Another Stab at Laptop Security

kogus writes "LoJack is licensing its brand name to Absolute Software, which provides Computrace -- soon to be known as the 'LoJack for Laptops' line of computer theft recovery systems. When a stolen Computrace-equipped system is connected to the Internet, it automatically and silently sends locating data to Absolute Software, which then calls out the law. In some cases, Absolute Software customers are eligible for a $1,000 guarantee payment when a stolen system is not recovered within 60 days.

Comments

Yay

[Nick of NSTime]

My PowerBook cost more than $1000.

Re:Yay

[Leroy_Brown242]

well, then you're pooched. Sorry. :P

Re:Yay

[Punboy]

I believe the point he is trying to make is that the $1000 compensation will not cover the cost of his laptop. He is not trolling.

Re:Yay

[Rickler]

If people are going to be forking out money to pay for a lowjack system in their laptop; it's most likly not about money but more about the data in the laptop.

Re:Yay

[B747SP]

I believe...He is not trolling.

I believe, Sir, that you've just been trolled.

Re:Yay

[qw(name)]

Agreed. In fact, if his laptop had Little Snitch installed the thief wouldn't have to worry about the Powerbook calling home to report the crime.

Of course, if a person were to steal another's laptop they should be smart enough to wipe it clean before using it.

Re:Yay

[weg]

Mine too, but my insurance paid the whole 1600 bucks after some burglars who broke into my flat took it with them. Though I'd really love to see those bastards caught.

Re:Yay

[Doug Neal]

Surely it covers the cost more than $0 does? :P

Re:Yay

[Nick of NSTime]

You would think so, except that by accepting the $1000 from LoJack, my insurance would not pay out the replacement cost of the notebook. So in other words, why buy LoJack for laptops when renter's or homeowner's insurance will cover the replacement value?

Re:Yay

[dgatwood]

The LoJack payment would pretty much cover the deductible on your homeowner's insurance. And it will pay off after 60 days, by which time your insurance company should have already paid the replacement value (minus the deductible).

Re:Yay

[Punboy]

Except he should said that his insurance would not pay if he had already recieved compensation from another source.

Re:Yay

[dgatwood]

But what I'm saying is that he -won't- have received compensation from another source when the insurance pays. So unless they ask for that money -back-....

Not secure at all.

[TripMaster Monkey]

From TFA:

When a stolen Computrace-equipped system is connected to the Internet, it automatically and silently sends locating data to Absolute Software, which then calls out the law.

Unless you:

• Block the outgoing signal with a firewall,
  and/or
  
• Wipe the drive, removing the Computrace software.
  
  Nice illusion of security....wonder how many people will fall for it.

Re:Not secure at all.

[gardyloo]

Yeah, but it's still silent! Unless you're some strange mutant person. In that case, get earplugs.

Re:Not secure at all.

[cosinezero]

Likely this would be on firmware; wiping the drive would be pointless (and probably past the abilities of most crackheads anyways - wiping the drives means a reinstall before resell). Blocking outgoing traffic on a possibly random port with a firewall isn't as easy to do as you'd think.

Re:Not secure at all.

[imaginieus]

Its not a perfect system, but its not like the computer has a sticker saying "Protected by Computrace Software". I bet the vast majority of thieves wouldnt even think about wiping the hard drive or setting up a firewall.

Re:Not secure at all.

[chrome]

I suspect it isn't intended for people concerned just about losing the hardware, but actually the data that is on the machine.

If someone steals a machine with the intent to stealing confidential information (god knows what people store on their laptops these days) then this sytem might be worth the money.

Regardless of intended use its more likely that someone in this line of espionage would know about this software and have a disconnected LAN they can use to dissect the machine on, and if its just simple theft, I suspect most thieves these days don't even bother to boot the machine and rather they just wipe it or ghost it so it can be resold quickly, like you say.

So, yeah, pretty much an illusion of security. Marginal at least.

Re:Not secure at all.

[KiloByte]

Well, how many thieves will have the knowledge necessary to block and wipe the related software? Not too many.

While no half-competent crook will let himself be caught this way, all that counts is whether (price_of_Computrace)/(probability_of_laptop_being _stolen)<$1000.

Re:Not secure at all.

[Penguinshit]

It sure as hell is. You block everything except the few things you know you need or want. Most Win32 home firewalls also allow you to block specific applications.

It's rather trivial, actually.

And anybody who's going to swipe a laptop will probably wipe the drive with a reinstall because they won't be able to log into the system to poke around (unless they intend on hacking the login; again a rather trivial task once you have physical possession).

Re:Not secure at all.

[Anonymous Coward]

Blocking outgoing traffic on a possibly random port with a firewall isn't as easy to do as you'd think.

Nah, it's easy. Just set Inside Any -> Outside Any -> Service Any -> Deny and hit then add it ^&^&^&$&%&^[NO CARRIER]

Re:Not secure at all.

[TripMaster Monkey]

Here's a snippet from their website:

Computrace Agent
The Computrace agent is a small, software client that resides on the hard drive of host computers and enables Absolute's services. Easy to install and unobtrusive to the end-user, the agent requires minimal bandwidth in its communications to the Monitor Center.

Doesn't look like it's on firmware to me...

Re:Not secure at all.

[TripMaster Monkey]

If someone steals a machine with the intent to stealing confidential information (god knows what people store on their laptops these days) then this sytem might be worth the money.

How do you figure? All I have to do is dump the data while airgapped. Problem solved.

Re:Not secure at all.

[chrome]

I know nothing of this airgapping of which you speak... :)

Don't forget the 'might'.

Like I said, I'm not convinced.

Re:Not secure at all.

[GrBear]

Nice illusion of security....wonder how many people will fall for it.

- How many corporations continue to run MS IIS to drive their corporate websites?

- How many people continue to run IE?

- How many people continue to run Windows and download the latest spyware infected software because it's trendy, even after they've had their computers infected countless times?

Your right, security is an illusion, and some people prefer to turn a blind eye rather than look at the root cause.

Re:Not secure at all.

[cosinezero]

What's the likelihood it will become firmware once wireless manufacturers hear about it? Think about it...

Re:Not secure at all.

[shmlco]

It's rather trivial, actually.

Of course, the "phone home" message could be a garden variety http/s request. So unless you setup your firewall to deliberately block your own web access....

It's rather trivial, actually.

Re:Not secure at all.

[Anonymous Coward]

it sits on the MBR of the HDD

you just fdisk /mbr or run grub/lilo and it kills it.

Re:Not secure at all.

[mikefe]

I think "airgapped" referrs to being physically disconnected from a network. Unfortunately this term came into use before wireless networks became popular, hence the low usage today.

Re:Not secure at all.

[bhtooefr]

There IS a Computrace Agent BIOS edition, but that is only available on laptops that offer it as part of the BIOS, of course (IBM's i915-based laptops have it as an option, FWIW).

Re:Not secure at all.

[pilgrim23]

reminds me of the security of Thinkpads (thumbprint), which in turn reminds me of a car with such a lock in...Malaysia I think it was... where the carjackers merely cut off the owner's thumb as a means to defeat security. When in doubt, use a bigger machete....

Re:Not secure at all.

[Qzukk]

You block everything except the few things you know you need or want.

You probably want http, so the firmware could do http://www.laptopjack.com/report.pl?laptopid=AF314 229B2C&gps=55N33E or whatever the hell it sends. If the result comes back "you've been stolen!" it halts the computer and prints FBI! on the screen or whatever. If theres no network or the laptop is not stolen yet, it boots normally and waits until next time.

The whole logic could be embedded in a boot rom on the card, with DHCP and all. Or, if you custom-made the ethernet card, it could even store the last IP address and gateway, and use that next time you boot if DHCP failed. You could even theoretically set it to do this every few hours or something when the network is idle-ish, so that if someone nabs it while its running and keeps it on all the time, it still gets a chance to report.

If you wanted to be REALLY tricky, you could hit other sites first and test for the presence of proxies or what not, then go through a few options, like SSL client authentication using a stored certificate to identify the laptop if a direct connection can be established. Or using just normal client SSL if a proxy that will allow it is detected. Or last ditch, http:

Re:Not secure at all.

[Lord Apathy]

If I steal a laptop for the data on it the first thing I'm going to do remove the hard drive then trash the laptop. It's harder to trace a hard drive than the laptop. Then I'm going to hook the harddrive up to a decicated computer and mount it instead of putting it into another computer and booting off of it.

Once I have the data I'm goign to trash the harddrive.

Re:Not secure at all.

[Qzukk]

Interesting, slashcode now automatically converts URLs to links in the Plain Old Text setting. Didn't know that. Not my fault if someone registers that domain and puts something bad there.

Re:Not secure at all.

[NanoGator]

"Nice illusion of security....wonder how many people will fall for it."

Depends on what kind of thief we're talking about.
I shouldn't have to go into that kind of detail, though. Just because one can semi-easily get around it doesn't mean it's worthless. I mean, that'd be like saying "Welp, why bother locking the door? They'll just break the window."

Let's talk about reality for a moment: It has been widely known, for DECADES, how to avoid leaving fingerprints at the scene of a crime. Despite being basically beaten over the head with the knowledge of how to do this, people are still busted with fingerprints every single day.

I'm sure somebody somewhere said "Gee, all you'd have to do is wear gloves."

Re:Not secure at all.

[Penguinshit]

Since the site itself tells me that this is nothing more than software, and that replacing an internal NIC (which almost every laptop sold today has) is prohibitively expensive (in most cases requiring a modified motherboard), I'll reiterate my comment about the blocking/discovery being quite trivial.

Set up a non-Internet-connected pen and see what tries to get out of your fully locked down firewall system. Remove offending code. Rinse, repeat.

Or, better yet, just boot from CD and wipe the drive (which is what's most likely going to happen anyway).

Re:Not secure at all.

[Anonymous Coward]

IIS huh?

http://blogs.msdn.com/michael_howard/archive/2004/ 10/18/244181.aspx

Re:Not secure at all.

[penix1]

(Sans M$ rant)

"You['re] right, security is an illusion, and some people prefer to turn a blind eye rather than look at the root cause."

You were ranting on about data / network security which is a little different than physical security. Try and guess where most laptops are physically stolen from? Give up? The airport where bagage handlers are usually the guilty party. Not too long ago they made a whole slew of arrests here in my city of bagage handlers who stole laptops, cameras, camcorders, etc.. from people's luggage.

B.

Re:Not secure at all.

[Locke2005]

To say nothing of the following: how does the laptop know that it has been stolen, and not just taken on a business trip? Does it send a report to Computrace every time it connects to the internet?

Re:Not secure at all.

[cyrix]

Of course you are assuming that the person who steals it knows something about computers. Let's say you live on a college campus, and your computer gets jacked from the library. Chances are it's some clown who knows diddly squat about computers. I mean think about how many computers are stolen, now what percentage would you assume knows how to block the signal with a firewall or wipe the drive?

Re:Not secure at all.

[drsquare]

You're assuming that the thief knows all this. How many people who steal laptops know much about computers? How many of them don't even know what af firewall is, but steal a laptop and then sell it for 50 quid down the pub a few hours later?

Most thieves aren't computer experts. And as most laptops won't have this 'anti-thief' technology, they won't be expecting it, they'll probably never have heard of it. They'll think it's going to be sellable, so they'll still steal it.

Although even if this device 'phones the law', by the time the police bother to get involved (12 weeks later), the laptop will have passed through half a dozen hands.

From this, I can conclude two points:

1. The technology won't stop any thieving at all.
2. If your laptop is stolen, by the time it manages to report it to the police, it will be too late.

Re:Not secure at all.

[Nova1313]

if the law is as good as they are with the lojack car theft systems then it could be effictive. My friend had a car recovered in under an hour after the report. Very nice system.

After I saw that I had to get one for myself.

Re:Not secure at all.

[mo^]

I've had a few people get them stolen from airports too. Often from right on top of their suitcase while they nip into a duty free shop or to make a phone call. Actually watched in on airport security files later too whilst filing the reports.

Can't expect execs to keep an eye on things, they are far too important (us lower-middle rankers seldom have stuff stolen cept in break-ins or muggings in my exp.).

Gotta hand it to corporate wisdom of carrying a nice uniform case with "Dell" or somesuch emblazoned on the side, make you know just what you're getting.

Re:Not secure at all.

[joto]

I think you forgot the part that said win32 firewalls. These firewalls block programs from sending outgoing requests. I.e. internet explorer is allowed to connect, but not phonehome.exe. Ports doesn't matter much.

There are tricks to work around this, using dll's or explorer plugins, but some win32 firewalls can deal with that with some sofistication too (although it's more painful for the user to configure it right).

Then again, I bet people who use stolen laptops tend to wipe the disk clean, unless they're into industrial espionage, in which case they would probably take a lot of precautions anyway (and certainly not connect it to the Internet). A better solution would be hardware-based.

Re:Not secure at all.

[guile*fr]

thats when the c4 rigged plates come into play.

Re:Not secure at all.

[joto]

2. If your laptop is stolen, by the time it manages to report it to the police, it will be too late.

Too late for what? For recovery? No. For prosecution of the thief? Probably. For prosecution of the moron who bought it and knew it was stolen? No.

