous Coward]

Use postal money orders and postal insurance when paying for auctions whenever possible. I've never had a problem going that route though there was one 'close call' that turned out OK nonetheless....

That way, if you get ripped off and the perp cashes the money order and does not send the stuff, you should be able to get a refund (via postal insurance) and file a complaint against the seller for fraud. Then let the postal inspectors take care of the perp in due time...(their plate is full too ya know--with chain letters, postage fraud, and whatnot).

They should talk to the MPAA

[Anonymous Coward]

Imagine the look on a 14-year old filesharer's face when they're computer announces "you've got jail!" immeadiately after they install Kazaa.

sed -e s/threw/through/g your_post

[pr0ntab]

nt

Easy, but posts don't include bios info

[Anonymous Coward]

The guy that was caught was caught because like most criminals, he's stupid.

What none of the level 3 or higher posts have mentioned in all the theories flying about is the phone home (to bios manuf I think) that the bios' in most laptops have now.

Don't remember how it works, but the bios has the ability to alert the bios manuf or a third party automatically as soon as connected to the internet after being stolen. From what I remember reading, it may not even require owner intervention to enable the phone home feature. Maybe just notify manufacturer that laptop is stolen?

Sorry, don't have the article. I read this about a year ago somewhere online discussing the bios' from several manufacturers having this ability.

A reason to configure dynamic DNS

[Emperor Skull]

We configure the built-in windows dynamic DNS for all of our systems. If someone steals it and connects it to a network without bothering to reconfigure, their IP address will show up in our DNS logs. WINS works the same way. Not perfect, but free and easy.

ES

- If I had all the money I spent on cars, I'd spend it all on cars.

AOL spy agency :)

[braddeicide]

AOL logs your thumbprint if you use the thumbpad mouse :P And this microphone hole in my monitor is really sampling my breath or somthing.

when thefting a laptop from your work.

[Anonymous Coward]

insert win98 boot cd
format c: /u
install windows ME or 2000 or XP PRO CORP

sell quickly.

"You've got jail"

[trance9]

I bet the machine had some email software on it (Outlook?) that checked for new mail once an internet connection was available. The mail server logs would show the IP address.

Re:"You've got jail"

[Anonymous Coward]

I work for WF but do not mean to represent my employer here. Your answer pretty close to right on. Our network logs ALL accesses, but of course denies access to our intranet from the internet at large. Ergo, any request in the access log (like when OutLook tries to connect to our mailserver, for example)that originate outside the intranet are automatically red-flagged. Requests to certain ports within our network are a more serious red-flag as it indicates someone is starting internal application from outside the intranet. IPs are logged, tracert to AOL, have FBI get AOL's access log to match temporary IP/date/time to originating login... not exactly rocket science, folks... There are other applications that as a matter of operation 'call home', so really the moral of the story is that it is a dumb idea to steal computers from work unless you really know how the computer is configured.

Re:"You've got jail"

[Anonymous Coward]

the moral of the story is that it is a dumb idea to steal computers from work unless you really know how the computer is configured.

I'm not a criminal, and I have no aspirations to be one, but I came away from this story thinking that the moral was, "If you steal a computer, don't let it connect to the internet until you've sanitised the software."

Re:"You've got jail"

[grolschie]

To the pc thief: fdisk is your friend.

Re:"You've got jail"

[Anonymous Coward]

Ergo! Concurrently! Vis-a-Vis!

Re:"You've got jail"

[Krashed]

It isn't that there is call home software installed on the computer. Something like Microsoft Outlook could have triggered the alarm. It was set to connect with the outlook server automagicaly. When it did, it set off a red flag because a computer accessed a protect server/port on the intranet from the internet. It came from AOL because when the computer connected to the internet through AOL, Outlook began to connect to the server. WF just had to give info of when and what ip and then AOL can look in their logs and see which one of their users was on that ip and that time.

I don't get it

[jester42]

This story sounds just too weird for me. First of all there is a bank that stores sensitive customer-related material on a laptop. How can this happen in the first place? Why would anybody do this?
And how can you let that computer get stolen? Since when do people leave sensitive stuff open in their offices? Why not simply lock it away?

Second, how can that thief still use the laptop? Because When you really have to store sensitive data on such a machine, you would do everything to secure this machine, right? At least strong Passwords in the OS and the Bios...
Or maybe that user was logged in when the laptop was stolen? That wouldn't make the situation much better though.

Also, would you install Internet Dial-Up on a machine that carries sensitive data? I don't think so. The news post aren't really clear in that matter, but if it was the private account of the notebook owner, then i ask myself again: 'How can this happen?'. How can a company allow personal internet dial-up on a computer with sensitive data?

And then why in the world would anybody use a dialup-account on a stolen computer? That's just so stupid...

Anyway, my impression from this whole story is that the guys at WF did a sloppy job in securing sensitive data and had more luck than they ever deserved in finding that thief.

Moral of the story...

[artemis67]

Set your ISP account to remember your password on your laptop; it's your best chance of catching a thief.

Aren't you paranoid?

[Anonymous Coward]

Why do you think that AOL is spying you? What about this very simple scenario:

• Victim reported to Police that laptoop was stolen; victim informed the Police his nickname on AOL
• Police contacted AOL to notify them when an AOL user with victim nickname goes online
• Thief turn laptop on and AOL client goes online automatically, when Windows starts
• AOL proceed as instructed and inform the Police the IP of the stolen laptop
• Police identify ISP that owns that IP and with the help of ISP determine the location of laptop

Re:Aren't you paranoid?

[Simple-Simmian]

I agree with what you pointed out except that you susbstute Wells Fargo Bank for the Police and you can bet your ass AOL was looking for activity on from the stolen computers.

no warrant needed

[js7a]

Fred sets his laptop up to log into AOL with a default account and password. The crook seals the laptop. Fred calls AOL asking what ANI-reported telephone number his account has logged in on since the theft. AOL tells Fred the phone number. Fred reports the number to the cops. The cops get reverse directory information from the phone company (without a warrant unless the number is unlisted.) The cops ask Fred to ask AOL to inform the cops upon the next login. The crook logs in again. AOL calls the cops. The phone numbers match. Cops bust down Crook's door without a warrant because they have knowledge that a crime is taking place. The crook is busted.

Re:no warrant needed

[snake_dad]

I'm not an American, but I'd think that "AOL tells Fred the phone number." would not happen without some kind of warrant.

Re:no warrant needed

[gl4ss]

yes the proper&probable course of action would be that the police get a warrant and then the police asks for the information from aol(there's no need for fred to act as an extra hand here).

of course unless you're a dmca applying big entertainment guy.

Re:no warrant needed

[js7a]

It's Fred's account. No law prevents AOL from telling Fred what number his account has logged in from.

I used to work as 3rd-level tech support at an American ISP, and I'd guess at AOL it is probably policy to divulge ANI phone numbers upon request when an account is reported compromised, as long as the caller can recite their credit card number or some other form of verbal ID. I bet AOL helps owners and cops find at least dozens of stolen laptops each year this way.

