Location-Based Encryption

davidwr writes "Eweek reports Apple co-founder Steve Wozniak has a new way to prevent theft of company secrets on stolen laptops: 'Wozniak offered a peek into his vision for the company on Ziff Davis Media's Security Virtual Tradeshow, where he introduced "wOz Location-Based Encryption," an application that uses GPS tracking within a wireless hub to encrypt and decrypt sensitive data for large businesses.' Today's encryption is good enough but I do like the tracking capability. Imagine your laptop screaming 'I'm being stolen! I'm being stolen!' and paging security as the janitor walks out the door with it."

Comments

Not totally secure?

[nmg196]

All GPS devices I've come across simply stream out NMEA data from a serial port (or over a bluetooth connection). What would stop someone that really desperate to get the data from hacking the GPS module or the dongle so they can stream in their own forged (or recorded) NMEA data which reports the laptops current position to be where they stole it from (after all, they should remember)? Usually anything these days that requires a GPS uses a standard GPS module, and at some stage, the position data from it ends up in an interceptable form on the edge interface of some module. Hardly bulletproof security?

Re:Not totally secure?

[jmcmunn]

Better yet, my portable GPS device allows me to "set my location" temporarily in case the signal is not strong enough. This allows the device to at least estimate where I am if it has a weak signal somehow. I don't really get all the details...but it works so I don't complain.

So what's to stop someone from doing essentially the same thing with the laptop? Just tell it "you're still in the building" and you'd be all good. I think this is a pretty cheesy idea for security, you can always figure out a way to lie to a machine, regardless of what lie you're telling. This is less secure than a well-encrypted password if you ask me, or course I assume that the machine would still have the password as added security, so I guess that argument shouldn't carry any weight.

Re:Not totally secure?

[nmg196]

> This allows the device to at least estimate where I am if it
> has a weak signal somehow. I don't really get all the details...
> but it works so I don't complain.

Well a GPS receiver has about 8-12 channels with which to look for the satellites. If it knows roughly where you are, then it can use that information, together with stored almanac data (info relating to the orbital positions of the satellites over time) in order to better guess *which* satellites it should try locking on to. It basically speeds up the process of getting the all important 'first fix'. If you didn't tell it where it was, it would simply take longer to get the fix - but it would still get there eventually.

I must admit, I wasn't too impressed when I received my first GPS and the very first question it asked me when I turned it on is "Please select the location of this device using the map below". I was like, "huh, aren't you supposed to tell me that?!". :)

Re:Not totally secure?

[stupidfoo]

When a laptop screams 'I'm being stolen! I'm being stolen!' and no one can here it, is it really making noise?

Re:Not totally secure?

[Mr Guy]

Don't appologize. It's not your fault you were using slang that actually does mean what you were trying to convey. I'm assuming didn't actually speak to the device, correct?

So in other words, you inclined to feel as though the machince should be telling you. Or perhaps your feelings could be described as resembling the emotions that sentence expressed. I think you'll find that's what the word like means, regardless of whether that's an encouraged sentence structure.

If you feel I'm wrong, explain to me what's fundamentally different about the following sentences, besides using a sentence to describe the feeling instead of direct simile:

I was like a cloud.
It was like a state of total weightlessness.
It made me feel like I buzzing around.
I was like, "Wow, I'm a cloud".

Or other more malign actions

[_the_bascule]

paging the boss, 'he's going home! he's going home!'

Alarms

[Anonymous Coward]

What if they had that for cars? Imagine someone tries to steal one and an alarm goes off! Everyone will pay attention and call the police right away. Car theft will be a thing of the past for sure...

This could be applied to other things as well

[uid100]

Some though would have to be applied to this, but a GPS system in your car that alerts you if some operational parameters are crossed would be nice.

"Hey, I'm being towed away from the parking garage, even though my keys are more than 100 yards from me"

Zztxt Flrqtp fnz p47eltnzd.

[mothz]

Zztxt Flrqtp fnz p47eltnzd.

Oh, I'm sorry, you need to move two steps to the left.

Do you keep your laptop solely in the office?

[mpathetiq]

It seems like the real risk would be when you are on-site, traveling, etc. As a consultant, my laptop never leaves my side. I'd hate to have to "check out" every time I left the building. Also, I don't think I would like my employer having the possibility of tracking my every movement. Sure, you could turn off the tracking, but then you've lost the security as well.

Shut Down?

[ZZeta]

Ok, may be I'm missing something, but wouldn't a simple shut down get rid of this 'feature'?

And before you tell me how you can't shut it down without the apropriate password: Unplug / get rid of the battery. If you're stealing the notebook, why would you mind turning it off? After all, there'll be plenty of time back home to retrive the data.