It's unlikely anyone but the last buyer will even attempt to connect it to the Internet. So whether the police uses 12 weeks or 4 months to get to him doesn't matter much, they will still find the laptop, and someone to put in jail.

On the other hand, the mechanism only works on idiots. If I were to buy a stolen laptop (not that I'm into that kind of thing anyway), I would of course wipe it clean, just as I do with any other new or used computer that gets into my hands...

Re:Not secure at all.

[E8086]

Now that wirless networks are more popular, especially the unsecured ones, this could work well with internal wireless cards. You can't easily block a connection to your neighbor's open network unless you put it next to your own open AP not connected to the Internet or keep it in your own faraday cage lined room. Even that may give the trackers a general location and your neighbor can truthfully say they know nothing about it, could have been someone parked outside in their SUV.

If you really want the laptop and the data go and get a USB 2.5" drive case and pull out the hdd, copy then wipe it and install the software of your choice. If you're that concerned about your "borrowed" hardware then forget to install the drivers for any internal network card(s) and only use pc cards.
If you do get caught with a hot laptop, you did remember to report it to a lost&found somewhere? "So you see officer/Mr FBI agent, I found this laptop on the train/bus and I DID report finding it and turned it on to look for an Owner.txt/ RewardIfFound.txt to try and contact the owner."

Re:Not secure at all.

[ASUSanator]

Yeah hehe i remember that story http://news.bbc.co.uk/2/hi/asia-pacific/4396831.st m

Re:Not secure at all.

[HavokDevNull]

I also wondered about that as well, so I jumped on the website and did a bit of research before posting here.

FROM FAQ

Q. Can ComputracePlus be detected?

A. On most PCs, the Computrace Agent, which powers ComputracePlus, is silent and invisible and will not be detected by looking at the disk directory or running a utility that examines RAM. On many PCs - depending on their operating system - the Agent cannot be erased off the hard drive by deleting files because it is not visible in file directories. The Agent can survive a hard drive re-format, F-disk command and hard drive re-partitioning. The Agent can be removed by an authorized user with the correct password and installation software.

On a Mac system, it is very difficult for a standard user to deliberately or accidentally delete the Agent as the files cannot be deleted by anyone other than the root user.

Q. What happens if a computer's hard drive is removed? A. The Computrace Agent resides on a computer's hard drive so if the drive is removed and installed on another computer, the Agent will initiate contact with the Monitoring Center at its next scheduled call. It will then report its new location. The original computer will no longer be protected.

Re:Not secure at all.

[penix1]

"Gotta hand it to corporate wisdom of carrying a nice uniform case with "Dell" or somesuch emblazoned on the side, make you know just what you're getting."

Call it a courtesy...;-)

Anyway, those handlers had houndreds of thousands of dollars worth of equipment in their homes when the search warrent was executed (while they were at work getting arrested and seeing the video of their doings). Thing that gets me is it took months for the police to catch on to them. Either way, it is a hell of a way to lose your job and your freedom.

B.

Re:Not secure at all.

[pr0c]

GrBear (63712): Nice illusion of security....wonder how many people will fall for it.

- How many corporations continue to run MS IIS to drive their corporate websites?

- How many people continue to run IE?

- How many people continue to run Windows and download the latest spyware infected software because it's trendy, even after they've had their computers infected countless times?

Your right, security is an illusion, and some people prefer to turn a blind eye rather than look at the root cause.

IIS 6 (3 advisories)http://secunia.com/product/1438/
IIS 5 (11 advisories) http://secunia.com/product/39/
IIS 4 (6 advisories) http://secunia.com/product/38/

Apache 2 (24 advisories) http://secunia.com/product/73/
Apache 1.3 (15 advisories) http://secunia.com/product/72/

Apache - 29 Advisories
IIS - 20 Advisories

Did I miss something?

Re:Not secure at all.

[Alan Hicks]

people are still busted with fingerprints every single day.

Myth (at least in the US). Fingerprint "evidence" is rarely ever used in practice these days. Police still dust for prints though, because it's easier to dust for them than it is to explain the following to the irrate victim who just lost his TV.

1. Fingerprints are never pristine. Every one of them is a blurred smudge except in the rarest of situations. The chances of finding even a single print reliable enough to ID some one are small.
2. Your local sheriff or police chief doesn't have a database of finger prints. This information has to be retrieved from the FBI, which doesn't even have prints for everyone in the country. Illegal aliens are particularly immune from a fingerprint database search.
3. The FBI has more requests for fingerprint checks than they can handle, so you're at the tail end of a long line.
4. Searching the database isn't exactly a sure fire thing. Tons of false positives are hit all the time, particularly if you have limited information. Thus the FBI rarely accepts a request to run a fingerprint scan unless you have a complete set of fingerprints for one hand, and they'd better be clear prints too, not smudged.

Ask your local detective sometime to talk to you about it, or ask the D.A.'s office to give you the cold hard truth about how often they admit fingerprint "evidence" in a trial, and how often it helps lead to a conviction.

Re:Not secure at all.

[Anonymous Coward]

Apache - 29 Advisories
IIS - 20 Advisories

Did I miss something?

Yeah. You missed the fact that all of the IIS advisories were remote access vulnerabilities, while the Apache advisories were mostly DoS attacks and local privilege escalation.

Re:Not secure at all.

[Anonymous Coward]

A $1000 warranty isn't an illusion.

Re:Not secure at all.

[QuickFox]

I've always felt that the United States seems full of contradictions, but this is absolutely amazing!

Fingerprint "evidence" is rarely ever used in practice these days.

The FBI has more requests for fingerprint checks than they can handle,

the FBI rarely accepts a request to run a fingerprint scan

--

Re:Not secure at all.

[NanoGator]

"3. The FBI has more requests for fingerprint checks than they can handle, so you're at the tail end of a long line."

So... lemme see if I understand this: Fingerprints aren't in use, but there's along line to get data from them.

Re:Not secure at all.

[jp10558]

Hmmm, my laptop has an external switch to turn on or off the wireless card. Probably so you can use it in hospitals or on airplanes and the like. I would guess most laptops would, mine was quite cheap...

Re:Not secure at all.

[eric76]

The only computer thief I know probably doesn't have the vaguest idea how to spell "firewall".

The punk can't even pass in the easiest school they could find for him to go to 200 miles from home. He turns 18 in a month and you can bet he'll never step foot in another school building unless it is as a janitor or something.

Most of his friends are equally brilliant.

However, if it does pass through a dozen hands, it might still be recoverable even if they can't identify the original thief. It doesn't matter if the person who ends up with it thought he bought it in an honest transaction -- it is still stolen and returnable to its rightful owner.

Whether or not it ever makes it back to the owner is another story even if it is siezed by the police. I have the impression that they often don't make that big an effort to return it to the owner.

Re:Not secure at all.

[Anonymous Coward]

Presumably they're not calling the cops if the owner hasn't reported it stolen.

Re:Not secure at all.

[InvalidError]

If I stole a laptop, I would...
- First boot it to see if there is anything interesting on it and copy anything that may be useful
- Then check out if it has any interesting hardware in it I may upgrade my own laptop with (like a compatible 1GB SODIMM so I can have 2GB total)
- Wipe it clean (and possibly reinstall) before reselling to make it harder (or possibly impossible) for the buyer to determine the actual origin (unless I decided to keep it)

Re:Not secure at all.

[Anonymous Coward]

Yup, if I were an industrial spy, I wouldn't boot up the stolen laptop, just remove the harddisk and plug it into another system where it wouldn't be the system/boot disk.

Re:Not secure at all.

[InvalidError]

So it would have to be airgapped within a suitable Faraday cage or equivalent - wrap the laptop in tin foil and use external KVM.

Re:Not secure at all.

[ars]

On the other hand, the mechanism only works on idiots. If I were to buy a stolen laptop (not that I'm into that kind of thing anyway), I would of course wipe it clean, just as I do with any other new or used computer that gets into my hands...

Are you sure? If you got a laptop wouldn't you boot it just to see what's on it, and then wipe it clean? It's too late though - you booted it.

It might not be connected to the net, true. But A: it could have wireless, and B: even non idiots will possibly connect it just for a little while - I mean you have this nice new computer just waiting to be used, let's browse just a little. And only then wipe it clean.

Re:Not secure at all.

[Anonymous Coward]

the Agent cannot be erased off the hard drive by deleting files because it is not visible in file directories. The Agent can survive a hard drive re-format, F-disk command and hard drive re-partitioning

Notice they only mention things that change the partition table. They just wrote a MBR boot sector virus, nothing more. Installing LILO or wiping the disk will destroy the agent. I imagine it just stealths itself into some normal Windows executable and runs from there.

To protect my laptop I password protected the BIOS admin password only and disabled booting from anything but the hard disk. Make it just hard enough to reinstall the OS, but still fully usable, and no one will bother to remove the little utility that will help me track them down. That's the best money spent for a WinXP partition that I can think of.

Re:Not secure at all.

[pcmanjon]

Apache - 29 Advisories
IIS - 20 Advisories

Did I miss something?

Yes, you did.

You see, that website is run by Linux security experts, and so consequently, they feature Linux exploits more oftne.

If you must look at it cynically -- Apache 2 in my opinion is a POS. The rest of the net must agree too, because rarely to I find webservers running Apache 2, mostly just Apache 1.x

Re:Not secure at all.

[joto]

But A: it could have wireless, and B: even non idiots will possibly connect it just for a little while - I mean you have this nice new computer just waiting to be used, let's browse just a little. And only then wipe it clean.

Good point.

Re:Not secure at all.

[k8to]

Okay, well, I don't pretend to know what they actually did, but there is a BIOS edition of their software, and there are such things as "reserved areas" in the ATA spec, disk areas which are not visible in the normal formatting/addressing space of the drive, but are intended for special recovery/restore type activities in conjunction with the BIOS or operating system.

With a BIOS set up for this and a reserved area that is not removed with special tools, this could survive an entire disk wipe.

I kind of doubt you could fit much useful in the mbr for this purpose. It's only 452 bytes or something and needs to include functional boot code as well.

Re:Not secure at all.

[Anonymous Coward]

Excuse my ignorance, but could anybody explain the joke? I don't get it.

Re:Not secure at all.

[skiflyer]

If I were to buy a stolen laptop (not that I'm into that kind of thing anyway),

Why do you assume the buyer is aware they've just purchased a stolen laptop?

If I were a laptop theif I don't really imagine my target market is people who want stolen laptops (unless I steal so many I use a fence)... I imagine it's the ebay crowd, and perhaps I'm rebranding them as company used decommissioned laptops to explain the pre-installed crap. Or maybe I'm at a swap meet dumping them relatively cheap etc.

Alot of buyers of stolen equipment would likely know it if they bothered to think hard on it, but they also tend to just not ask and hope they're really getting a great deal.

Re:Not secure at all.

[flosofl]

That's freaking hilarious!

I just did that for real last week. Some guy came over and wanted to know how to tweak /dev/ethX settings (ethtool). Well, I was showing him (he's just getting into administering Linux stuff) and then I said if you ever need to bring an interface down you do this...and then I did it. On a box I was ssh'd into. Had to go down 6 floors into the test-lab to connect my laptop to the console port and bring the interface back up... Thank God it was only a lab box.

Re:Not secure at all.

[doubledoh]

I agree. As an professional industrial spy, this is exactly what I do.

Re:Not secure at all.

[wo1verin3]

>>Yup, if I were an industrial spy, I wouldn't boot
>>up the stolen laptop

Or boot it up and DON'T connect a network adapter or phone line... and pray to god it doesn't have a wireless and you don't have an open access point... hrm you're right your method is easier.

Re:Not secure at all.

[RobertLTux]

this joke is a network version of cutting off the limb of a tree YOU ARE CURRENTLY SITTING ON when you hit save/add you get cut off from the box you are working (remotely) on

Re:Not secure at all.

[X0563511]

It's a software switch, not always used for what it's meant for. For instance without the specific software it doesn't work. Don't trust it.

Re:Not secure at all.

[E8086]

this is the first I've heard of that feature, which brand?
Turning off unused devices is a nice battery saver.

Re:Not secure at all.

[Yert]

I want your job. Not _your_ job, but _that_ job. You get the idea. How does one get into that line of work, and who's dick do I have to suck?

Re:Not secure at all.

[loraksus]

So, where do I get the amazing mental powers shared by you and Johnny Smith of Dead Zone fame that tell me that something was stolen or not.
Sure, off the back of a truck, etc, is pretty obvious, but people post used stuff on craigslist etc all the time and you really can't tell.

Re:Not secure at all.

[Trepalium]

I seriously doubt there is any single network administrator that hasn't done this AT LEAST once. Usually with these thoughts immediately following pressing enter (or Ok, or save, or...):
"I didn't do what I think I just did, did I? ... shit, shit, shit."

Followed immediately with a sprint to whatever machine was just rendered inoperative by that mistake.

Re:Not secure at all.

[weg]

Well, it's worth a try, but you won't have to pay for such a solution, at least not if you made your laptop reasonably safe by using passwords.
I found The Beacon on the Internet (Google Cache, PDF version is on Rufy.com), that's something every moderatley talented programmer can do to secure his laptop... (using cron and scripts).