Re:no warrant needed

[jrumney]

Its his account. I'm not American either, but in Europe, companies aren't just allowed, they are obliged to give you all information they hold about you, which in the case of an account which only you are legitimately allowed to log into should include the last phone number you dialed in from.

Re:no warrant needed

[Anonymous Coward]

Earthlink (a far superior ISP to AOL) won't tell you phone numbers you wring in from. I had this happen to me once, where the bill said that for one minute, my account had been used from two different places. I called them to ask about it, and asked "what was the other phone number?" The guy said that he couldn't tell me because they weren't allowed to give out that sort of information.

Re:no warrant needed

[cas2000]

> It's Fred's account.

yes, it is Fred's account. but it's not Fred's telephone number.

this may seem like a silly distinction to make, but there are some circumstances where it is essential - e.g. ex-wife or ex-husband still sharing an account (stupid, but it happens) and not wanting their ex-spouse to know where they live or what their phone number is. more likely is ex-husband ringing ISP and just asking for the list of phone numbers used by his ex-wife's account.....or just anyone ringing the ISP and claiming to be a customer and asking for the list of phone numbers.

There's no way for the ISP to know the circumstances or the truth in any such request, so they should as a matter of policy if not law refuse to provide any such details without a court order or search warrant. at the most, they should refer the caller to the relevant police/law-enforcement authority.

> No law prevents AOL from telling Fred what
> number his account has logged
> in from.

depends what country you're in.

In Australia, at least, it is the CALLER's privacy that needs to be protected, regardless of who they are claiming to be when they call - this applies whether the phone call is voice or data.

In Australia, the Telecommunications Act has stiff penalties (including gaol time) for breaching privacy - the only safe answer for an ISP to give a customer when they ask for a list of phone numbers used to dial in to their account is "please contact the police, that information can only be given in response to a court order or search warrant".

personally, i think that's a Good Thing.

Re:no warrant needed

[smchris]

Well, in the U.S. companies are obliged to give all information about you to the government if they ask and obliged _not_ to tell you about it.

That's why we're so "free".

Re:no warrant needed

[JoeError]

Or how about this one, Police, being smarter than given credit for, know whose computer were stolen and a general idea of what was on them, and call aol and say "Fred", or rather "Peter Gascoyne had his computer stolen from work, when his AOL account gets signed on give us a call." That being said...

"SBC and AOL privacy policies both say information can be shared with law-enforcement officials." - LAZARUS AT LARGE, "Arrest in Wells Fargo data theft Net surfing tips cops to stolen computer, customer records" - San Fransisco Chronicle / SF Gate - [http://www.sfgate.com]

and again

"White said investigators had asked AOL as a routine precaution to watch for any log-ons in Gascoyne's name. He said the world's biggest online service had reported a hit earlier this month but then dragged its feet in providing information about the phone line used in the connection." - Same Source

Maybe it isn't perhaps guessing on how they may have gone about getting this information but just not trusting one source, that repeated a generic Associated Press story as many papers have. Maybe alls it takes is a quick google here or a quick lexisnexis there to come up with all the information needed to stop our little minds from concocting more "Fred" theories.

Oh yea, and the same source also reads,

" 'We ended up taking a while with search warrants,' White said. 'Part of the difficulty was the lack of cooperation among various entitis.' "

So I guess search warrants were needed. But the thing that matters is they got em, right?

Re:no warrant needed

[Anonymous Coward]

Oh, look at me! I know what ANI means! I'm a fag!

ZoneAlarms!!!

[Anonymous Coward]

ZoneAlarms Bitch! The new ZoneAlarms uses GPS in case your computer is stolen!!!

Re:Password protected?

[jester42]

true, but what about BIOS passwords? And then again why would that thief be smart enough to get the passwords but smart enough to avoid somebody elses AOL account?

Re:sed -e s/threw/through/g your_post

[PReDiToR]

Its ok to point out the mistake, IMO, but FGS, tell him what he is doing wrong.

If he never took the time to do highschool, is he even going to bother looking up why you advised him to change the word?

Grandparent:
Threw is the past tense (means you already did it) of throw, as in PReD threw a brick at the parent.

Through means to pass between the inner restrictions of something, as in go through a tunnel.

No, that's OK, don't mod me up +5 informative, I don't need the Karma, but all donations are gratefully accepted.

Re:Not spyware. The story is much simpler than tha

[Lars T.]

But he used his own AOL account.

99% clueless techie-wannabees

[Anonymous Coward]

First, hat's off to all who don't know and say so, or simply state it. It's OK if you don't know your NIC's vendor ID/prefix by heart, or if you can't dissect the IP header without a reference.
Really.

To the rest: Offering complete goofball theory after complete goofball theory, briefly resting only to scream 'violation of privacy' then going back and suggesting another goofball theory impresses nobody. CPUID/NIC MAC/Windows/Office/[you-name-it] identifers or serial numbers are not immediately accesssible just because you have a PPP sesion going over your modem. If a phone-home feature was installed, then fine, but that's a completely different story.

Another hilarious example was the the default-route theory, which someone suggested as a 'dead giveaway' to the feds. Hello!? Even if the routing table was accessible, routes associated with a NIC wouldn't be *in* the table unless the NIC was active, and the setting would only be visible in the registry, not typically accessible to the world, nor routinely queried by an ISP. And never mind the statistical probability that a corporate NIC is configured for DHCP, thus it wouldn't have a default route to begin with.

I simply can't believe the amount of idiotic pseudo-techies posting and feeling BIG because they could incorrectly apply page 254 of the MSCE prep guide to formulate a crackpot theory.

Bleeeeeeeeeeeechhhh.

Re:99% clueless techie-wannabees

[drakyri]

No, no, no, it's on page 255 of the MSCE prep guide.

D'oh.

Re:99% clueless techie-wannabees

[azuretek]

Thanks for pointing that out!

I thought I was the only one angered by all the stupid insane theories as to how it happened!

Seriously, this really proves that the slashdot crowd isn't much more than a bunch of "hacker" wanna be kiddies that want to look cool because they read slashdot..

sometimes these posts make me want to scream... the only thing that stops me is the looks I'd get from my coworkers..

Re:99% clueless techie-wannabees

[really?]

yeah. It's why I read Slashdolt(sic.) at home.During the day. With the radio blasting. ;-)

Re:99% clueless techie-wannabees

[mcknation]

So you are new here aren't you? Welcome to Slashdot.

McK

Re:99% clueless techie-wannabees

[Anonymous Coward]

I simply can't believe the amount of idiotic pseudo-techies posting and feeling BIG because they could incorrectly apply page 254 of the MSCE prep guide to formulate a crackpot theory.

But that's what /. is, my friend.

Re:99% clueless techie-wannabees

[Anonymous Coward]

(Parent is mine) Yep, it was driving me nuts, above-average score on the Dumb-o-meter today.