I can see the error messages now...

[Elphin]

Error! Unable to open file!

In order to open this file you must move 3 metres northwest of your present position

British intelligence and self-destructo laptops

[call -151]

This has come up before- here is a link to a 2001 Wired article about the British intelligence services using laptops with ``a built-in electronic self-destruct mechanism that erases a laptop's hard drive if the case is opened by force'' when a code is forgotten, as well as ``a tracking feature that allows a computer gone astray to call home." This was after a spate of embarrassing episodes where laptops with lots of important info went missing. I don't know if it's been implemented but this does seem to have some interesting applications, potentially...

Thinkpads and RFID

[terrencefw]

IBM Thinkpads have had RFID in them for a while now, to prevent them being taken out of specific areas.

Why must it always be "the janitor"??

[gambit3]

A few years ago, a securtity head-honcho at my company gave a presentation about keeping confidential documents off our desks, because "you never know when the janitors can come in and just swipe it out with them. I know they don't speak Englis, but it doesn't take a lot to swipe stuff off a desk..."

I've had my fair share of stuff stolen, and it's never been a janitor.

Re:Why must it always be "the janitor"??

[Inda]

In my place the high paid engineers do all the stealing of laptops. The rest of us don't have access to them...

They take them home to do work in the evenings. They dial into the network for free internet. Their kids download Britney. Their begged CD burner is constantly burning audio CDs - they have to beg because there is no real reason for laptops having burners...

...they find out that they are unable to install latest_spyware_infested_program. They wipe the hard drive, install their own software (disabling dial-in in the process) and the laptop never sees the office again. They know they'll have a lot of explaining to do if the laptop ever needs rebuilding.

They see it as one of the perks of the job.

"Unplug / get rid of the battery"

[da5idnetlimit.com]

True, very true...

Also one should note that in most cases, when someones steals a laptop, it is for the laptop itself, and they couldn't care less for the data on it...as long as they can download the corresponding drivers later on...

One the laptop get sold, it'll suffer a quick reinstall. and the security dongle will become a nice high tech keychain 8)

+ This system assumes I have a physical access to the machine...

If I have physical access to the machine (usually you find them plugged into the network, and no screensaver password...) all I have to do is either install a quick soft from the net or from the cd/usb key I have with me...

Keylogger/bot/zombie/spyware/remote desktop... I can do whatever I want...and your security is breached...

Re:w0z is a nutjob at best...

[erikharrison]

Wozniac is a nutjob no doubt about it. He'd still be a legend, though, even if it weren't for Apple. He was an early phreaker, and a good friend of John Draper - Cap'n Crunch for gods sake! He was an important figure in the Silicon Valley hobbyist community, and even if he hadn't done either Apple or phreaking he'd still be a footnote in the big book of commodity PCs because of that. Certainly more than you or I can claim.

He and Jobs didn't start their relationship selling computers together - they originally sold blue boxes. Woz still works for Apple, mostly as a consultant, and he and Jobs still collaborate (though Woz has claimed that on many occasions Jobs credits him with ideas that he had minimal participation in).

Since leaving Apple he's been as much a humanitarian with his skills and money as Bill Gates (though in smaller absolute amounts). He personally provides free tech support for the local school system, and (at least when System 8 was still cutting edge) held computer classes for preschool and elementary school kids. He's sponsered charity concerts, and more.

Problem with Wozniak is he has a great technical mind, a wonderful sense of playfulness, and even a good sense of what users want in products, but his business sense is poor. That's why there hasn't been as much output from Woz since leaving Apple - their hasn't been a Steve Jobs. Wozniak was the Paul Allen to Job's Bill Gates, and much like Allen, Wozniak has dabbled here and their, with no truly successful financial venture yet. That doesn't mean he's worthless

Stop!

[buss_error]

'I'm being stolen! I'm being stolen!' and paging security as the janitor walks out the door with it."

I've been in offices for many many years. There has been only one time the Janitor Did It, and it was a case of they put it somewhere we wern't expecting.

Can we stop with the steriotype? All of the janitors I have known have been honest, hardworking people that are just trying to make a living. While I a sure there are dishonest janitors around, I sure that like anywhere else the vast majority are not crooks.

Re:Stop!

[TomorrowPlusX]

Not to mention that janitors -- being blue collar and generally lower on the social totem pole -- *know* they're the first to be suspected/fired when something goes missing.

Generally speaking the theives are coworkers, with sticky fingers. But usually it's people -- dressed nicely -- who just walk in off the street, looking like they belong, and picking something up and quietly taking off.

We've had a fair bit of the latter where I work.