Re:Not secure at all.

[Anonymous Coward]

Are you sure? If you got a laptop wouldn't you boot it just to see what's on it, and then wipe it clean? It's too late though - you booted it.

I might boot it just for that purpose - with a Knoppix CD, I'm not going to be trying to figure out what Windows password the guy set. And I'm not going to put it on the internet until after wiping it, who knows what kind of shit is on the machine - virus'es, worms, spam bots, DDOS bots, phone home software...

Re:Not secure at all.

[Gumph]

my sig says it all really!!

Re:Not secure at all.

[Anonymous Coward]

Read up on MBR booting and the viruses which hijacked it before commenting.

Even LILO actually reads several sectors from elsewhere on the disk (wherever the chain loaders lie) and executes those - plenty of space for code. Windows (NT/2K/XP) typically will not allocate the last cylinder of the disk to any partition - room on disk to store those few sectors.

As for reserved areas... two options. I doubt the disks come from seagate et al with the phone home code preinstalled. So IBM et al or Computrace must be installing this, and if they can, someone else can overwrite/remove it.

Alternatively, put a new disk in. Disks are cheap compared with the laptop hardware itself.

And BIOSes can be flashed. There are several sites around discussing disassemblies of standard bioses.... notably IBM laptop bioses, refer to the article on slashdot recently about mini PCI cards being refused by said laptops.

Besides, many laptops are stolen for the data on the disk - excellent corporate espionage, making this whole line of argument moot.

Re:Not secure at all.

[Anonymous Coward]

"...if the drive is removed and installed on another computer, the Agent will initiate contact with the Monitoring Center at its next scheduled call."

Assuming they include an appropriate driver for the network card in the other computer. Lots of drivers = lots of space required = harder to hide.

Process: steal shiny new laptop. Put hard disk in old laptop with old (unsupported) NIC. Throw away old (10GB) hard disk in old laptop. Buy new 80GB+ hard disk for shiny new laptop. Computrace thwarted.

Re:Not secure at all.

[Anonymous Coward]

>Did I miss something?

Yeah: 24 + 15 = 39

Re:Not secure at all.

[Firethorn]

Or better yet, yank the HD and place it(with suitable adapter) into a desktop to pull all the data/format.

This product counts on the laptop thief to be like most thieves (who get caugth), stupid and or lazy.

Re:Not secure at all.

[TheLinuxWarrior]

6 floors? That's all?

Try 30 miles away at a colo. :P

Re:Not secure at all.

[Doug Neal]

It would be possible to sneak enough data out to make a theft report in a carefully constructed DNS lookup (with a specially made DNS server at the other end obviously)...

Re:Not secure at all.

[InvalidError]

This would go against the /. tin foil&duct tape first policy.

As for removing the HDD and using an adapter (or external 2.5" case), this works only when the OEM did not glue some proprietary header to the HDD's connector or use so-fitted HDDs. (For large OEMs, ordering customized parts is not uncommon.)

In my case, the HDD has a comb-like connector plugged in. Although there is no evidence of glue, getting it off requires more force than I felt comfortable with (a few times what I am used to for plain headers) so I gave up.

Re:Not secure at all.

[Molochi]

Recent Acer Travelmates (TM3200, TM2300/4000 for example) have a large illuminated button that turns the wireless card on and off. Same with bluetooth. I've also seen quite a few that use a Fn+ hotkey combo that does the same thing. I would prefer the later as it is less likely to accidentaly to happen.

Re:Not secure at all.

[smyle]

Followed immediately with a sprint to whatever machine was just rendered inoperative by that mistake.

...or calling somebody that has a key and talking them through it, because the machine in question is 200 miles away.

*blush* ... ummm... not that I'd know that from first-hand experience or anything...

Re:Not secure at all.

[Anonymous Coward]

Thank God it was only a lab box.

Remind me never to give you the root password to anything outside the lab.

Re:Not secure at all.

[bagofbeans]

It also *knew* that you wanted the first sentence italicized. Wow!

Methinks you were HTML Formatted, ol' son.

Re:Not secure at all.

[jp10558]

Well, it's a cheap Toshiba Satallite. It flips a light on and off on the front, and causes windows to either see or not see the wireless card.

Re:Not secure at all.

[Anonymous Coward]

>>How does one get into that line of work, and
>>who's dick do I have to suck?

You could start with mine!

Re:Not secure at all.

[todu]

You probably want http, so the firmware could do http://www.laptopjack.com/report.pl?laptopid=AF314 229B2C&gps=55N33E or whatever the hell it sends.

"Hello Mr Thief,

Your ip address has been sent to the legitimate owner of this laptop with a copy sent to the owners local police station. The ip address is traceable to you personally. I suggest you post this laptop back to me (the owner) within a week at the below address. If you choose not to post it yourself, the police will come and get it for me. They may be less understanding.

Kind regards,

Tommy"

Re:Not secure at all.

[Anonymous Coward]

Its more common than you might think. Engineers in highly competitive industries move around a lot. Having two sources of income (previous employer and target company) is very tempting. Make sure that you get a guarantee of legal fees from previous before trying this. I know someone who got burned.

Re:Not secure at all.

[shmlco]

I think you forgot the part that said win32 firewalls.

I think YOU need to think about what you just said.

Win32 firewalls? You mean the win32 firewall on the notebook you just booted up? The win32 firewall running on the stolen notebook? The one its owner would have deliberately UNBLOCKED so the anti-theft protection worked? The one that just let the program phone home while you were messing around trying to block it from doing so? THAT win32 firewall?

I did miss that. Thank you.

manufacturers

[JimmyJava]

should build this into the hardware or the bios. i know if i stole a computer i wouldn't be in a rush to plug into the internet. unless of course it's a windows machine, in which case i've got a good solid 12 minutes to play around with it.

Re:manufacturers

[inexplicable_fool]

Yeah, but Jo-sixpack's probably not going to think of that. I don't think most of the people that swipe laptops on trains/in airports are regualr /.'ers. They'll probably just sell it on without touching it. So there's certainly a fair chance that someone somewhere will f**k up and get caught. God knows it happens enough!

Re:manufacturers

[Nohea]

No they shouldn't - if i had one in a laptop, i don't want people i don't know tracking my movements. My car too (ok i buy used).

Re:manufacturers

[pg110404]

unless of course it's a windows machine, in which case i've got a good solid 12 minutes to play around with it.

yeah, but after the 12 minutes are up it's not much fun anymore, so then what? Wait for the cops to show up by looking at all them viagra pop up windows?

Re:manufacturers

[mkendall]

Manufacturers should build this into the hardware or the bios.

They do, apparently. The press release says IBM/Lenovo ThinkPads have it in the BIOS. It can survive image reloads and hard drive swaps.

Re:woulda read it...

[Anonymous Coward]

Just wait 15 seconds, the box clears on its own.

Most Stolen Laptops are stripped within minutes

[Anonymous Coward]

The bastards have even developed very tiny cinder blocks which they leave the empty laptop skeletons propped on.

Re:Most Stolen Laptops are stripped within minutes

[Anonymous Coward]

I bet he lives in Essex

Re:Most Stolen Laptops are stripped within minutes

[pg110404]

This works for cars. It's hard to tuck a car under your arm so they strip it of the easily removed items like tires.

The more organized car heists either go to a chop shop or are put on a boat overseas.

There's no point canibalizing a laptop when it can easily be taken in one piece. What you meant to say was that the laptops are put on a boat for overseas countries within minutes...

Where perhaps they're to be used as spam relay bots?

Re:Most Stolen Laptops are stripped within minutes

[Anonymous Coward]

*WHOOSH* That's the sound of a good joke going right over your head.

software?

[Anonymous Coward]

If I were to steal a laptop, the first thing I would do would be to format it if i could. I hope this isn't a software solution. If it was a hardware solution, it would seem likely that it would be so expensive it would probally ofset the cost of the laptop. (hardware to phone home... am I stolen?) + monthly fee.

Re:software?

[TripMaster Monkey]

Again, here's a snippet from their website:

Computrace Agent
The Computrace agent is a small, software client that resides on the hard drive of host computers and enables Absolute's services. Easy to install and unobtrusive to the end-user, the agent requires minimal bandwidth in its communications to the Monitor Center.

It's looking a lot like software...

Who posted this crap anyway?

[Anonymous Coward]

Link is bad. I hate this.

Maybe I'm a little high, but...

[inkdesign]

Is the groundbreaking gorilla of stolen vehicle recovery committing Peter Lynch's cardinal sin of deworsification into the unrelated field of hard-drive hacking?

...could this perhaps use a little dewordification?

Re:Maybe I'm a little high, but...

[Beardo the Bearded]

I think "deworsification" is supposed to be like "diversification" but pointless. e.g. if your local doughnut shop started carrying roofing tiles.

what happens?

[Mo B. Dick]

If the person who steals the computer just reformats the hard drive?

Re:what happens?

[Valiss]

Then the laptop owner gets a grand.

Frist post

[Anonymous Coward]

yeah!

Re:woulda read it...

[PitaBred]

You could just click the "close form" link in the upper right of that information request. It wasn't a demand, just a very obtrusive request.

huh?

[zoloto]

...you insensitive clod???

Ah...

[HillaryWBush]

1. Purchase $500 laptop
2. Purchase $100 security
3. Purchase $100 spyware remover
4. "Lose" laptop
5. Wait 60 days
6. Profit $300 for 60 days work
7. GOTO 1 (I never spaced lines by 10, what was up with that)

Re:Ah...

[Anonymous Coward]

LOL, what? That makes no sense, and if it even works, it's too much work for too little reward.

Re:Ah...

[Anonymous Coward]

What if you want to add another line between lines 3 and 4 and you have 1000 lines of code? Are you really going to relabel ~1000 lines code? With increments of 10 you can easily slide a new line of code in between them.

Re:Ah...

[Paolo DF]

I like spacing by 10, it gives to me that feeling I can insert other lines.
That is, BTW what I ususlly did

Re:Ah...

[mallardtheduck]

I never spaced lines by 10, what was up with that
That was so you could insert extra lines between the ones you already had in the pre-screen-editor period. RENUMBER would also conviently space all lines by 10 for this purpose.

Re:Ah...

[Anonymous Coward]

Your plan seems pretty good, but it's missing something. Looks like you forgot the "????" step.

I'll just insert it between lines 50 and 60...

Re:Ah...

[kesuki]

(I never spaced lines by 10, what was up with that)

It was for debugging, the 0 column was perfect for sliding your finger down the page of printed code.

Re:Ah...

[Anonymous Coward]

You're gonna have problems with those periods anyway. Replace with : or you will get a syntax error on line 1.

God I suck.

Re:Ah...

[rudydog]

Never use go to it should be like this.

While(1) { 1. Purchase $500 laptop 2. Purchase $100 security 3. Purchase $100 spyware remover 4. "Lose" laptop 5. Wait 60 days 6. Profit $300 for 60 days work }

Re:Ah...

[Beardo the Bearded]

You spaced the lines by 10 in case you had to add more lines of code without rewriting everything that you'd already written after that point.

For example, if you'd written:

1. Purchase $500 laptop
2. Purchase $100 security
3. Purchase $100 spyware remover
4. Wait 60 days
5. Profit $300 for 60 days work
6. GOTO 1

You'd have to add line 4, the "lose" laptop option. Then you'd have to rewrite lines 5 and 6 then add line 7.

On the other hand, if you'd written:
10. Purchase $500 laptop
20. Purchase $100 security
30. Purchase $100 spyware remover
40. Wait 60 days
50. Profit $300 for 60 days work
60. GOTO 10

You could just enter: 35. "lose" laptop. Less muss, less fuss.

Re:Ah...

[Anonymous Coward]

Dude this is BASIC, get real.

10 PUNCH BALLS
20 GOTO 10

Re:Ah...

[PitaBred]

Dude... it's BASIC. There were no loops. That's why he used GOTO.
But it's good that you pay attention blindly to what your teachers tell you.

Re:Ah...

[slavemowgli]

7. GOTO 1 (I never spaced lines by 10, what was up with that)

The idea was that if you needed to insert a line or two at some place in your program, you'd be able to do so without renumbering all lines.

Re:Ah...

[Anonymous Coward]

There are times when goto is absolutely the best choice; but especially in assembler and BASIC!

Re:Ah...

[jasha]

3 goto 1001 ...

1001 REM old line3
1002 REM new code
1003 goto 4

easy as pie!

Re:Ah...

[Anonymous Coward]

It's people like you that gave basic programs the nickname spaghetti code.

Re:Ah...

[Anonymous Coward]

FROM TFA:
Q. If the recovery is unsuccessful, what are the conditions for the money back guarantee?
A. In order to be eligible for the money back guarantee on the Computrace Personal software purchase, the following conditions must be met:

* A theft report must be submitted with local law enforcement and a record of this report, including the police file number should be obtained.
* A report of theft or loss must be made to the Computrace Personal recovery team within seven (7) days of the police report submission, including the required details as indicated. The report may be submitted via the Computrace Personal website or directly with the recovery team through fax or phone at 1-604-608-4930.
* The theft or loss must have occurred within the United States , Canada , or the District of Columbia.
* The agent software must have successfully completed a minimum of one (1) call event during the thirty (30) days immediately preceding the date of the customer reporting the theft to the Computrace Personal recovery team.