"Using the default account and password stored on a machine seems stupid at first, until you consider that the guy had ID theft equipment"
Err?

"Yeah but the only mac address they'd get to see would be for the PPP adapter which im not 100% sure how they get assigned I guess their custom login software could be sending it though... "
Hmmm....

ISPs usually knows ARP address of computers (network interfaces actually) that are connected to their gateways because DHCP-servers are caching them. I don't have details about this but I'm pretty sure about that DHCP stuff. So one doesn't have to know MAC address, just IP address and that's enough.
Oooooooh....

But the winner of Most Roundabout Way Of Catching A Thief is.... [drumroll] :
I'd bet AOL and its "partners" use cookies to track users and target ads. If the former owners give the FBI their account info such as an AOL account name then they should be able to pick up the cookie trail and follow the ip address to the phone line"

Stunning ingenuity! You have the account name, but it can't be that simple. Oh no, just to even the odds you forget the account name and instead track those evil (see, see! privacy no more!) ad cookies, held by a third party, which ultimately leads you to... a phone line. Wow.

"Officer, I want that phone line arrested, immediately!"

contractor

[js7a]

The laptop and its data was stolen from a contractor, who probably didn't have Entrust (or whatever) data encryption which is standard for corporate IT at financial institutions. It was probably just an ordinary personal laptop, or a loaner without Entrust activated, and Wells' only protection for the data was an ordinary NDA, which was probably adhered to by the contractor as long as he, for instance, "held the confidental data in the same confidence and with the same protections afforded contractor's own most confidential information."

I predict bank contractors all over the country are learning about Entrust over the next few weeks. It's like cfs, only under Win32 and with likely backdoors and corporate centralization of administration and key escrow and big brother (anyone's management chain can gets summaries of all their underling's files updated whenever they touch the server e.g.)

Re:Not spyware. The story is much simpler than tha

[Anonymous Coward]

mod parent up.

Re:Not spyware. The story is much simpler than tha

[rlowe69]

• Thief tries AOL account found on stolen computer.
• Account is known to have been compromised.

Yeah, not quite. It says that he used his own account. So it's not like the FBI is looking for a specific AOL account to be used and then tracking it.

More likely is that there was a seperate piece of software "phoning home" over TCP/IP, giving the FBI the IP address. They know it's AOL at time yadda yadda and AOL gives them the number that was used to connect to the service, which gives the address.

Still a lot of help from AOL's needed. We can only assume they had a court order or something. What happened to ISPs protecting user's identities?

I think I know her...

[plover]

According to the article at sfgate: Doreen Woo Ho, head of Wells' consumer credit group, said the bank would "prosecute to the fullest extent of the law" now that a suspect is in custody.

I think I fragged someone yelling "Woo Ho" yesterday in America's Army... don't think they were named Doreen, tho...

It isn't that simple.

[AtOMiCNebula]

* Thief tries AOL account found on stolen computer.

He didn't use the AOL account on the stolen computer. He used his own AOL account. That's why people are concerned.

Re:It isn't that simple.

[Anonymous Coward]

> He didn't use the AOL account on the stolen computer. He used his own AOL account. That's why people are concerned

RTFA. He logged into the laptop owner's account. Probably set to autoconnect, after which he could have switched to his own account. Too late.

Hmmm...

[BrokenHalo]

If he's a happy AOL customer, the world is probably a better place without him anyway :-)

A sojourn in the slammer might just do the trick.

Re:Password protected?

[rduke15]

true, but what about BIOS passwords?

In all the cases I have seen this problem, it was enough to remove the CMOS battery for a few seconds. It may be a bit more difficult with notebooks. For one, the case takes a bit more time to open. Then the battery may be soldered? Never had the problem with a notebook.

And then again why would that thief be smart enough to get the passwords but not smart enough to avoid somebody elses AOL account?

Indeed. Good point.

But I wasn't thinking about that specific looser, just replying to a general comment from someone who seemed to believe passwords were efficient protection.

So it sounded usefull to remind that there can be no security when physical access is possible.

How about this?

[3.5 stripes]

Known stolen AOL account + phone number recorded by any ISP (radius does it by default) + call to phone comany by FBI = physical location.

No magic.

Re:How about this?

[chef_raekwon]

No magic.

whaddaya mean? they didnt throw the 11 sided die, to determine who and where?

Re:Not spyware. The story is much simpler than tha

[Grizzlysmit]

How dim are you, he used his own AOL account but he didn't reset the ip address of the machine:

Investigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers, White said. That enabled authorities to connect the computer's Internet Protocol address, a number that identifies a computer on the Internet, to Krastof's home address through his AOL account, White said.

So of course he was easy to pickup, he was using the stolen ip of the stolen machine on his AOL account, QED.

Re:Not spyware. The story is much simpler than tha

[Anonymous Coward]

All this fuss, just because Yahoo messed up:

elsewhere on /.

"He logged onto an (America Online) account that was registered on that computer and we traced it back to his phone number and address"

His first mistake:

[Anonymous Coward]

AOL KEYWORD:

GO FEDS

EVERYTHING BELOW THIS IS MEANINGLESS

[Anonymous Coward]

This issue is a non-issue. Cease discussion on this topic immediately, or continue to be morons.

We Need People like this!

[Anonymous Coward]

Seriously we do. What kinda of thief, master mind, idiot, what ever you call him/her would still a computer_and_keep the same OS on it?!?! At least as other people have pointed out change the freakin NIC for typing out bold! But in general why not format the HD about ten times, take the NIC out, change the BIOS settings and then install a whole different OS of you choice. Granted more should be done like going out and buy a laptop instead of stealing one.

He logged in with account of the laptop owner

[Gish34334]

"Investigators knew where to look for the gear not because of unusually intrepid sleuthing but because Krastof allegedly used the computer to log on to an AOL account belonging to the system's owner, Peter Gascoyne.

This allowed authorities to eventually trace the call back to Krastof's residence, said the Police Department's White, who acknowledged that cracking the case was, as much as anything, a matter of pure luck."

SOURCE:

http://www.sfgate.com/cgi-bin/article.cgi?file=/ c/a/2003/11/27/MNGUO3BN101.DTL

Re:Not spyware. The story is much simpler than tha

[Anonymous Coward]

If by 'own', you mean his brand new own stolen AOL account that was on the laptop, then you're 100% right! If not, well, better luck next time.

simplest explanation

[Anonymous Coward]

The explanation is simple - he dialed up to the internet with dialup networking connection that alredy existed on the laptop. Possibly this was to an ISP, or possibly to the corporate net. The owners of the machine were looking out for this. Then he fired up a webbrowser and checked his AOL mail. The security guys then have the IP address, and so they ask AOL, which AOL account was accessed by xxx.xxx.xxx.xxx at such and such a time (they can't tell themselves because of the SSL). Easy.

Re:Password protected?

