Laptop Thief Caught via AOL Login

Mundocani writes "Yahoo (Reuters) is reporting that the FBI has caught the guy who stole computers from Wells Fargo. The interesting part is that 'Investigators traced the computer to Krastof when he logged onto his own America Online account at home through one of the stolen computers.' Makes you wonder what sort of hooks the FBI has into AOL or other ISPs and what hardware identification is being transmitted at login."

Comments

Good vs Bad

[Anonymous Coward]

There may be some good in the fact that they are able to trace someone like this...but the ramifications make me shudder.

That and make me glad I am in Canada..

Re:Wait a minute...

[leenoble_uk]

Running Jaguar I set up a fake account with no password on purpose. If my laptop was stolen I WANTED the thief to use it to get online. My real accounts were hidden from the login screen and my home folder was invisible. I had a penny-per-minute dialup ISP set up to make it easy for the thief to get connected. Using DNS update software I would be able to see the IP address at Dyndns.org if it was ever used.
If the thief was to find the computer locked down from the start then they'd be far more likely to wipe and restore making this a lot more difficult.
Unfortunately, now running Panther and making user account invisible makes the fast user switching a buggy nightmare. So in spite of the extra security features like FileVault I think it less likely I would ever see it again if it were stolen. I liked my security through obscurity.

Re:Password protected?

[rduke15]

Were they not running a password protected operating system, at least Windows 2000 or Windows XP?

You must be kidding, but I'm not sure.

It takes only a few minutes to change the administrator password on a Windows box with a Linux boot floppy.

Done it a couple of times (on Windows 2000), for users who didn't know the admin password.

Re:PC call home

[Zocalo]

I kind of get the impression, that with this being a laptop and all, it would have been using a modem to connect. Last I heard a modem does not actually have a static MAC address in firmware like a network card. Since this is Slashdot, we might as well blame Microsoft for this confusion since they gernerate a MAC with the vendor ID of 44:45:53 to "internal adapters" such as modems.

Because there is nobody to guard the guardians

[Anonymous Coward]

It's simple. Everybody wants thieves to be locked up, but nobody wants to live in a police state. This means that we applaud whenever the authorities apprehend a baddie, but we boo whenever they give themselves even more powers and so bring the darker possibilities one step closer. There is nobody to guard the guardians, so we defend ourselves as best we can, by trying to postpone the day when their control might become total.

The two things are directly related, inasmuch as in a police state there would certainly be much less crime, since freedom cuts both ways. What you see as a conflict is just a reflection of this inter-relationship. We have to do both if we wish to safeguard both our present and our future.

Similar Experience

[Lieutenant_Dan]

I had one of my notebooks stolen at the LA airport. I had one in my suitcase (there's only so many I can carry) because of a conference. One of the baggage handlers must have helped himself to my notebook.

The funny thing is that the notebook was my personal, and because I did travel a lot at the time, I had an AOL account for convenience. Out of a whim, I called AOL and asked them for a log of my sign-ins. Lo and behold, turns out whoever stole my notebook was using my AOL account to surf! I pleaded with the tech person to at least give me the IP address so I can track the thief down. He sympathized with my problem and passed me to one of the network engineers who was very keen on helping me. I got the IP address and the phone number that he used to dial-in. He said that the Telecom department could give me the number that was used to dial in to AOL but I would have to get law involved as certain FCC regulations prevented him from sharing that info.

So I collected all the info and sent the report to the security officer at the Airport, a copy to the LA sherrif's dept and another one to my insurance company (who I had hoped would be keen to solve the problem). After a few calls, I got nothing. Turns out that theft like that happens a lot at the LAX and the LAPD is way too busy with serious crime to investigate a crime committed to an out-of-towner.

The good thing is, my home insurance covered the theft, so I got a better model for basically the amount I paid for my notebook a year prior (minus deductible).

This was pre-2001 btw ...

Re:Similar Experience

[crashnbur]

...the LAPD is way too busy with serious crime to investigate a crime committed to an out-of-towner.

It's sad, really... but police officers have essentially been reduced to insurance claims officers when it comes to theft or vandalism. Unless someone is in clear and present danger, the police often can't or won't act because there is just too much crime.

I read a sociological report about persons who have committed felonies recently, and the results shocked me. The statistics in particular that got my attention:

Of all the grand theft (generally $500+) that occurs in the US, only 6% of it is even reported.

Of all the grand theft that is reported, only 1% of the thieves are ever caught.

Of course, you have to understand that sociology isn't the most exact science in the world, and that these stats most likely include career thieves who only get caught once. I guess you can tell any story you want if you've got the stats to back it up.

But still, according to these numbers, 99.94% of all thefts of $500 value or more are lost causes for the theft victims, because either the thieves are too good or the police forces are not good (or willing) enough to catch them.

Re:Wait a minute...

[HeghmoH]

If you do want to implement e-mail, it's very simple. You don't need a local MTA; SMTP is very simple, and a server will accept a message for a user at its domain, no matter where you're connecting from. (Or nearly so....)