Meaning that you have to plug your laptop onto the internet at least once after line#4 and before line#5. So, not spacing line by 10 is not a good idea.

Re:Ah...

[drsquare]

That's only $1,825 a year. Do you have any proposals for a scheme which would give a decent return on investment? Perhaps if you bought a thousand laptops under sucha scheme, that would give you 1.8 million laptops. Although the problems then would be when they decided to stop giving you insurance after you 'lost' a hundred laptops. You'd need more people in this scheme, although they'd want their own cut and that would eat into the profits.

Re:Ah...

[SpaceLifeForm]

Especially since he's gonna have to add a subroutine named 'call-lawyer' after looping enough times.

Re:Ah...

[Buradorii]

* The theft or loss must have occurred within the United States , Canada , or the District of Columbia.

Since when was DC not part of the United States?

Re:Ah...

[hAN sHAN]

Perhaps the OP never made a mistake and never needed to insert a line.

Re:Ah...

[Anonymous Coward]

Since when was DC not part of the United States?

It's not part of any 'State', it's a District.

Re:Ah...

[g-san]

Nah, just sprinkle more GOTOs:

1. Purchase $500 laptop
2. Purchase $100 security
3. Purchase $100 spyware remover
4. Goto 8.
5. Wait 60 days
6. Profit $300 for 60 days work
7. GOTO 11
8. Lose Laptop.
9. Report laptop Stolen.
10. Goto 5.
11. REM I never spaced lines by 10, what was up with that
12 Goto 1.

gosub is for wimps.

Re:Ah...

[HillaryWBush]

But spacing lines by 10 would cause the program to run ten times slower, right? Right?

Re:Ah...

[Desert Raven]

Since when was DC not part of the United States?

Funny thing is, it kind of isn't. See to be part of the United States, it would have to be a state, which it isn't. Yes, that may sound pedantic, but essentially it's true, DC is somewhere between being part of the US, and being a US territory (ala Puerto Rico or Guam). It's a legacy from a time when the US was more of a conferedacy of independent states rather than the homogenized federal system we have today.

But suffice it to say that there's a whole lot of legal things about DC that are different from the states.

Re:Ah...

[stoborrobots]

But spacing lines by 10 would cause the program to run ten times slower, right? Right?

Yeah! you're right!

Oh, wait... or was it ten times faster?

Hmm... I forget... Damnit!

Re:Ah...

[Politburo]

Considering that DC is specifically mentioned in the Constitution, I think it is safe to say that it is part of the "United States of America" despite the fact that it is not technically a state. I do not consider DC to be legacy. Its purpose still makes sense today. The capital should not be under the authority of any State.

From Article I: "To exercise exclusive Legislation in all Cases whatsoever, over such District (not exceeding ten Miles square) as may, by Cession of Particular States, and the Acceptance of Congress, become the Seat of the Government of the United States..."

Re:Ah...

[Bad_Feeling]

This won't be needed if you are using a Commodore 128 and have access to the Renumber command, which does all of the above automatically.

Re:woulda read it...

[Paolo DF]

well, it is aligned with the policy of the content of the article...

Questions

[yuriismaster]

How would one report if a laptop is stolen? How easy would it be for a thief to remove this after stealing said laptop (before connecting it to the computer)? How will the law know where to go (geographic IP location can't be THAT accurate, can it?) How much of a performance hit will this add to normal use?

Re:Questions

[Tweak232]

I will answer them in order:

By phone, just like a credit card, after waiting a few hours

That depends, some adhesives can require 800+ pounds to loosen. They would most likely just disable it, or sell it to someone on the street, and let them worry about it
Just like LoJack, it would have a gps transmitter in it.

Depends on how well the software is designed and how it operates. Chances are that it will take as many resources as anti-virus software.

I hope these answered your questions, and also makes you(and everyone else) realize that laptops would be hard to protect from theft, especially if the last answer to #2 was used. Case in point, the best way to protect your laptop is just how you would protect your (young) child. Keeping it close at all times while in potentially dangerous places.

Locating Data

[jerw134]

I'm curious as to what kind of locating data it gathers, and how it gathers it. Seeing as this is just a software package, I can't imagine it can go much farther than an IP address.

Re:Locating Data

[Ooblek]

I got the inside track on this. Here is a sample of the data chatter from a stolen notebook to the LOJack server:

<LOJACK_Loc_DATA>HELP ME!!!!</LOJACK_Loc_DATA>
<LOJACK_Loc_DATA_Response>What seems to be the problem?</LOJACK_Loc_DATA_Response>
<LOJACK_Loc_DATA>I've fallen....AND I CAN'T GET UP!!!</LOJACK_Loc_DATA>
<LOJACK_Loc_DATA_Response>Where are you? Can you describe your location?</LOJACK_Loc_DATA_Response>
<LOJACK_Loc_DATA>HELP ME!!!!</LOJACK_Loc_DATA>
<LOJACK_Loc_DATA_Response>Yes, we are aware you need help. Please tell us where you are.</LOJACK_Loc_DATA_Response>
<LOJACK_Loc_DATA>I don't know where I am. It's dark and I SEE DEAD PEOPLE!!! And empty pizza boxes and beer cans.</LOJACK_Loc_DATA>

<LOJACK_Loc_DATA_Response>Oh, you aren't stolen. You are at an Everquest Fan Faire.</LOJACK_Loc_DATA_Response>
<LOJACK_Loc_DATA>HELP M+++ CARRIER LOST

Re:Locating Data

[Anonymous Coward]

The IP, however, can be traced. Find out that user X was on dialup347.foo.hometownisp.net at HH:MM:SS, and you can get a subpeona to figure out who owns the account.

Re:Locating Data

[InvalidError]

Run whois on an IP and you get the netblock information. The netblock information tells you who owns that part of the IP address space. Whoever owns these IPs usually also owns a log of which account owned which IPs at what time for the last couple of days/weeks.

Some years ago, there was an iBook owner who setup his laptop to sync with its desktop whenever it went online. By adding the logs to his theft case, he managed to get his laptop back within a few days from it showing up online.

Re:Locating Data

[buckthorn]

I also remember years ago somebody had distributed.net software running on their laptop. It was stolen, and the thief never wiped anything and d.net kept running and fetching/flushing work. The owner contacted Nugget (the coordinator for d.net) and they tracked down the IP address of the laptop and found the thief.

I guess Prime95/SETI@Home/Folding@Home/etc could probably work the same way. So see? Do something good AND protect your portable box.

Re:Locating Data

[InvalidError]

I wonder if these would count as prior art for "internet-powered tracking of computing assets" patents - assuming such patents were applied for.

I hadn't thought of SETI&all as "tracking services" but anything that automatically connects to some server for whatever reason most likely qualifies as long as the service/whatever provides some way of retrieving your own last X known IPs and login date/time.

Re:woulda read it...

[Incongruity]

Hmm... for me, the first time I clicked through the link it quickly refreshed and asked me for my email address or login, yaddda yadda, but when I clicked on the link again, after having closed the first window, I got to the story without any trouble. your mileage may vary... -t

Hide n seek

[Anonymous Coward]

In some cases, Absolute Software customers are eligible for a $1,000 guarantee payment when a stolen system is not recovered within 60 days.

Anyone else imagined lots of laptop owners playing hide n seek with their laptops for 60 days?

Re:Hide n seek

[Anonymous Coward]

Insurance fraud is nothing new. Notice that part about being required to report the theft to the police before calling them? Sure they'll lose a few thousand dollars to crooks, but it's the same with any other form of insurance. Everyone's rates will just be a little bit higher than if everyone was honest (which would, of course, mean the insurance was useless to begin with).

Re:woulda read it...

[dan dan the dna man]

Except the website doesn't demand personal information before they let you read the story. Which story were you clicking on?

Have TFA anyway, if it makes you feeel any better

LoJack for Your Computer

By Michael Jaffe
July 6, 2005

Last week, LoJack (Nasdaq: LOJN) announced the dawning of a new era in data recovery.

What? Is the groundbreaking gorilla of stolen vehicle recovery committing Peter Lynch's cardinal sin of deworsification into the unrelated field of hard-drive hacking? Not really.

LoJack is licensing its brand name to Absolute Software, which provides Computrace -- soon to be known as the "LoJack for Laptops" line of computer theft recovery systems. When a stolen Computrace-equipped system is connected to the Internet, it automatically and silently sends locating data to Absolute Software, which then calls out the law. In some cases, Absolute Software customers are eligible for a $1,000 guarantee payment when a stolen system is not recovered within 60 days.

In my opinion, LoJack investors should be pleased for at least two reasons. First, without committing any capital or assets, LoJack is collecting a licensing fee, as well as warrants to purchase 500,000 shares of Absolute Software, with a $2 per-share exercise price. Assuming that LoJack can capitalize on its option to buy shares profitably (Absolute Software shares are trading at around $2 each), LoJack investors might be looking at the elusive free lunch. As long as Absolute Software delivers on quality control and customer service, thereby maintaining its reputation, downside risk is relatively limited.

Second, and more importantly, the LoJack brand name is gaining free exposure in the laptop market, catering to a higher-middle-income individual and business population, which happens to be a major segment of LoJack's automotive target customer base. Ostensibly, LoJack's status as a recognized brand and market leader in its field stands to be confirmed and enhanced. If companies take note (and mass appeal exists), there might be more licensing revenue to come.

To be sure, in a business that depends on brand awareness and customer confidence, a deal like this carries tempered risks because a company's brand equity is tantamount to the success or failure of a product. That said, successful licensing also offers the possibility for even greater rewards.

Want valuable nuggets on small-cap investing with a potential for mythic returns? Spend your magic bean money on a subscription to the Motley Fool Hidden Gems newsletter.

Fool contributor Michael Jaffe owns no shares in any of the companies mentioned in this article. Click here to see The Motley Fool's disclosure policy. The Motley Fool is investors writing for investors.

Worthless unless...

[rosewood]

Unless you have a peice of radio transmitting hardware inside the laptop that will destroy the laptop if removed, how can any software really be worth while?

Re:Worthless unless...

[chris_mahan]

Wife:
Look Honey, I know I much you hate to come to my mother's house with me, so I brought your laptop so you can entertain yourself!

Husband:
Oh crap, the lo-jack must have cut groves in the mobo by now...

Wife:
Is everything ok sweetie?

Husband: (curls into fetal position wimpering softly...)
Yes honey, i'll be fine, go talk to your mom...

Wife walks away.

Husband muttering:
All my game saves! Gone! Damn LoJack!

Re:Worthless unless...

[drsquare]

I'm sorry, can anyone explain what this post means?

Re:Worthless unless...

[Anonymous Coward]

Yes. There is this thing, and we need to talk about it stripping the coil from the mother membrane.

Re:Worthless unless...

[Alioth]

Because most thieves are opportunistic morons who won't even know how to wipe or remove a hard drive, let alone reinstall an OS on the laptop.

Firewall

[fembots]

If the thief follows the standard security procedure to install a firewall before going online, what would happen?

Re:woulda read it...

[zoloto]

not sure what you're talking about, but it doesn't require anything.

you troll...

here's the coral cache anyhow http://www.fool.com.nyud.net:8090/Server/foolprint .aspx?file=/news/mft/2005/mft05070623.htm

Popup annoyance.

[Futurepower(R)]

It was a stupid popup. Just close it and read the article.

The AdBlock and FlashBlock extensions to Firefox are excellent, but somehow that site found a way around them.

--
Bush lied. 100,000 died. Violence & lying show a lack of social sophistication.

Hardware, or software?

[djh101010]

TFA is remarkably lacking in technical details, so I looked at LoJack's site, which doesn't mention a thing about this. So - is this a hardware solution, or a program that gets installed into an existing OS? If the latter, well, how useful is that? While the slashdot crowd and the laptop-stealing crowd probably don't have a whole lot of overlap, I can't see someone not just re-installing the OS to wipe the system in any case.

The spyware and firewall questions seem important as well - if this is just a "Hey, this is box XYZ and I'm at this IP address", talking to lojack's servers, well, fine, but how does the end-user know that they haven't blocked that with their firewall?

I'd love to see something technical on this, rather than some stock-tip-guy's interpretation.

Re:Hardware, or software?

[Sir_Eptishous]

Yes, this article is a joke.
Blah, blah, this company will make money because of blah, blah.
What about the product?

Re:Hardware, or software?

[Intron]

Yeah, right. Why'll you're at it, ask them where they hide the lo-jack equipment on cars and how to disable it. Let me know when they get back to you.

Most likely they are putting code on the disk and in the flash.

Re:Hardware, or software?

[wuffalicious]

Hmm, ok. Problem 1. The thief doesn't wipe your system once they've aquired it. Solution #1: Have a large archive of well-labeled, painstakingly organized pornography the thief won't be so eager to dispose of. Problem #2. The thief will need to stay in the same place for a good long time, connected to a network, in order for the IP information the software provides to be remotely useful. Solution #2: See solution 1.

Re:Hardware, or software?

[RosenSama]

See Absolute's, not LoJack's site http://absolute.com/Public/computracepersonal/note book-security.asp for details.