[cnelzie]

MOST people that steal laptops aren't smart enough to know how to recover passwords using the methods you described. Also, MOST of those password recovery tools are rather pricey.

If they can't use the Laptop, they HAVE to format it and reinstall, if they are that smart, or they have to take it into a computer store somewhere and get someone to install an OS for them.

At the VERY least, proprietary information could be kept more secure, especially since MOST thieves would have to format the machine and put a new OS onto it in order to be able to use the laptop.

Identifing the PC

[CavemanKiwi]

All AOL have to do is log the user ID and the incoming phone number of the account. This identify where the person logging in with their ID. It is that simple no need for CPUID or MAC addresses. Like users write all that down anyway. Even if they have masked their number the Telecoms company company record all calls so the can bill people. In fact if I recall correctly when canceling AOL they ask you the last time you used it and why are you canceling so it would be likely that canceling process would raise this.

Re:PC call home-I think you've hit the nail.

[Anonymous Coward]

on the head. WTF is a laptop with CC info doing connecting to AOL?! I think that's why we see the discrepancy here:

The Yahoo statement:

Investigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers, White said.
and the Herald statement:

"He logged onto an (America Online) account that was registered on that computer and we traced it back to his phone number and address,'' White said.

Re:Password protected?

[cybrthng]

Not so easy as pulling out batteries on laptops.

If you lose the CMOS/Bios password you usually have to RMA the laptop back for a new bios (unless you can find it and solder or replace it yourself). Thus requiring receipt or tracking of serial numbers of which any big company can cross reference against service contracts.

Re:Not spyware. The story is much simpler than tha

[Alsee]

he didn't reset the ip address of the machine
he was using the stolen ip of the stolen machine

[cringe] You can't "steal" an IP address in the sense you suggest. Every time you log on to AOL you are given a brand new IP address.

-

Resetting/deleting WinXP admin pass takes seconds

[horza]

I downloaded onto floppy disc the program here and had reset the admin password on my Win XP box within seconds. Never seen anything so simple in my life. Though others recommend LC4 which also works.

Phillip.

Re:Not spyware. The story is much simpler than tha

[Anonymous Coward]

How dim are you, [follwed by retarded ramblings]

Nice post, jackass.

Solution

[diffuze]

1. Install new os (read: linux)
2. Spoof MAC address
3. ???
4. Profit !!

What's so funny?

[Frisky070802]

All these responses to this answer, moderated "funny" by multiple people, and no one's asked why "Mac address perhaps" is "funny"?

Now, if they'd said it was a Big Mac address, at least I might laugh.

Re:What's so funny?

[Anonymous Coward]

Perhaps because it is obvious why it's funny.

John: "Hi Bob, it's John."
Bob: "Hi John."
John: "Hey...how'd you know it was me?!?!?!?"
Bob: "Um...well...first of all, you just said your name."

Re:What's so funny?

[Frisky070802]

But as other postings noted, the mac address isn't "automatically" sent to correspondents. AOL'd have to have code in the AOL client that sends the mac address explicitly.

So to me, mac address seems like a perfectly reasonable way to identify a machine, but not so self-explanatory that it's inherently funny...

Re:What's so funny?

[Anonymous Coward]

Humour also depends on context.

Being a programmer with extensive network protocol experience, I found it inherently funny, since MAC address is by far the most common way of uniquely identifying a host.

A truck driver is less likely to find it funny.

Maybe you are more of a truck driver than a programmer.

Re:What's so funny?

[Walt Dismal]

These two MAC addresses walk into a bar.....

Re:What's so funny?

[thetaikung]

I might be wrong and horribly confused...but I've logged into my routers before and seen the MAC addresses of any attached devices. Since AOL is mostly dialup, they can catch a logon of a user of one of the stolen laptops and look up his MAC from the first level of routers they logged into. Yes? No? Overly simplified? Who cares.

Of course, I could just be drinking and posting. It's 3:33pm.

Re:Password protected?

[FattMattP]

You think that someone who uses AOL would know how to do all of that?

way off topic

[kayen_telva]

okay, since this discussion has gone haywire, I may as well ask an off topic (kinda) question. Lots of people are mentioning that you can use dynamic dns or special software to alert you to where your stolen laptop is. But it seems they all require you to allow the thief to completely log into your system. w00t ??!! I have THREE passwords to get to a desktop on my Linux laptop. BIOS, LILO, user. So Im screwed right ??? If I want some theft security I have to give up my data and day to day security ?? anybody know solutions ??

Re:Password protected?

[JeffTL]

Actually, there are floppy images floating about freely that wipe NT/2K/XP passwords. They amount to miniature Linux distros that convince Windows that the account has no password. A Windows admin's best friend, I daresay, because there'll always be the user who loses passwords.

Re:Password protected?

[cnelzie]

Again... Most thieves do the snatch and grab because it is convenient and have little to no desire to get involved in any of the intricacies of actually knowing how to circumvent any security on anything that they have stolen.

Remember the furor over the Pentium Serial Id?

[l8apex]

The equivalent of that just snuck in the back door- any computer with built in networking hardware automatically has a permanent uniquie ID via the Mac address. Built-in means you can't switch the network card, and you probably can't change the Mac address in the BIOS. um, oops!

Now the article didn't say how he logged into AOL- he could've been connected via DSL and possibly used the included networking hardware to do it, nailing him with the MAC address.

Re:Remember the furor over the Pentium Serial Id?

[fozzmeister]

Mac address don't go any further than the first router and certianly don't get put into TCP/IP packets for transmition accross the NET. therefore AOL or anyone else (not on your local LAN) would have a hard time using your MAC address to find a stolen computer

We LIKE watching UK cops on TV

[Anonymous Coward]

Like that in the UK. The Police are too busy catching people doing 80mph on the motorway to bother with the boring stuff like murder and gangland shootings

By the way, THANKS for the seemingly endless streams of idjits doing silly things on the carriageway, makes for GREAT TV viewings!

Laughing all the way from the bank

[krzystealth]

You people are overcomplicating a very simple situation. He works at a hardware store and steals computers (?!?!), the solution can't be that complex.

The laptop belonged to a 'consultant' of WFB, not an employee. Which means WFB had no control over it (Don't ask me why they allowed it on their network in the first place!?!?). The result is that you end up with a laptop full of all sorts of crap. Most of it was probably set up to autostart on autologin. Our friendly neighborhood laptop thief probably plugged it into his "4 port DSL router" when he got home. When he fired it up, it connected 'automagically' to AOL using the stolen screen name. Upon noticing that, he either quickly logged out and back in as himself (phew! that was close) or another computer behind his DSL router was already logged in as his usual screen name or had been recently.

Don't over estimate the abilities of the hardware store employee-laptop stealing community. You'll get burned every time.

Either way, it has to be what most of us consider a dumb mistake and he's probably kicking himself right now.

(he used the AOL login on the computer)

Re:Laughing all the way from the bank

[krzystealth]

Doh, I missed this part:

"He logged onto an (America Online) account that was registered on that computer and we traced it back to his phone number and address,'' White said.