So all you have to do is know the SMTP server for your e-mail address, and a bit of scripting with netcat does the rest. Just make a file with:

helo phone_home@domain.blah
mail from:phone_home@domain.blah
rcpt to:phone_home@domain.blah
data
Subject: subject

contents go here
.
quit

Then you can send it with 'nc smtp.isp.blah 25 file'.

I do this for my phone-home program. It doesn't send mail by default, but it checks a private page on my web site. If it finds the right command on that page, then it will send e-mail. I can also have it execute commands and open up an ssh tunnel so I can ssh in.

Of course, like a dumbass, I don't have an easy way for them to get online unless they have a wireless network. Do you have a suggestion for how to do that without having a password-free admin account? I don't want random people to be able to do nastiness on my machine.

Do this with yahoo auctions

[adzoox]

I have done something similar with yahoo auctions. At auction end I type the seller's name into my IM client. It registers that name under all IM clients.

I always request a phone number and email address if I pay by Paypal or PayDirect. If they don't give it to me and I can't validate it, I don't send the money.

I have sent money in the past; rather blindly. I have been able to catch two sellers by just pretending to be girls interested in them, through IM. I got their actual phone numbers and even got one ready to pick me up and meet me for a "date" LOL.

Of course it was a lot of hassle.

If you can catch a criminal at their own game - that's justice.

I wish eBay wouldn't have eliminated the contact information request without having a transaction with the othert party. Most sellers that cheat me on Yahoo, also have aliases identical on eBay.

no warrant needed

[js7a]

Fred sets his laptop up to log into AOL with a default account and password. The crook seals the laptop. Fred calls AOL asking what ANI-reported telephone number his account has logged in on since the theft. AOL tells Fred the phone number. Fred reports the number to the cops. The cops get reverse directory information from the phone company (without a warrant unless the number is unlisted.) The cops ask Fred to ask AOL to inform the cops upon the next login. The crook logs in again. AOL calls the cops. The phone numbers match. Cops bust down Crook's door without a warrant because they have knowledge that a crime is taking place. The crook is busted.

Re:no warrant needed

[jrumney]

Its his account. I'm not American either, but in Europe, companies aren't just allowed, they are obliged to give you all information they hold about you, which in the case of an account which only you are legitimately allowed to log into should include the last phone number you dialed in from.

99% clueless techie-wannabees

[Anonymous Coward]

First, hat's off to all who don't know and say so, or simply state it. It's OK if you don't know your NIC's vendor ID/prefix by heart, or if you can't dissect the IP header without a reference.
Really.

To the rest: Offering complete goofball theory after complete goofball theory, briefly resting only to scream 'violation of privacy' then going back and suggesting another goofball theory impresses nobody. CPUID/NIC MAC/Windows/Office/[you-name-it] identifers or serial numbers are not immediately accesssible just because you have a PPP sesion going over your modem. If a phone-home feature was installed, then fine, but that's a completely different story.

Another hilarious example was the the default-route theory, which someone suggested as a 'dead giveaway' to the feds. Hello!? Even if the routing table was accessible, routes associated with a NIC wouldn't be *in* the table unless the NIC was active, and the setting would only be visible in the registry, not typically accessible to the world, nor routinely queried by an ISP. And never mind the statistical probability that a corporate NIC is configured for DHCP, thus it wouldn't have a default route to begin with.

I simply can't believe the amount of idiotic pseudo-techies posting and feeling BIG because they could incorrectly apply page 254 of the MSCE prep guide to formulate a crackpot theory.

Bleeeeeeeeeeeechhhh.

Re:You know...

[Alsee]

why is it that when the police do something smart with computers...
And when they can't solve a computer crime case...

Because the issue is how they do it. News items appear slam the police for success and ridicule them for failure simply becuase news items are not a representitve sampling of reality! The police have a hundreds of successes every day, but who cares to write about them or read them? It only becomes a news item when the police have a success AND they did something wrong or controvercial in the process. The same goes for their failures - it only becomes newsworthy when someone really screwed up.

As for this particular story it is all about how the police caught the guy. It appears that Slashdot botched the story in this case. Another news site reports that the guy did NOT log into his own AOL account, he logged into an AOL account belonging to the owner of the machine. If that's the case then there really isn't any story here. If some moron steals my wallet and then shows up at bank trying to use my safety deposit key then there's no problem grabbing him and throwing him in prision.

I was going to continue with an example of police methods that would not have been acceptable, but lets skip arguing over specifics. Suffice it to say that there *are* a wide variety of unacceptable methods. If you don't agree with that then you are a far greater threat to this country than any terrorist with a bomb.

-

CALM DOWN!!!!

[clickster]

http://www.crime-research.org/news/2003/11/Mess270 2.html Check the above article. They say he logged into AN account registered on that computer. It could have been that he logged onto the Wells Fargo guy's account (with password saved). After all, he is a data thief, and not a very smart one apparently. If the FBI had AOL watching that guy's account, then they could have simply traced the IP Address. No big deal...if that's the case. It would help if the articles would be little more specific.