Re:Hardware, or software?

[QuickFox]

Are you sure you want your laptop back all icky?

Re:Hardware, or software?

[Anonymous Coward]

" I can't see someone not just re-installing the OS to wipe the system in any case."

I was lead news editor for Macscripter.net when the story about an AppleScript assisted "lo-jack" broke, and that's exactly what happened.

Long story short, the laptop also had Timbuktu on it, and shortly after being stolen it could be seen accessing the internet via the free trial AOL disks. The thief didn't bother to even look at the contents of the hard drive, let alone wipe it clean and reinstall the OS.

Re:Hardware, or software?

[zornorph]

What could prove to be fun would be to take a sniffer trace of what this application is sending out, then create a program that sends similar, but bogus information to their servers. Load it up on the machine of a someone you don't like and wait across the street with a videocam for the cops (and the ensuing hilarity) to arrive!

Re:Hardware, or software?

[djh101010]

Yeah, right. Why'll you're at it, ask them where they hide the lo-jack equipment on cars and how to disable it.

Well, if it turns out it's software (other responses indicate it goes into the MBR on the hard drive, so it is), and can be defeated by something as simple as throwing away the hard drive or reformatting it to *nix, then it doesn't give any real protection. The bad guys aren't stupid, they're dishonest. They'll toss (or maybe even use *nix to reformat) the hard drive, install the system, and be back up and running. Net effect is that this gives only minimal protection.

Don't get me wrong, I'm OK with them selling it; if criminals think that laptops might rat them out if they steal them, they won't steal as many laptops. So, by that uncertainty, my laptop is less likely to be stolen. So, while I wouldn't bother with this for my own systems (windows-specific limitations aside), I don't have any problem with them selling it to people who feel it's good enough for what they want.

Call out the law??

[pe1chl]

which then calls out the law

What does that mean?
Is there some law organisation in the USA that you can call saying "my laptop has been stolen and it is now on the internet at address 333.444.555.666" which will then go out to locate your laptop and return it to you??

Re:Call out the law??

[Hawke666]

I certainly hope not, since that's not a valid IP address.

Re:Call out the law??

[sTalking_Goat]

FBI Hostage Rescue Team.

Rappel down the side of the building, smash the window, flashbang the room. Whack the 15 year old who stole your laptop in thw chest with a CS grenade.

Re:Call out the law??

[Anonymous Coward]

Is there some law organisation in the USA that you can call saying "my laptop has been stolen and it is now on the internet at address 333.444.555.666" which will then go out to locate your laptop and return it to you??

IRCops?

Bad boys bad boys, what ya gonna dooooo

Re:Call out the law??

[joe_bruin]

That IP address and its owner will be promptly banned from the Internet.

Re:Call out the law??

[Lord Apathy]

which will then go out to locate your laptop and return it to you??

Fuck that. Just give me the address of the fuck tard that stole my laptop. I'll go round up some goons and recover it mysel...

So what this tells me...

[Mrs. Grundy]

is that would-be laptop thieves need to learn how to wipe the harddrive and reinstall before connecting to the internet. Probably a lot easier than removing a lojack from a car before you are busted.

On the other hand, if thieves think will get busted by stealing laptops, this helps everyone. Schneier has an interesting note on his blog about lo jacks in cars benefiting everyone.

Perhaps?

[Pepsiaddict]

Well it could be remotely successful... I would ponder most crooks would be curious enough to boot a stolen laptop before they wipe it clean... though unlikely they would have need for internet access.

I want a Q model James Bond.

[Anonymous Coward]

I want my laptop to emit knock-out gas and then send a signal via satellite to track it if it is stolen and wrong password are in the hardware.

Re:I want a Q model James Bond.

[Anonymous Coward]

someone should do this as a mod. GPS installed with some kind of gas release.

First law of data security...

[chill]

If you don't have physical control, you don't have security. Okay, strong encrypted data may be safe from prying eyes but how many people, after getting a stolen laptop back, boot it immediately and "check" everything? Can you say keylogger trojan?

Computrace is a piece of client software that "phones home" on a regular basis. It provides NO protection against things like formatting the hard drive before connecting to the Internet. http://www.absolute.com/Public/products/techplatfo rm.asp

Oooo... it uses an ENCRYPTED connection. Explain to me how this stops "fdisk; format c:" or "fdisk; mkfs /dev/hda1"? How about booting from alternate media like a USB key, floppy or CD?

This must be designed to nab the stupid criminal, who jacks in as soon as they boot.

On the other hand, with the prevalence of open WAPs, it is quite possible a laptop with a built-in wireless NIC will connect and phone home before the hapless thief realizes it.

-Charles

Re:First law of data security...

[Stealth210]

Granted it may be able to "phone home" from a temporarily connected WAP, but what good is that going to do?

Re:First law of data security...

[PitaBred]

It is designed to nab the stupid criminal. Fortunately for us, most criminals are stupid. It's the smart ones that don't get caught that scare the hell out of me.

Re:First law of data security...

[chill]

Granted it may be able to "phone home" from a temporarily connected WAP, but what good is that going to do?

Thinking about this is an entertaining exercise. Assuming the machine is booted and can get a network connection.

It would be trivial to get an IP address. If it can get to the Internet at all, just send an HTTP GET request to the LoJack servers and check the logs to see where it came from. NAT won't protect from this, but a captive proxy will make it more difficult.

From an IP address, you can get the ISP. From there, presented with the situation, many will roll over on who was using the IP at that time without a warrant.

Yes, it could be an open WAP, which makes it more difficult. The entertaining part would be if the client had a keylogger that sent everything back in case of activation.

-Charles

"Guaranteed" is a loose term these days

[Hachey]

Absolute Software may be guaranteeing $1,000 after 60 days if the laptop is not found, but you'd be surprised what that actually means.

I used to work for a computer store. We sold scores of laptop locks; all sorts of kinds of them. The Kensington locks sold like hotcakes because they had a $1,200 "guarantee" that the lock could not be compromised. The problem, we soon found out, is that the theif has to physically cut through the lock and leave behind the pieces. As we all know, some locks can be picked with even a bic pen, and so a lot of good this "guarantee" did for some poeple. Some theives also just took the not-so-hard-to-steal item the laptops were attached too. (Lock it to a bed or desk people, please!)

No evidence to send in, no money back. I am willing to bet in this case there are similar loopholes for Absolute Software to play with.


--
Check out the Uncyclopedia.org :
The only wiki source for politically incorrect non-information about things like Kitten Huffing and Pong! the Movie !

Re:"Guaranteed" is a loose term these days

[anubi]

Yup... a marketing phrase.. they are selling "peace of mind".

I can't help but think of all those Laguna homeowners who had purchased "homeowner's insurance" for peace of mind knowing they were covered if something awful and completely out of their control happened to them... and it did... the Laguna Landslide ( Southern California ). News traveled fast that the homeowner policies did not include landslides.

I wonder more and more what the logic is in having insurance? That is perfectly good money I am paying in, and what I see is lots of buildings staffed full of office hens flitting to and fro charging their time against my policy. I wonder, statistically, would it be better to just drop insurance and simply invest those premiums elsewhere... with premiums at nearly $1000/year, and every year I get yet more modifications the Insurance company sends me clarifying under which circumstances I am covered - and it all seems so nebulous to me whether or not I would be covered for anything. I really ponder the economics of insurance. I see others sleeping soundly at night, *thinking* they are covered, but then when disaster strikes, the insurance companies hide behind the little clause they stuck in that exempts them from their side of the deal.

It just seems like I am getting the shaft when it comes to insurance. Anyone else have any insights?

Re:"Guaranteed" is a loose term these days

[baerm]

It just seems like I am getting the shaft when it comes to insurance. Anyone else have any insights?

Insurance is architected not to work. By that I mean, it's in the companies best interest to not provide the service they offer. There are two ways for an insurance company to increase revenue: take more money in and pay less money out. Their business goals, therefore, are twofold. The first is to get the highest value of number of people insured multiplied by their premium. This includes advertising, various pricing techniques, etc.... The second is to pay out the smallest amount possible. This includes dropping claimants and having clauses to not cover as much as possible.

With most services, the service provided is relatively immediate. If the service isn't provided, you can demand your money back and/or never use that service again. This is affective for immediate services. I buy bread. If I don't get bread, I say, "give me my #%*&$ money back" and I'm not going to let the door hit me on the way out. Since insurance is based on statistically small occurrences, I buy insurance. If I don't have anything to cover, I keep paying. If I have something to cover and they don't cover me, I stop buying insurance from them. They laugh all the way to the bank.

My main point/complaint being, the goal of insurance companies is to not provide insurance or, in other words, insurance as a business is architected not to work for the insured.

To conclude my rant ;), this means when we decide to legally require insurance provided by unregulated or poorly regulated companies we are hosing ourselves badly.

Re:"Guaranteed" is a loose term these days

[anubi]

Thanks...

I am pondering homeowner's insurance. It seems every time I have ever known anyone to make a claim, they weren't covered! The latest example being those Laguna Landslides.

I have no idea what calamity may befall me, and I buy insurance to help should the unlikely event occur. Like you say, I have no idea if the insurance is even useful until I need it. Statistically, I won't.

To find I have been paying on the order of $1,000 a year just for the "peace of mind" of having insurance, to discover its useless when I need it, geez, over the 20 years I've had insurance, it would have grown to well over $25,000 had I invested it in lieu of premium payments. Somehow I consider it highly unlikely the house burns to the ground. And it looks like other ways I will lose the place, via Earthquake, riot, flood, landslide, whatever, not covered anyway!

I feel so stupid paying so much for "peace of mind"... its hard to have peace of mind when I am suspicious the company is only there to accept my premium, and will likely give me the "We're sorry business-face" when I need them. Those super thick policies full of exceptions foster that distrust.

Having the insurance company constantly revising the policy does not help my confidence one iota either. I dropped State Farm for doing just that... it didn't seem a month went by without my getting some letter from them revising my policy - and I just don't have time to keep up with their printing press. I felt all I was doing with my policy dollar is financing all those office buildings I see with their company name on them... all filled with office workers scuttling about filling out papers and dreaming up yet more ways of modifying my policy and spin doctoring it so it sounds passable.

oh boy! Software

[SatanMat]

Okay so I've just stolen your laptop and formatted it and installed (anything) on it... Where's you LoJack now?

I fear software solutions will always fail, be weak at this point. A hardware option would seem to be better, no?

Yes it will work when a petty theif steals your baby, but not for anyone with an IQ over 105.

Re:oh boy! Software

[InvalidError]

Yup.

Something like a power-on boot lock based on server authentication would be much stronger... steal a laptop, its ID is dropped from the authentication servers and the laptop becomes little more than spare parts for whoever stole it after the "Allow X boots between mandatory check-in" counter expires.

This should also have some provisions for third-party servers - to cover LANs during internet outages and roaming - and an optional override code where unexpected lock-outs are not tolerable.

corporations

[kebes]

Not sure what the costs involved are... but I doubt that this will be of much interest to the typical personal laptop owner. However, I can see this being bought up in bulk by companies as a sort of "insurance." In fact, their insurance rates would probably go down if all company laptops were equipped with this software. I think it makes sense for a business to try to protect their laptops this way. Employees are going to be less careful with a company laptop, as compared to their own personal laptop, and it might be important for the company to get the laptop back.

I think companies would be even more interested if there was a "kill-laptop" feature. So if the owner of the laptop goes to the IT department and says "my laptop was stolen!" (or lost), then they activate a flag so that when the laptop makes its secret connection, it receives a signal to erase itself, thereby protecting valuable company data. For many companies, protecting the data on the laptop might be more valuable than the laptop itself.

On the flip side, I would think that most people who steal laptops are going to wipe them or snoop around in them for awhile before connecting to the net and surf for porn. So this should hardly be viewed as a perfect solution for catching thieves (although WiFi certainly helps).

Re:corporations

[Anonymous Coward]

> it receives a signal to erase itself, thereby protecting valuable company data

How about just encrypting the data to begin with?

If it's that valuable, the IT people should be smart enough to use strong encryption on the block device level (i.e. login before mounting the filesystem, not just a BIOS/HDD password).

Re:corporations

[Incadenza]

On the flip side, I would think that most people who steal laptops are going to wipe them or snoop around in them for awhile before connecting to the net and surf for porn. So this should hardly be viewed as a perfect solution for catching thieves (although WiFi certainly helps).

It is amazing what you can do remotely with a stolen laptop before the thief notices anything.

Above article is a story about a guy who retreives his sister's computer by using Timbuktu Pro (a VNC like client/server solution for Mac). Same article also mentions this BS:

Absolute's CompuTrace software programs computers to call the company's tracking center in Vancouver, B.C., at prescheduled times. If a machine is reported stolen, the monitoring center waits for it to dial in, then reprograms it to call every 15 minutes until its location can be traced. The software is very difficult to remove, and works even if the hard drive is reformatted or repartitioned. The company has been operating since 1997 and claims a 95-percent success rate.

Sorry, but that doesn't resonate with Absolut's own FAQ. A bit too much absolute absolute maybe?