It WAS dialup..

Cookies

[Radical Rad]

I'd bet AOL and its "partners" use cookies to track users and target ads. If the former owners give the FBI their account info such as an AOL account name then they should be able to pick up the cookie trail and follow the ip address to the phone line.

Re:Password protected?

[wpc4]

except if they were that bright would they still be using aol to connect to the interweb?

I wonder what they have on me...

[crashnbur]

This story could have huge implications on every single one of us. What other information are our various logins tied to? Web-surfing histories? File-sharing histories? Email histories?

Any transaction that goes in or out has at least two records -- the one on your computer and the one on any other computer that's on the other end of the transaction. Most users are pretty careless about trashing their histories in order to save space, memory, etc. But something tells me the federal government would prefer to just spend more on bigger and better storage equipment and faster memory in order to contain every miniscule detail of information they can.

Re:I wonder what they have on me...

[IM6100]

Don't look now, but I think your social security number is etched into your butt plug.

Better clench down hard and try to abrade it off.

Oh really?

[SuperBanana]

Authorities now have a sizable fraction of the technology possessed by big brother in the book 1984. Whether or not to fear that power is a matter of trust.

Oh REALLY. Like...two way spying devices in EVERY room of EVERY house, and mind reading devices?

We must be living in rather different worlds my friend...

Re:Oh really?

[IM6100]

No, I think he's referring to the other stuff from 1984, namely that the government can and does retract all printed newspapers and books and updates the history written in them at will.

Honestly, if people are going to rant about ever-closer dystopian futures, why not look a little deeper. The society of 'orgy porgy' infantilism that Aldous Huxley warned against in Brave New World is far closer in our 'sexually liberated' society. Then again, all the knobs rant about coming from that book is testtube babies.

The way High School teachers who forcefeed little snippets of Orwell and Huxley ignore the obvious anti-Stalinism in Orwell's work and the anti-cultural-infantilism in Huxley's work, one wonders if they are simply stupid or if it's a deliberate attempt to blunt the thrust of those works by corrupting the message.

Re:Oh really?

[Anonymous Coward]

The way High School teachers who forcefeed little snippets of Orwell and Huxley ignore the obvious anti-Stalinism in Orwell's work and the anti-cultural-infantilism in Huxley's work, one wonders if they are simply stupid or if it's a deliberate attempt to blunt the thrust of those works by corrupting the message.

I think it is more a case of forgetfulness than anything else. People refer to 1984 far more often than they actually read it. Hell - last time I read the book was 15 years ago. However, when 1984 gets used as a metaphor in various discussions, it begins to morph into the meaning that those discussions assign to it. Pretty soon you have a very simplistic view of what it was about, rather than understanding it in its entirety.

This goes for many works, not just 1984, of course. On that note, I think I have some reading to do...

Statistics

[freeweed]

Considering how many more people die annually from traffic accidents (speed often considered a contributing factor) than murders, I'm inclined to be happy with that situation.

Re:Statistics

[isorox]

Speed is never a problem. Inappropiate speed (like the perfectly legal 30mph in rain and fog past a busy school at kicking out time) is a problem, but 80mph on a motorway doesn't harm anyone.

Stolen mac call home

[craw]

Here's an article about how someone got back his sister's stolen mac using Timbuktu and help from usenet.

MAC Addresses changeable

[XiChimos]

Don't you guys realize that MAC addresses can be changed? It is fairly easy to do with software, but extremely hard to do directly to the hardware.

If you guys really want to know how the government does the forensics, read "Computer Forensics: Incident Response Essentials" by Kruse and Heiser. Well written book that is easy to read and teaches you a lot about this type of stuff and also analyzing machines.

It is easier to read the book than prove that Big Brother is out to get you.

Re:Password protected?

[fishbowl]

"It takes only a few minutes to change the administrator password on a Windows box with a Linux boot floppy."

The password recovery tools that have worked in the past, don't seem to work very well on more recent versions of windows. The last time I needed to do this, none of the freely available tools worked.

Or more likely...

[supabeast!]

That Diebold uses commonly available software that reports home whenever the system connects to the internet, just in case a machine is stolen.

Slashdot users are such a bunch of paranoid freaks!

Re:Or more likely...

[Teunis]

Since such software is routinely available and frequently installed... this is the most likey reason I can see.
The only necessary (probably hidden) thing here is that the company handling the software would be reporting it to the FBI in this case... probably on the request of the owner of the laptop.

FBI is evil...right

[Aliencow]

Just because you're paranoid doesn't mean they aren't after you... But why would they need information on your hardware other than the phone number that was used to connect to AOL?

How to disable the Pentium III serial number:

[Speequinox]

download this software from Pentium: It's on this screen

Re:Not spyware. The story is much simpler than tha

[Stigmata669]

Yes, except if you had read the abstract, you'd know that he logged onto AOL through his AOL account, not someone elses that was stolen.

Nothing exceptional here. The posters do not need any strange hooks into the article. They only need an uninformed opinion based on the headline. Case closed.

more reason to discount the Yahoo/Reuters version

[spiritraveller]

Investigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers, White said. That enabled authorities to connect the computer's Internet Protocol address, a number that identifies a computer on the Internet, to Krastof's home address through his AOL account, White said.

Apparently, someone thinks that the IP address is constant. That's probably why the reporter misparaphrased (is that a word?) Sgt. White.

Whoever wrote the story just plain bungled it.

Another Reason to use LOCAL ISPs

[The Raven]

Small local ISPs do not currently have any special hooks to the govt... there are no laws yet requiring us to. And since most smaller ISPs do not use any special software at all (the installation CD is just a new version of IE, with Netscape or Moz on the CD too), they cannot be detecting anything on your computer.

On a completely unrelated note, I work for a small ISP in Wisconsin that services the area from Green Bay to Milwaukee, and extending west of Lake Winnebago. Dump your AOL or Earthlink and go with a small provider that respects your privacy!* Go Dotnet! ;-)

* It's really not that we respect your privacy... it is more that we just don't CARE what you do online.

Re:Another Reason to use LOCAL ISPs

[IM6100]

* It's really not that we respect your privacy... it is more that we just don't CARE what you do online.

Will you care what 'I' do online after my account is stolen or my box trojaned by a spammer??

Re:Another Reason to use LOCAL ISPs

[Anonymous Coward]

As long as its not ARN.NET.

They have admins there that dont care about anyones privacy. Yes Daniel... I mean you...

for your own sanity... STAY AWAY FROM ARNET....

Re:Password protected?

[Anonymous Coward]

Delete the Sam database where the windows 2000 accounts are stored. When you startup again there won't be an Admin password. Same principle with linux and editing the shadow file.

Point of fact is there are very few desktop systems where you can't get root access so long as you have access to the machine.

What are they up to ?