Re:corporations

[Locke2005]

I beleive thinkpads can be configured to encrypt the hard drive and require a bios password every time you power it up. Not sure how effective the hard drive encryption is, but Intel relies on this mechanism for keeping their company data secure.

Re:corporations

[Anonymous Coward]

That feature is available as an option. When you report your laptop stolen, you can optionally activate the data delete feature. The next time it calls in, the contents of the drive will be wiped.

Wow, What Garbage

[Protocron]

Come on Slashdot. What is this, news for AOL users? This kiddie crap. Yes, most thieves will just boot the computer with Windows and try to get on the net. But this is Slashdot. We're nerds or something. And this ain't F***ing news. If I got a laptop that was stolen, hell if it was used, I would format it:

From the website: www.absolute.com

Q. Can Computrace Personal be removed?
A. The Computrace Personal software is a low-level utility that is as tamper resistant as a disk-based utility can be. The software can only be removed by an authorized user with the correct password so please be sure the password is stored in a safe location and not on the protected computer.

Q. What happens if a computer's hard drive is removed?
A. The software resides on a computer's hard drive so if the drive is removed the computer will no longer be protected and can not be located if stolen or lost.

http://www.absolute.com/Public/computracepersonal/ faqs.asp
Wow, what great protection.
Come on!!!!! This ain't even hardware!!!

My solution for thiefs

[LordSnooty]

Just wipe any laptop you steal and install a nice, fresh OS on it. Preferably one without "LoJack".

Nothing in the rather grim article suggested that this tech is available outside the OS, so to me it sounds like an easy fix.

Re:My solution for thiefs

[kebes]

True enough. As with all security measures (lock, alarm system, etc.), it can be overcome by someone who is smart, and especially someone who is expecting the security measure to be there. I would think that alot of stolen laptops are re-formatted and re-sold within a day (without ever being connected to the net), and thus this utility is useless against those particular thieves. However, there are some thieves who may start using the laptop immediately, and may connect it to the net to do so (or maybe a WiFi connection will even occur without them knowing?). So this will at least help against some thievery. No security measure is perfect. The point of security is not to make anything impossible, but just to make it more difficult.

I highly doubt that most laptop-thieves (who are probably thieves of opportunity, not elite criminals or computer hackers) will think to worry about this utility being installed.

1000 bucks!?

[avocade]

If I'm without my work-computer in 60 days, it sure has cost me a heck of a lot more than a grand in productivity loss. Not too friendly-minded with systems that call home either. This's certainly a stab... somewhere...

Boot any one of the many live *nix distro's

[Goatboy]

..then use fdisk to wipe the disk. Really, am I missing something here? (Other than a possible BIOS setting to force boot from internal HD in preference to CD/USB/Floppy/LAN, which can always be gotten around).
Oh, I get it - it's just designed to recover stolen laptops from non-slashdot readers ;o)

$1000? please...

[finse]

There was a time when laptops were stolen due to their price, and possible resale value on the black market. I personally think we are now in a new era where laptop theft (at least the corporate type) is no longer about getting a shiney new powerbook, and possibly selling it off the back of a truck. Today laptop theft could be for the information contained on the hard drive. Now lets think about the componsation, if my HR director "loses" his/her laptop with important information about me/co-workers, is $1000 really going to cover the loss? No, not even close. 1K in most cases will not even cover the cost of the laptop. For my money, I want a techonology that will encrypt the contents of that hard drive, and be easy enough for an HR director to use.

Re:$1000? please...

[BrK]

If your HR director is porting around a laptop with unencrypted data on employees you have bigger problems.

The data shouldn't even *be* on a laptop in the first place.

What exactly does an HR person need to do remotely? Keep sensitive data on an internal server and use a VPN to access it.

Re:$1000? please...

[finse]

I fully agree that this type of data should not be on a laptop. However, people will be people and they will take shortcuts whenever they can. While I used an HR person in my example, there are many other examples I could have used. For instance, what about the technical sales person who has senstive pricing information on his laptop? If the sales guy is onsite at another company, do you really think said salesguy will a) be able to plug into the network, and if he can, b) use VPN from the remote location?

Its just a bad idea to allow unfettered VPN access from outside of your network, no security admin worth his/her salt will ever allow this type of access for a mear sales person.

Re:$1000? please...

[Anonymous Coward]

Well I know I couple of people who've had laptops stolen recently, with no data more valuable than their itunes songs. They were clearly stolen so they could be sold on (I presume for crack money). The "old era" isn't exactly ending. And corporate espionage isn't new either.

Re:$1000? please...

[tirnacopu]

Right-click on the "My Documents" icon, select "Encrypt this folder". Easy enough?

Re:$1000? please...

[soft_guy]

The company I work for doesn't even buy any desktop systems anymore (except for Macintosh systems - which don't come from the IT department.) All our PC systems are Dell laptops - even for folks who have no reason to travel away from their desks.

Re:$1000? please...

[Anonymous Coward]

> Right-click on the "My Documents" icon, select "Encrypt this folder". Easy enough.

If you think that's strong encryption, you're fooling yourself. No serious system administrator in a military or corporate top secret job would trust anything other than certifiable full disk encryption at the block device level.

First of all, unless you encrypt every sector on the disk, information can leak through temporary files, swap files, unused areas of the disk and a million other places. By making sure no part of the disk ever sees unencrypted data, you can guarantee no leaks (not counting keyloggers etc).

I would also suspect the Windows facility has government backdoors just like previous Microsoft products had NSA access - I would definitely not trust it without formal certification (or source code inspection).

and for my information?

[dallask]

So when the bank official looses his laptop with my bank data on it and the thief dumps the data to another system and reformats before it connects to the net then what do I get for my stolen identity?

Re:and for my information?

[cursion]

I'd say a lawyer or a baseball bat.

Don't get both - a lawyer would be scared of an angry person with a baseball bat.

Re:and for my information?

[Anonymous Coward]

You get to hope the thief tightens the laptop back up again.

Teh Internets Police!

[subtropolis]

BTW, it's strictly forbidden to report non-existing IP addresses to Teh Internets Police.

Re:Teh Internets Police!

[pe1chl]

It is an example.
But I think it would be useless here to report something like this to the police. They will put your report on some stack of "nice things to do should we have some time left" and it will be assigned zero priority.

Re:Teh Internets Police!

[soft_guy]

Not true. You take the IP address, find out who "owns" it. It will be such and such ISP. You then get the ISP to tell you who the subscriber is, get their address, give that to the police and they go bust the guy.

This has happened before. They found a guy who had been committing burgarlies this way.

btw I'm not sure at what step the police take over. You probably need to be the police with a warrant to get the isp to give you the name of the subscriber.

Re:Teh Internets Police!

[pe1chl]

The situation will be different by country, but I think here the only thing the police is obliged to do is to make a written report of your laptop being stolen. They are under no obligation to followup on the matter, even if you provide evidence yourself.
In fact, the more evidence you provide ("my laptop is gone and I know who has it now") the more chance that they declare it a civil case and refer you directly to civil court to file a claim.

Re:Teh Internets Police!

[subtropolis]

and that was an example of a joke

PC or Mac? Linux?

[Pepsiaddict]

I figure there's a 97% chance this is Windows-only software, according to the last market-share report.

Not just stolen!

[Telastyn]

It's not just stolen laptops that send information to their servers. Any laptop with this software installed sends periodic heartbeats to the computrace people.

Our PHB ordered it installed after getting a call from a golf buddy. It was ripped out a week later. The heartbeats contain enough [cleartext] information that the increased chance of the laptop being broken into, or the salesguy socially engineered using the info was deemed higher than the chance it'd ever be stolen.

only $1,000?

[hazzey]

eligible for a $1,000 guarantee payment

Sounds pretty low to me. Insurance should pay at least that much depending on the value. And considering how easy it would be to stop this sort of thing if it was only software based, it just sounds like an extra insurance plan.

hardware solution

[subtropolis]

a drive bay double-barreled Derringer might be of use.

Then worry about the data, not the hardware

[sterno]

If you're worried about the data, then you should protect that, not the hardware. Have the system thoroughly encrypted locked to biometric data. Then have it keep back ups of critical data on a secure remote server. Then if you're laptop gets stolen, no big deal, they can't get the data and you've not lost much.

How does it know when it is stolen?

[Anonymous Coward]

When a stolen Computrace-equipped system is connected to the Internet, it automatically and silently sends locating data to Absolute Software ...unless it is constantly phoning home all the time? I don't think I want that.

Mod AC parent up :)

[rbarreira]

This, people, is why you shouldn't try every step of the instructions you recommend to people :)

Re:corporations and Nuclear Labs & Banks

[Anonymous Coward]

This is just what Los Alamos needs next time one of their laptops go missing.

Come to think of it, Banc One should also consider it.

like cell phones

[fermion]

If your cell phone is stolen, it should be easy to connect the called numbers to the person who has the phone. In some cases this will work, and I have seen cell phones returned.

However even the young kids who casually steal cell phones appear to have some sophistication, and are able to reprogram or wipe phones for resale.

Given that wiping and reinstalling the OS for laptop is trivial compared to reprogramming a phone, I do not see how this would stop anyone but the most casual of laptop thief.

I would like to see how easy it is to get the $1000. If the service was cheap enough, it would be valuable merely as $1000 insurance policy.

Dissapointed

[rbarreira]

God I suck

I always thought God could get better than a /. nerd...

Limiting Conditions

[Anonymous Coward]

The Computrace $1000 refund system is only valid if the Computrace servers recieve a transmission from the laptop after it is stolen. Sort of defeats the value of the whole thing, especially if the thieves know their security. It'd also make it harder for people to "steal" their own laptops to get the $1000 claim.

Agreed.

[Pepsiaddict]

$1000 would in no way compensate my for my $2700 17" Powerbook.

Re:Agreed.

[Anonymous Coward]

Or the shame of being openly outed by posting pro-Apple comments.

1992 Called...they want form-before-function paperweight gayputers back.

Nice marketing idea, but...

[imuffin]

I've been doing this for years using DynDNS's free dynamic DNS service. I run a client on all my machines that updates their IPs with dyndns's database. If my laptop disappears, I just look to see what mylaptop.dyndns.org resolves to.

--
watch funny commercials

Re:Nice marketing idea, but...

[dimmak]

i setup dyndns in conjunction with ultravnc's sc (single -click) client that auto connects to my home machine. it can be placed in the startup folder and autoconnect when an internet connection is present. i wouldn't mind investing in big brother-esque technology that enabled me to police my own stuff better. of course then the government will probably be able to remotely control my toilet while i am pooping and that is not what the founders of this country would want.

A fool and his money.

[BrK]

This company just proves the saying "A fool and his money are soon venture capital".

I seriously can't believe this concept ever got past the drunken-scheming-businessplan-on-a-napkin phase.

Yes, this might catch your average completely clueless snatch-and-grab thief, but I wonder how often those guys go through the trouble of connecting a stolen laptop to an internet connection anyway?

What would be really fun is to report some PHB's laptop stolen while he's on a business trip with this software installed :)

roundup!

[SuperBanana]

Is there some law organisation in the USA that you can call saying "my laptop has been stolen and it is now on the internet at address 333.444.555.666" which will then go out to locate your laptop and return it to you??

Well sonny I work for these here boys, and when I get a tellygram, I hop on my trusty steed 'Mac', and he and I head on down to russle me up some lappies. 'casionally I hook up with m' associate Ping; she's a real darlin' and knows how to ferret out the sneakiest son-of-a-guns, even them Cen-trin-toes.

I tell ya, these city slickers wouldn't be loosin' 'em so fast if they branded 'em!

How does the computer know it's stolen?

[wombert]

How does the stolen computer know it's time to transmit the homing signal... unless it's always transmitting anytime you're connected to the internet?

I'm not entirely sure how the LoJack on cars works, but I seem to recall it requires you to report the theft, and then the cops/LoJack have some means for tracking the car's device. With a physical device, this might not require an always-transmitting approach so much as always-ready-to-transmit - that is, it could have enough battery power to start transmitting once it's hit with a request for broadcast. But for a software solution, how would you ping the stolen computer? (You need routing information in addition to the MAC address, right?)

Fortunately, there's a good chance that anyone booting up your stolen WinXP laptop will quickly be caught and arrested for connecting to the nearest WiFi network.

I can beat this...

[suitepotato]

Simply put a small charge of explosives in the case and when it gets stolen, boom, check the news for "fence killed by stolen laptop", wait for the /. posting "innocent man killed by exploding Windows laptop", and comment here.

These situations are just fodder for more posts, so why noy enjoy it?

Re:I can beat this...

[Locke2005]

Simply put a small charge of explosives in the case... then try carrying it on an airplane!

Not most, but many

[lheal]

Ever been to a swap meet? A lot of that stuff is, uh, warm to the touch.

I asked for this 10 years ago

[davidwr]

Literally. 10 years ago. I called them up and asked if they did laptops. They did not.

A better solution is to make it work like the car LoJacks - when the unit receives an "I'm stolen" message it replies with its location. Only major problem would be power - if a theif removed the batteries it could be a long time before some sucker replaced the batteries, and by then LoJack might've stopped broadcasting.

Of course, any kind of security won't work well if it can be disabled or removed without disabling the PC.