[Anonymous Coward]

Might be kinda interesting to install AOL and try and see what (if anything) it sends along with your user authentication to AOL HQ.....

simply stupid ?

[Anonymous Coward]

maybe he spend ages cracking the login .. then logged in as Administrator ( like make users ) and tried to aol-connect ! .. hihi

Re:Not spyware. The story is much simpler than tha

[mortonda]

What happened to ISPs protecting user's identities?

I doubt very many ISP's will disobey a court order for this sort of information. I won't give out my customer's info without one, but I sure as heck will cooperate with them if they go through the proper channels.

beta test offer

[morcheeba]

Sounds like a neat system. If you want a beta tester for it, just post your address and the dates & times you leave your laptop all alone in your house, and I'll see what I can do!

Next time ...

[John Jorsett]

If something like this ever happens again, try asking for your city council member and/or state legislator to put some pressure on the cops for you. That can sometimes get a case moved up the ladder, priority-wise. It would be particularly effective if your politician had also had a laptop stolen. There's nothing like a ticked-off politico to get a bureaucrat to haul his butt out of his chair.

Re:Not spyware. The story is much simpler than tha

[_Sprocket_]

An even better quote from another source reads:

Investigators knew where to look for the gear not because of unusually intrepid sleuthing but because Krastof allegedly used the computer to log on to an AOL account belonging to the system's owner, Peter Gascoyne.

Seems Reuters screwed up on the facts.

IBM Thinkpad

[BigFire]

When I was buying my IBM Thinkpad, it came with a feature of calling home, should the machine be stolen. The call home mechanism is build in, and cannot be removed. What it requires is a subscription fee to activate the feature, sort of like LoJack for laptop.

For the people with sensative information, it's bitter price that must be pay.

Re:IBM Thinkpad

[davidstrauss]

The "call home" functionality is not hardware, to my knowledge. In contrast, IBM's Embedded Security Subsystem 2.0 is hardware, firmware, and usually software. I could use ESS 2.0 to make my laptop useless if stolen, but ESS 2.0 doesn't have a phone-home feature itself. (I'm a T40p user.)

Cookies, my friends, cookies (or GUIDs)

[jtara]

It's way to obvious that most slashdotters are either:

a. Unix users or
b. Conspiracy theorists

I'd guess that the intersection between the two is enormous!

While I don't know how the AOL software works, one can easily imagine that it has something akin to cookies. So, if AOL issued a cookie to the previous user, that cookie would be held by the client software. There may be one or more cookie that would be machine, rather than user-specific, and would be sent back by a given machine regardless of which user account is used.

Alternately, it could be a GUID created by the client software, say on first use, and then sent to AOL upon connection.

A GUID is a Windows thingie, kinda similar to a cookie. It's a "Globally Unique ID". It's basically a hash of the MAC address and the current time. (But if there is no network card, there are other ways of making it machine-specific - Windows decides how.)

There are zillions of GUIDs used by Windows. They are typically used in the registry. But program data files often contain them - for example, Word files.

You can't reverse-engineer a GUID to find out what machine produced one. It's a one-way hash. But if you know that a given GUID came from a given machine, and you see that GUID again - you know that it came from the same machine.

(1 in a billion fluke excepted. The fluke could only happen in the case where there is no network interface on the computer.)

Not a scary Big Brother scenario

[This Is Ridiculous]

Makes you wonder what sort of hooks the FBI has into AOL or other ISPs and what hardware identification is being transmitted at login.

If you actually read the article, nothing untoward happened.

Probably, Wells Fargo reported to AOL that computers with those accounts on them had been stolen--perhaps simply to keep them from buying anything on company money or anything. When AOL noticed the login, they notified the FBI, who used normal techniques to get the account information.

This is not a scary Big Brother scenario; rather, it's a great model for how corporations and government can and should cooperate to fight crime. Does anyone here really think that AOL acted improperly by giving them the address of a computer and identity thief?

Did u consider suing him?

[Anonymous Coward]

You wouldn't even need a lawyer; in this case you could've taken the law somewhat into your own hands by suing in small claims court. It sounds like you have enough evidence to win a civil suit against the a-hole that stole your computer. If the a-hole doesn't show-up, you win by default. If that a-hole did come to court, even better. You can ask to have him arrest after you win. At the very least it seems like he recieved stolen property. IANAL

FYI: MAC, not ARP

[phorm]

ARP is a protocol (Address Resolution Protocol), the address in question is a MAC (Medium Access Control) address.
ARP can use a MAC address to resolve machine identification, IP assignment, etc

Slashdot Goes Trolling For Dollars

[reallocate]

>> ...Slashdot is run by trolls for trolls. There's lots of banner revenue in trolling sucaks...

Exactly. Gotta keep those numbers up amd OSDN's creditors at bay.

Pity, though, that they have to demean themselves to do that.

True and false

[phorm]

since you can't track a MAC address back across the Internet

While it is true you can't check a connected machine with netstat etc and say "hey, this machine has MAC xxx" there is nothing to say that a program can't capture a MAC address from local hardware and pass it on.

Generally, MAC address stop being readable somewhere after (correct me if I'm wrong) the local gateway. But a piece of software could still check the network interfaces and transmit it within a message to home-base.

Too many possiblities

[Anonymous Coward]

Microsoft xp update Serial number
Email pop3.xxx.xxx server
Instant messenger auto login
Hot Mail
Laptop auto updates.

Heh, a practical use for spyware.

No news here

[Awptimus Prime]

Back when I worked in the abuse department for a leading ISP, this was a daily thing. Why's it news? Beats me..

The dial-up equipment at ISPs keep a log on hand of the numbers you've connected from. The investigators get a warrant for this information, you email it to them, case closed.

Speaking of stupid computer theives...

[MadAnthony02]

The security guys where I work are fond of this story. We had someone steal a couple of college owned computers, and aparently resold one of them to a student halfway across the country. The computer had Norton Antivirus Corporate Edition configured to run as "managed" -ie it gets it's definitions of our servers instead of symantec's. Our network guys got suspicious when they noticed trafic on one of our NAV servers coming from several states away - turned out that the computer theif never changed the antivirus settings before selling it and it was trying to get virus definitions from us.

Re:Speaking of stupid computer theives...

[tiny69]

Without the admin password used for the NAV server, it's difficult to remove the client from a computer. Most administrators of NAV servers lock everything down on the client. This includes restricting a user from making changes to the configuration or being able to stop administrative scans. Symantec has a 20-step process listed on their website to remove the client if you don't have the admin password. The instruction are a little too involved for the average user.

NO, he used owners AOL account.

[babazaroni]

http://www.sfgate.com/cgi-bin/article.cgi?file=/ne ws/archive/2003/11/26/financial1853EST0113.DTL

Re:NO, he used owners AOL account.

[babazaroni]

Direct linking not working, so go to sfgate.com and search for Wells Fargo.

re: mind reading devices

[ssstraub]

Having just finished reading 1984 last night, I would like to know where it mentions "mind reading" devices anywhere in the book? The telescreens are obvious, we have torture and conditioning, but I don't remember any mind reading device...