If LoJack or any other company wants to make a killing, license their technologies to motherboard manufacturers.

Hmm, if I could get LoJack-on-a-motherboard, I'd like it in my TV, my VCR/PVR, my CD player, and anything else likely to wind up in a pawn shop.

Re:Wow, What Garbage

[t0xic@]

"Come on!!!!! This ain't even hardware!!" True...but unless you get another ethernet card they DO have your MAC address. I can see a cookie finding its way back to their servers with that info. I would definately not use the ethernet it came with ever.

Why not intergrate a GSM/GPRS radio?

[mcbridematt]

I've been thinking of anti theft protection for laptops recently, and the flaw in most software is that they assume you will somehow end up on a open network which isn't firewalled.

One way around that is to put in a celluar radio, not only will it allow net access almost anywhere where coverage exists, it can be used to call home and do lots of things easily. Perhaps port LinuxBIOS to the laptop (if you can get the docs) and set it to self destruct on bootup remotely, not sure if any trapping is possible via LinuxBIOS while an user operating system is runnning.

The biggest barrier here is that there isn't many (I couldn't find any) intergrated cellular radios in miniPCI (probably due to power requirements?) form which would be suitable to plug in, I know Telstra down here in Aus is ordering rugged laptops from Fujitsu with an integrated GPRS radio (or perhaps CDMA judging by their recent monopoly boosting stance) to replace HP PDA's for field techs, but thats about all I've heard.

Re:Why not intergrate a GSM/GPRS radio?

[Anonymous Coward]

Novatel are planning a GPRS/UMTS device that integrates into a laptop......

Gee, let's start a scam....

[pg110404]

Absolute Software customers are eligible for a $1,000 guarantee payment when a stolen system is not recovered within 60 days.

1: get a laptop
2: install this "security" software
3: report laptop stolen
4: wait 60 days
5: put in claim for money
6: profit


Just because I claim it's stolen and make sure I don't plug it into the internet for 60 days, or claim it's stolen then wipe the drive clean, does that mean I can make $1000??

It sounds about as ridiculous as

1 - collect underpants
2 - ???
3 - profit

It's a great idea, but I think it should be a function of the BIOS. It's a whole lot harder to bypass a security feature of the bios than it is to wipe the harddrive.

Re:Gee, let's start a scam....

[t_allardyce]

well yes, but that's no different from:

1. get x
2. insure x
3. report x stolen
4. claim insurance
5. profit

its called fraud.

Re:Gee, let's start a scam....

[pg110404]

its called fraud.

.... which makes me question the wisdom of their guarantee policy. I'd imagine that will be revised very quickly when they realize most laptops reported stolen are not actually, and that those that really are won't "live" long enough to report themselves.

Re:Gee, let's start a scam....

[t_allardyce]

actually i think their guarantee policy is probably something like:

1. advertise $1000 guarantee policy
2. get customers
3. hope it works out
4. if it doesn't, just make claiming the $1000 very hard with lots of forms and delays, assume that most people won't have the time or money to take it to court.
5. profit.

Re:Gee, let's start a scam....

[Incadenza]

1 - collect underpants
2 - ???
3 - profit

It's a great idea, but I think it should be a function of the BIOS.

Underpants as a BIOS function? I know us Mac guys are a different breed, but when I hear stuff like this I severely doubt Steve's decision to switch to Intel.

FOR/NEXT in BASIC

[tepples]

Dude... it's BASIC. There were no loops.

Even in early BASIC there was the FOR statement, but because behavior with STEP 0 was unpredictable on various home computer ports, it couldn't always be used as a replacement for WHILE.

Solution: Buy a second lock. Break it. Send parts.

[wernst]

Sometimes it takes evil thinking to get around evil guarantees."Fight Evil with Evil" goes the tagline to at least one movie...

Were *I* in this position, I'd buy a second lock, break it, leave pieces of it lying around the area where the notebook was stolen, take a photo, and then proceed to make my claim.

Of course, there there is no way I would *really* do that officer...

Calls out the law? Yeah, riiiight!

[jhylkema]

When a stolen Computrace-equipped system is connected to the Internet, it automatically and silently sends locating data to Absolute Software, which then calls out the law . . .

And the law proceeds, uninterrupted, with their donut break.

Seriously, "the law" doesn't pursue stolen cars all that aggressively. Instead, they say, "we'll take a report that you can turn in to your insurance company. What? You didn't have theft insurance? You're one dumb sonofabitch." The manufacturer implies that, once the laptop is located, they're going to invade the house, BATF style, to retrieve it. Ain't happenin, sorry.

OTOH, the cops aggressively pursue speeding, overtime parking, etc., with collection agencies, wage garnishment, etc. Why? The government then has more money to buy new furniture for the mayor's office and other such extremely important public expenditures.

snake oil security

[Anonymous Coward]

I remember another "security" measure at work: they went round and painted PC cases with a smear of some magic water containing microspheres in a combination making a unique identifier. They paid good money for this.

What I found funny was that every PC is registered for the campus network. So every PC likely to be stolen has a unique six-byte identifier built into the motherboard, and recorded in a campus-wide database. (PCs with plug-in ethernet cards are too old to be worth stealing: as we saw after an actual break-in and theft of the only PC worth taking.)
How difficult is it to read off the MAC address of a suspected stolen PC and compare it with a list of reported stolen machines? A damn sight easier than reading off the magic water markings....

New business model

[Locke2005]

1) Buy $500 Dell laptop
2) Install Computrace
3) Throw laptop away and file police report as stolen
4) Apply to Computrace for $1000 guarantee
5) Profit!

Re:New business model

[yaweh]

err, um, i believe thats what they call "fraud", and its usually illegal. but yeah, ha ha. its no more fraudulent than claiming the police are going to be called out in droves to retrieve your laptop, when the reality is they may get around to sending you a form to report your stolen goods. that is, if they're not too busy with the counter-terrorist stuff.

This is available in BIOS

[Anonymous Coward]

IBM thinkpads are shipping with this software in the BIOS. From http://www.pc.ibm.com/us/security/ "This PC tracking and loss control solution helps security departments monitor asset locations daily, protect valuable corporate data and attempt to recover PCs if they are stolen. The Computrace BIOS-based agent provides superior security over tracking software that is installed only on the hard drive. Once the ComputraceComplete or ComputracePersonal service is activated, it will reinitiate even if the hard drive is reformatted or replaced. The Computrace BIOS-based agent works with System Information Center to provide asset management."

Re:This is available in BIOS

[dwellersire]

I ordered the IBM X41 Thinkpad Tablet a couple weeks ago, and got the bios-based 3 years of computrace along with it. I got the CD, but I'm still waiting for the tablet. It says that it's an activation CD, so I'm hoping that you can activate it via windows, but have it work without worrying about the OS.

System Requirements:
Windows XP
Internet Explorer 6 And Above

This article for more:
http://www.newswire.ca/en/releases/archive/Februar y2005/01/c8968.html

Worse than just an illusion...

[janic]

It is outright bullshit!

We had a laptop stolen and called it in.

"Oh, you need to file a police report"

Fine, so we get the numbnuts who lost it to file the report and give us the report number.

"Okay, yes... we have recieved a call home from the laptop, and we know where it is!"

Great! Now when do we get it back?

"Wellll, you cant..."

and it just got worse from there. The police wouldn't retrieve the laptop, and these clowns wouldn't tell us where the machine was. But at least we knew:

- it was in fact stolen and not in the hands of the numbnuts employee
- it was in fact connected to the internet, being used, right then
- we couldn't get it back
- someone was at least enjoying their brand new laptop...

damnnit! This shit just annoys me. I'm going home.

Re:Worse than just an illusion...

[pcmanjon]

Yes, I used this service before as well -- last fall I think. The police were very unhelpful --

and Computrace wouldn't share the location of the stolen laptop, she was nice to tell me that they were online with it right now though.

Jesus Christ, it was a waste of money

Re:Worse than just an illusion...

[ockegheim]

I hope you get your $1000.

Or is there something buried deep within the TOS that you clicked "I agree" to?

as soon as it gets popular...

[dimmak]

i will be sure to put an official "protected by lojack" sticker on my laptop just like the home security signs outside many houses. i remember a sales guy saying that the sign itself deters like 90% of thieves. personally i feel if someone really wants to make off with my stuff they will, but i am more than happy to invest in proper signage.

What about encryption atop it...

[GeekMarine72]

First, the idea that the recovery software is worthless because the user will wipe the drive ignores the idea that the thief may boot the OS to try to steal sensitive data. The real value of such warez is the chance that you will recover or disable the system. I've been looking into the option because I have careless people who carry gigs of sensitive data on their laptops and who could lose it. Cyberangel (http://www.sentryinc.com/) adds file encryption / locking to the idea, stuffbak is not software based but offers a reward for return of not just laptops (http://www.stuffbak.com/stuffBakAdmin/) and others offer a similar service. Some insert the tool in the form of a root kit (http://blackhat.com/html/bh-usa-05/bh-usa-05-sche dule.html) that might be difficult to detect and delete. Obviously hardware is prefered. Recovery is not the key, teh real key is information leak prevention. I just use sysinternals boot logoing to set my windows craptop to show the CIA logo on boot. Geek Marine

This kind of program takes about an hour to write.

[DaedalusLogic]

I wrote both Windows and OSX clients for a very basic system that does this last night. I'm planning on offering it to my customers for free. I don't think that I would have a lot of success selling it as a service compared to the clients it would naturally bring in for other things... Plus... it's insurance you're buying with these folks... an insurance product... not a security product... think about it.

And yes, it's simple to get around this software... but think about this... Most criminals/thieves are stupid . I have seen stolen computers that still have entire family photo albums on them from the previous owner.

If you have a script that sends out a call for help every minute... What's your bet that an idiot can find out in less than a minute that the computer is calling for help.

Thieves aint dumb

[Anonymous Coward]

I have the pleasure of many "acquaintances" visiting me from time to time with laptops of dubious origin.

First thing they do is bring it me to wipe, check, value and prep for sale.

Better than some other options

[ravenspear]

Profit $300 for 60 days work

Well, if you work in IT, at least you'd be getting a raise.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Intel

[Impy the Impiuos Imp]

...but when Intel wants to do this to track counterfeit or stolen chips, oh how you'll howl!

Wipe the drive

[apankrat]

AFAIK wiping the drive does not remove their tracker unless you do a low-level BIOS format. Also if I remember correctly they had an option of having the tracker in the bios itself, so it was executing even before mbr is referenced. I talked to their CTO at some point and these guys were actually involved with IEEE and IETF to move forward some related standards. It is far more complex stuff than it seems from the first glance.

Fractional line numbers

[MarkByers]

There is no problem with using consecutive line numbers. If you need to insert a line between two other lines, use fractional line numbers.

5½ GOTO 3.1

No renumbering required, problem solved!

Yes, I know what you are thinking: what if we run out of fractions? Don't worry though! In such emergencies, you can start using irrational line numbers. There are tons of those, so you will never run out. This does tend to increase the size of the program considerably, so they should only be used as a last resort.

Re:Fractional line numbers

[pcmanjon]

" There is no problem with using consecutive line numbers. If you need to insert a line between two other lines, use fractional line numbers.

5½ GOTO 3.1

No renumbering required, problem solved!"

Uhh, you can't do that in BASIC?

What language can you do that in?

If you were being funny, well, you must not have been -- otherwise you would have been rated Score: 3 Funny

Re:Fractional line numbers

[tomlouie]

LOL! If I still had my C=64, I'd try that out right now.

Color me gullible.

Tom

Re:Fractional line numbers

[megrims]

If you were being funny, well, you must not have been -- otherwise you would have been rated Score: 3 Funny

You have far too much faith in the moderation system, my friend.

1980 called...

[soft_guy]

They want their coding paradigm back.

Norton Firewall

[LibertarianWackJob]

The theif is presented with this pop-up window:

Norton Firewall has detected that program - LoJack - is attempting to send information to the Internet.
Do you wish to allow it?

And now the award for...

[Anonymous Coward]

not understanding a joke despite it's complete absurdness. Nominees for this award showed immense ignorance in the face of an obvious attempt at humour. Ladies and gentlemen, we have a winner!

Re:Ah... I'm an idiot!

[Anonymous Coward]

6.5 goto "jail" 'for fraud, you loser.
8. jail = bubba.pusher
9. bubba.pusher = 10 'inches of PAIN

I've administered computrace....

[lysium]

...and it is useless. It is an application (not firmware) that is installed into the disk's MBR. It also requires a Windows OS. So, in a nutshell: if you reinstall Windows it will not kill computrace. Reformatting the MBR or installing a *NIX OS will kill it, however.

hmmm...

[justdrew]

should say: "When ANY Computrace-equipped system is connected to the Internet (built in LAN?, wifi?, what about others?), it automatically and silently sends locating data to Absolute Software" wtf? "locating data"? So can I really have a GPS reciver in a laptop case? If so can this locating data be used with google maps or some such other use?

Wondering about Linux?

[ThisIsFred]

Yeah, something along those lines is what I've wanted to implement on our laptops for a long time. Since we support more than one OS, I'd probably implement it in a cross-platform script and make sure the firewall is open. Whenever we get something new, there's always such a big hurry to get it deployed, whereupon it is promptly placed on a shelf and gathers dust. I never got the chance to test a phone-home program. Ah well, someone walked off with a nice laptop.

old news

[uw_badgers]

I read about the exact same idea at least 5 years ago.

organized crime!