Not that I steal laptops but....

[LnxAddct]

If I did the first thing I would do is format the harddrive. I mean isnt that kind of common sense? That is, if you weren't trying to get information off of the drives. This guy said he didn't know that there was important information on there, so he probably was looking to sell or use them personally (although he may have lied about not knowing). And if he was trying to get information off of the drive, boot up with knoppix. I mean its a good thing that only dumb people are thieves. Writing a program that sends information out whenever there is a net connection isn't hard to do. If I stole these I would have assumed that they had something similar on there and taken every precaution. Neither side really thought this through.

Re:Not that I steal laptops but....

[sik puppy]

that won't do it. Many major firms have custom bios installed.

The laptop checks via the internet to see if its id (serial# ?) is on the stolen list. If it is it self-destructs.

Some friends who used to work for a major silicon valley firm said this was done at their place of employment.

AOL and FBI not enough

[Dot_Killer]

Just because they have the IP that is not enough to trace the guy back to his house. He logged in a someone else's AOL account, they could get the IP from AOL. AOL could backtrack to the modem bank that gave out that IP.

The IP has no connection what so ever to someone's home when they are on a modem. So then AOL/FBI had to find out what phone number called and got that IP assigned, then they either looked up the guys address on a GOOGLE search or put the screws to the phone company to give them an address to the number.

An article I read

[MagicBox]

at News.com claimed that the computer's IP address was traced. But how? Unless it was static and the guy didn't know, how would they trace it? If it has a static IP doesn't he need to change the settings to connect to AOL's network? I'm thinking there's something deeper here. Either they suspected him, or FBI has the capability to *find* you if they need to. I've always thought that we lived in a world which I couldn'd find something to compare it to, until THE MATRIX came out. Looks like (the real) agent Smith has prevailed in our world though.

CALM DOWN!!!!

[clickster]

http://www.crime-research.org/news/2003/11/Mess270 2.html Check the above article. They say he logged into AN account registered on that computer. It could have been that he logged onto the Wells Fargo guy's account (with password saved). After all, he is a data thief, and not a very smart one apparently. If the FBI had AOL watching that guy's account, then they could have simply traced the IP Address. No big deal...if that's the case. It would help if the articles would be little more specific.

Re:ARIN

[Wolfrider]

--I believe the site you are talking about is this, is it not? Correct me if I'm wrong. (I'm posting this because I didn't know about it before, and got nowhere trying www.arin.com.)

Please read the writeup or the article next time

[Anonymous Coward]

nvestigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers, White said. That enabled authorities to connect the computer's Internet Protocol address, a number that identifies a computer on the Internet, to Krastof's home address through his AOL account, White said.

"Known stolen AOL account?" According to the article (and the writeup), he logged in using his own AOL. Somehow the authorities were able to link this login with the laptop itself, and that's what we're all discussing.

Those of us who troubled to read the writeup or the article, that is.

Re:more reason to discount the Yahoo/Reuters versi

[Anonymous Coward]

I read that as well. I was thinking to myself, "what are they smoking, the IP address wouldn't be the same if they're connecting to AOL by dialup."

can WE get AOL & FBI to help us? no.

[SethJohnson]

The hooks that should really be discussed here is the fact that Wells Fargo was able to get the FBI to work this case and do this leg work of contacting AOL and watching out for this login. The thing that sucks is that if it were my laptop that were stolen, neither the FBI or AOL would help me recover it via this method. Remember the case of that guy in Chicago who was buying laptops on eBay, but never paying for them? Here's the page describing one victim's success in catching the crook after the FBI refused to help.

The Freedom of Information Act

[NeoMoose]

Is the FBI refusing to divulge how they found out that he was on one of the stolen computers? Because if so that is a direct violation of the Freedom of Information Act. I sure as hell want to know if my computer transmits some form of identification information when I log in to my ISP.

What I am willing to bet that it really is though, without reading, is that the serial number of the computer led to the serial number of the nic, whether it be modem or ethernet, and then the mac address could probably be identified. Just my guess.

I'd be more interested in thoughts on the FoI Act thing though.

Re:The Freedom of Information Act

[Anonymous Coward]

Is the FBI refusing to divulge how they found out that he was on one of the stolen computers? Because if so that is a direct violation of the Freedom of Information Act. I sure as hell want to know if my computer transmits some form of identification information when I log in to my ISP.

What I am willing to bet that it really is though, without reading, is that the serial number of the computer led to the serial number of the nic, whether it be modem or ethernet, and then the mac address could probably be identified. Just my guess.

I'd be more interested in thoughts on the FoI Act thing though.

If you really want to see this information more public than it already is, go ahead and file a request with them - any citizen should be able to:

http://www.fbi.gov

If you are having trouble there, you might want to check out the following:

http://www.usdoj.gov/04foia/index.html

They allow you to file a request online, although I doubt it deals with FBI's information. Something to keep in mind here though, is that if the information is being used in a investigation currently (which it is), then I doubt they will release anything. Imagine if the guy who stole the laptops has an accomplice that the authorities have yet to find out about, he could use information obtained via FOIA to alude them even further. Just a possibility.

This joke is a repeat post...

[bonch]

...of the byline in this very article that michael posted. Come on, moderators.

Re:more reason to discount the Yahoo/Reuters versi

[jovlinger]

AOL (and all ISPs, as per law) keeps logs of which acct gets each IP. If you're LEA, you probably don't even need a court order to find out which acct had a given IP at a given time.

I'm sure the story is wrong and inaccurate in other ways, tho.

RE: Web address

[Anonymous Coward]

There's a space in news, that's the only problem with the link try:

http://www.sfgate.com/cgi-bin/article.cgi?file=/ne ws/archive/2003/11/26/financial1853EST0113.DTL

Wells Fargo Home Mortgage employee

[Anonymous Coward]

About a year ago, our development team had our laptop stolen, right off of our desk. It housed all of our sourcecode, and other things that...should not have left that room. After we reported the theft, absolutely nothing happened. Security tapes were dug up, and watched, with nothing found at all. The WF laptops have much more security then ours did. According to our internal rules, the employee who had control of the laptop, should be entirely at fault. We're supposed to leave our laptops locked up in a drawer at night, and this person, definitely did not. I honestly wouldn't be surprised if he were to get fired over this.

Posting anonymously, so as to not tip myself off.

3com has done it too

[mnemoth_54]

I think MS once recieved a very large batch of new 3com cards, all with the same MAC address. Needless to say it was a big mistake, and took some time to troubleshoot. Imagine upgrading/deploying ~300 NICS, all get link but they wont talk. No matter how you troubleshoot, your just not going to figure it out until you start sniffing.

Re:more reason to discount the Yahoo/Reuters versi

[spiritraveller]

AOL (and all ISPs, as per law) keeps logs of which acct gets each IP.

Of course. Once they realized he was logged in with the stolen computer, that's how they traced his number and got his home address.

The question you should be asking yourself is, "How would they know that he was using the stolen computer in the first place?"

spyware

[1eyedhive]

perhaps WF put some (not-so)spyware on their machines, and if they logon to the net, BAM! the IP address is made, and a traceroute grabs the identity of the gateway router, whois gets the ISP's info, tell the cops and you get one busted criminal.

Re:Password protected?

[Myxorg]

My laptop doesn't have a floppy drive, watcha gonna do now smart guy?

Re:Password protected?

[rduke15]

My laptop doesn't have a floppy drive, watcha gonna do now smart guy?

Don't worry, I have the floppy drive. And the CD drive too. External USB.

Of course, if it's an old notebook without USB, the simplest is to put your hard drive into my desktop which does have a floppy to massage your admin password, and then back into your notebook :-)

Find the Article Here

[Anonymous Coward]

Moved to Archive at:

http://www.sfgate.com/cgi-bin/article.cgi?file=/ch ronicle/archive/2003/11/27/MNGUO3BN101.DTL

seems simple enough...

[decepty]

... to write a script where on a network connection the computer attempts to access a server and basic security info about itself (i.e. IP address, CPU name, etc.). As the usage of AOL seems to indicate a lack of common sense in the first place, I would assume the thief wouldn't check for such a thing.

How Computrace works:

[Anonymous Coward]

The program installs a hidden partition at the beginning of the hard disk -- it is similiar to "service partitions" one might find on an IBM, or Compaq, computer. As long as this partition remains on the harddrive, the program will periodically "phone home" with an IP address through the modem or ethernet ports. This gets logged into the Computrace system.

As soon as a laptop is reported stolen, the Computrace people (a) check the last logged IP address and (b) send a special signal to the stolen device that causes it to lock up.

who cares?

[BenLutgens]

If it gets someone's stolen shit back whats the big deal. If you're being honest with your own laptop its a non-issue.

Now, if you're a criminal you might have a reason to be concerned.

Wow.

[SisyphusShrugged]

Wow. I have heard of typos, but to transpose words completely like that...its kind of strange.

When I first read it, I was trying to make sense of threw in its proper context, thought maybe it was some new slang for hacking!

I think the media got it wrong ...

[jopet]

this looks as if the thief was simply attempting to log into the account of the *original owner*, which was preconfigured on the stolen laptop. Of course this is easily detectable and easy to trace back.

Report it anyway

[Beryllium Sphere(tm)]

Routinely, the police bust people on unrelated charges and find apartments full of stolen goods. Sometimes they succeed in taking down a fence.

Then the police often can't return items to their owners because they don't have any record of the item.

Moving away from self-interest to social responsibility, reporting crimes makes it possible for the police to identify trends, prioritize patrols, and justify the budget for things like AFIS systems.

ThoughtCrime!

[twitter]

All the FBI would have to do is find out whats on the PC, and contact these companies for that software's unique IDs.

Ah, the many faces of Big Brother's love. It's so reasuring that so many non free software companies keep such close tabs. It would be beneath Big Brother's and your ISP's dignity to identify hardware, like XP does. God only knows that an OS call is too trivial for Big Brother especially when he has so much help. We might also be sure that our own masters who provide our daily bread have their own unique tracking software. Wells Fargo double plus good company, bellyfeel Ingsoc. We must support our troops in Eurasia. All else thoughtcrime. Kill Goldstien! Kill! Kill!

The lesson here

[Lord Kano]

If you're going to rip off hardware from a large, powerful, incluential company like WF, make sure that you wipe the HD, toss the PCMCIA NICs and start from scratch.

LK

Laptops

[coyotedata]

Of course WF may have something hooked in themselves.

Wells Fargo hiden task

[Anonymous Coward]

Probably the laptop contains a background task that auto-login to Wells Fargo once it connect to some sort of network. The moment he connect to AOL - the laptop gets a DHCP ip-address then the background daemon login to Wells Fargo telling another task that it is alive. That task would look up and notice that the laptop "secret key" is reported stolen. It then notify the Wells Fargo security and a reverse trace is then run.

Re:Not spyware. The story is much simpler than tha

[Vlad_the_Inhaler]

They must mean MAC Address, the only way it could be IP Address is if AOL give fixed IP Addresses (for broadband) based on the MAC Address and then it's the MAC Address all over again.
Someone here quoted another - more detailed - article from SFGate where it was claimed that he used the AOL account he found on the laptop.

Re:in related news

[bensagenius]

"Shouldn't this be in the Your Rights Online section?
Obviously the constitutional rights of this poor thief have been grossly violated by the mean FBI guys"

How did this get modded down? It's a perfectly good point, and one I would have voiced had the poster not done so. Or has a "well-turned, insightful, pointed sarcasm" negative moderation category been added since the last time I had mod points?

Smart Thief NOT!

[Anonymous Coward]

The only problem with that is that this guy was trying to pull off sensitive information from the box.

No, the SF article mentions that the thief didn't know there was any interesting information on the computer.

To protect your stuff, it is safest to not underestimate the intelligence of a thief. But most thieves aren't smart -- if they were smart they probably wouldn't be thieves.

Mass hysteria

[Gary Destruction]

Sounds like alot of people on here are just a tad bit hysterical. It's already been shown that the story was misreported by the mentioned source.

It's like the shootings at I-270 near Columbus. The newspaper said that a lady was shot and killed when a bullet penetrated the driver's door of the car she was riding in. If that's true, the driver was totally missed and she died. Obviously, they either meant that it hit the passenger door of the car she was riding in or it hit the driver door of the car she was driving.

Exactly

[sacrilicious]

The real issue here (which nobody's talking about) is how can Wells Fargo get away with this? Seriously, they left a mess of Real Important confidential customer data unencrypted on a highly mobile computer.

Exactly. So this guy claims he had no idea what was on the machines... what if he was lying? What if the first thing he did upon booting up the machine was burn its contents to a dvd and mail that to his cohort offshore? Nobody's talking about this, and it's the real story here.

Re:more reason to discount the Yahoo/Reuters versi

[jovlinger]

I'm going to stick with the idea that the previous owner had it set up to dial home, somehow. Most likely, IE's homepage was set to the Wellsfargo website, which had previously stored a cookie with the previous owner's UUID in it. All they needed to do was set the Wellsfargo webserver to go off like an Xmas tree if it saw the UUID in another cookie.

Get the IP from the wellsfargo webserver, and ask AOL to finger the IP's lessor.

Re:more reason to discount the Yahoo/Reuters versi

[stankulp]

"The question you should be asking yourself is, 'How would they know that he was using the stolen computer in the first place?'"

My guess would be from the MAC address of the computer's NIC.

Ranges of MAC addresses are assigned to network device manufacturers much like IP addresses, only they are stored in the device's PROM.

You can change a device's MAC address, but it involves reflashing the PROM.