[aqsv49]

Well i see all your arguments for and against this software. This software is moronic, I.E. another marketing tool. This is asking for people to exploit this tool and make a quick thousand bucks. OH and to all you morons calling criminals dumb, ask yourself how many people know what theyre stealing! If they do you better hope theyre dumb! If i were a criminal straling your laptop i wouldnt connect it to the internet, catch me if you can. Am i really a dumb criminal now?

Re:Wow, What Garbage

[Anonymous Coward]

Q. What are the browser requirements of the Computrace Personal web site?
A. The Computrace Personal web site currently supports only recent versions of the Internet Explorer browser (version 5.5 and above). The site also requires the default security settings in order to install and configure the Computrace Personal software on your computer.

In other words, we not only won't be able to help you when your computer gets stolen... We also want it to be so full of spyware that the theives get so frustrated they give it back!

Bicycle

[dacarr]

I'll be impressed if they come up with a lojack(-like) device for a bicycle, frankly. Only problem I forsee is where to put it and how to power it, since most bicycles don't have batteries, many don't have dynamos (and those who light prefer batteries versus dynamos), and it's pretty hard to find a spot on a bicycle that isn't going to require cutting into the frame.

Novel Concept

[crutchman]

Here's a novel concept....use more standard forms of security...eg...lock your doors. Back when I was living in college dorms 6 years ago (is it bad I already feel old?) the most common reason people had their laptop stolen is because they left their dorm door unlocked and went to take a shower, etc... Laptop locks have been around a long time as well (of course, as we learned from the bike-lock world, sometimes the best lock can be defeated by a BiC pen) Granted everyone will be able to come up with a what if this scenario, what if that, but the best solution to solve the problem is to be like an onion and have layers (ok, shoot me for the lame joke). A layered approach is always the best bet. Lock your door, lock down the laptop to the desk if you so choose, and install some "Phone Home" software if you like. But of course, given physical access and enough time, anything can be defeated.

Linux security distro?

[zeketp]

Boot from external source, crack the users password, remove the security software, all without activating any alarms. Boot off internal drive, use password, steal personal data, wipe drive. Free identity with every laptop!

I doubt it would be affected by firewalls, because the client would just send a signal, and there would be no incoming response. It wouldn't be affected by NATs either, because it could just signal the server and the server records the IP address the signal came from, not what the software sees as its IP. I'm sure you could write a program to do this in a minute. It just records every ping it gets and also receives an encrypted key that is different for each laptop. The client just pings the server and sends its key with it. Keys are automatically assigned from the server on first use.You could probably make a shell script with only a couple commands for the client, and another slightly longer one (due to key assignment) for the server.

gone in 6 seconds?

[pintomp3]

with all the new technologies to protect laptops, i wonder if we will see a movie about stealing laptops? gone in 60 seconds meets hackers perhaps. i can't wait to be an elite internet joyrider.

Tinfoil hat crowd??

[AntiCopyrightRadical]

Anyone who is even mildly paranoid is not going to want to install (trusted?) software that gives away their location every time they get online.

Re:Wow, What Garbage

[Col. Klink (retired)]

> ...but unless you get another ethernet card they DO have your MAC address.

Or you just reconfigure it:

ifconfig eth0 down hw ether 00:00:00:00:00:01
ifconfig eth0 up

No loops in basic?

[g-san]

10 GOTO 10

a.k.a. an infinite "loop"

Speaking of paying attention to one's teachers...

Re:No loops in basic?

[stoborrobots]

I believe his point was that there were no loop constructs - you had to create your loops manually using if and goto...

Easy to Thwart

[eno2001]

Just take the laptop, plug it into a non-Internet connected network that has snort running on it. Watch for the DNS queries, ICMP, which ports are outgoing from the laptop, etc... It shouldn't be too hard to collect the needed info, write a "de-tracer" program to be installed on these types of laptops and POOF it's all yours. Not that I condone that sort of thing, but I'm simply putting out an example of how to break the system. You can't solve people problems with computer technology. If you want to cut down on laptop theft, do the following:

1. Don't let your laptop out of your sight. Ever.
2. Put the CPU (with a symbiotic identifier for your particular laptop) in a key fob that ensures it's a useless box unless your keys are stolen with it. (CPUs need to be smaller than they are. 1cm x 1cm is preferable)
3. Don't lose your fucking keys

Brigadoon PhoneHome already doing this

[Aire Libre]

Brigadoon has software for Macs and PCs, 30-day trial and $30 forever, to do essentially the same thing. See https://www.pcphonehome.com/

How does the laptop know it's been stolen?

[Anonymous Coward]

Yes, you can call me paranoid...

They have a hardware version

[Anonymous Coward]

It's installed at the HW level on all Thinkpads.

http://www-1.ibm.com/press/PressServletForm.wss?Me nuChoice=pressreleases&TemplateName=ShowPressRelea seTemplate&SelectString=t1.docunid=7525&TableName= DataheadApplicationClass&SESSIONKEY=any&WindowTitl e=Press+Release&STATUS=publish

I think this is the direction the company is going.

I don't see how this can work

[-Harlequin-]

When the theives turn on the laptop, they can't connect it to the internet without entering the logon password. So their only option is a fresh install... meaning the Lo-Jack software is uninstalled.

Do you have to dispense with passwords for LoJack to work?

Do you set up a passsword-free guest account as a kind of honeypot?

Waste of money

[Anonymous Coward]

Anyone who steals a laptop will wipe the disk and get a new version of Windows,etc installed on it if they are after the hardware.

If they are after data, we can assume the data is encrypted and the machine has an operating system with a user id and password. In this case, the disk is going to be mounted on another machine and analyzed.

In either case, I don't see how this software which resides on the disk as per TFA is going to help.

Mac had that already!

[Evil Al]

I'd been using TrackYourMac for over a year but their site (trackyourmac.net) seems to have disappeared and been snarfed by Seeq.com.

Pity, it gave me a nice, warm false sense of securtiy :-)

heu

[pooly7]

silently sends locating data So do I have to by a GPS to do that on my lapotop ?

Ha! They are still alive?

[Anonymous Coward]

I worked for these guys 10 years ago when they were just starting the tech up and using 1800 phone numbers to call home. Didn't realize they were still alive. I would think they would have to integrate the technology into the motherboard itself. I was also wondering about if they would use GPS... Doesn't GPS not work too well inside some buildings?

GSM/GPRS + GPS

[mynickwastaken]

How much it costs to integrate a GSM/GPRS modem with a GPS locator inside a laptop? No bios, no OS, no software. Just a device (built in the Notebook HW) with a rechargeable battery wich sends periodically the GPS location after the owner reported that was stollen.

Dynamic DNS

[thomas.me]

...is a very efficient, cheap, and stealthy way of getting a laptop to always phone home. As far as I can figure, that lock doesn't do anything Dynamic DNS can't do.

I have configured my PowerBook to phone home on boot, without having to log in. A firmware password prevents booting with any other system that the one on my harddrive.

Of course, this helps only against novice thiefs. Experts can easily circumvent the firmware password, and nothing helps if the stolen laptop is not connected to the net, or if hardware is removed beforehand.

Furthermore, I figure as soon as I have the thief's IP address, there are ways to get my laptop back. I never had to prove that, fortunately.

On the other hand, I need dynamic DNS anyway, so the protection is a free side effect.

The compu mob...

[DirtyFly]

Ring, Ring ... - hi, this is compumob, you are using a stolen computer, either you pay us $500 or we eill tell the cops ... - burps the $$$$ DOSH $$$$ -hi , is it the police ? Im reporting on a stolen computer at address .... mua ah ah ah --- r u a retro computing fan ? http://www.retroreview.com/

NO BOOT DEVICE FOUND

[lazarus]

I was ordered to install this crappy software on the engineering workstations of a company several years ago. Shortly thereafter one-by-one all of the workstations the software was installed on failed to boot. The commonality, of course, was this software (which locates itself in your boot sector).

The company was absolutely no help in troubleshooting or fixing the problem as I recall, and I had engineers who didn't understand why their workstations were dropping like flies. After wiping their drives (including re-initializing their boot sectors), the problem went away and never came back.

Do not walk, RUN away from this software. And for that matter, you should *NEVER* install anything that messes with your boot sector unless it's a boot manager.

Frame someone for laptop theft.

[Pointer80]

This sounds like a good way to frame someone. You steal a laptop and then go turn the laptop on and associate with their home AP. Subpoenas are issued. Customer information is released. Police show up and arrest unsuspecting victim. Laptop not recovered.

/pointer

its called cpuid & palladium

[Hecatonchires]

and this is slashdot. we hate that stuff here.

No one has addressed the wireless angle yet!

[celerityfm]

I just bought a laptop and was considering something like this because, like most new laptops, my laptop has built in wifi. Now, I've configured my laptop to automatically connect to any available wireless network. Many /.ers seem to have said "I wouldn't connect it to the internet until I've wiped the hard drive" but no one has mentioned wireless yet so this gives me hope that the common thief would never even CONSIDER the trap that I'd lay for them:

With software like this installed, simply turning ON the laptop near an open access point will give away their location!

Now many have said "hard drive removal" negates the process and to them I say, password protect your bios settings so that the computer will boot, but access to bios is password protected so therefore changing out the hard drives becomes more difficult, assuming you can setup your bios for that and manually enter your HD information.

But this software, or the DYNDNS trick someone else mentioned + wifi = the win.

Feasability

[g0bshiTe]

This is a good idea but impractical (sic). The idea has been touched on here before. A few things, no default user password would be set. The default user would need to be able to access the net, how many of us set BIOS passwords to prevent booting from CD? What's to keep said crook from fdisking the drive and doing a fresh install. A better idea would be to have some type of theft insurance on it. But with the current price of laptops, is that even worth it? I have never had a laptop stolen, I have also never put it in a situation that it could be stolen. At school it fits in my backpack and goes into the bathroom with me. I would rather shut it down than be shut down upon return to find it had taken off. It never stays alone in a car, not inside, not in the trunk, and not under a seat. In fact when out and about with it, it doesn't leave my site. Of course none of these steps would prevent a face to face laptop jacking, but if someone is willing to try that, I'd hand it over. It's equipment, not my life.

We use Computrace where I work

[Anonymous Coward]

I hate to post anonymously however the words deserve to be spoken, I just can't speak them aloud.

We use Computrace where I work. In fact I am in change of it from the IT perspective. However, the return rates are pathetic. Until the lastest generation of the software all one had to do to defeat the software was reinstall any Windows NT based operating system on the drive (NT3.5/4/2000/XP/2003) the call home functionality was stopped dead by the HAL.

It was able to call home if the machine was running DOS/or a 9x kernel.

It still can't deal with Linux or any other *nix on the machine. Having those on the machine will also stop the call home dead.

The easiset defeat of all is to simply pull the hard drive and replace it with a new one. I have argued time and again with them on this issue. With the price of drives if I thief makes off with a machine they can easy do this simple task and avoid detection.

The machines boot order has to be fixed and locked so it can't be changed so the machine can do its work as well. The Hard Drive has to be first in the boot order or the agent can be easily defeated. I have told my company this 100's of times and they continue to ignore my advise.

Guys are being too critical.

[gurps_npc]

You guys are all saying "The thief could do X, the thief could do Y".

Yes he could. The software is not supposed to be perfect.

The quesiton is not Is this the single peice of security that will solve ALL your stolen laptops problems.

Instead the question is: Given the typical missing laptop situation, will this be helpfull?.

It will DEFINITELY be helpfull in a "lost laptop" situation where you left it someplace and was found by a reasonable person who decides to use it. (Lets face it, people do "forget" computers).

It will also Definitely be helpfull when some idiot who is too stupid to get a job decides to steal something. Low end street thieves are NOT smart (or rather, anyone risking prison and a legal record for a mere couple of grand is not smart - when smart people steal they go for at least a $100,000. See Embezlement.)

So YES, I do think that in at least 50% of the likely missing laptop scenarios, this will be helpfull.

But if you really want security, do the following:

Install a wireless modem with GPS capability. If you really are paranoid, open the case and install it in the case. Frankly, I don't think people will remove the card.

Set up the modem so that it will answer back anyone calling it with a modem line, and just log on remotely and activate the GPS.

Cost would be reasonable, assuming you want a wireless modem for other purposes and had sensitive data.

backup is better

[grikdog]

IIRC, LoJack puts "secret transmitters" into cars so's they can be tracked by cops if stolen. Oh kay... So, if I put one of these software jobbies on my laptop (it will work with Apple laptops, right?), what prevents Little Snitch (or -- heaven forfend -- even some little homebrew daemon script that monitors tcpdump) from noticing the "alert"?

This reminds me of "the club", that low tech bar you lock onto your steering wheel -- defeated in 10 seconds by a $20 hacksaw that wrecks a $200 steering wheel so the thief can drive off with a $28,000 Toyota. None of these systems PREVENT theft. None of these systems ALERT anybody, if thieves know where to look, what wires to jiggle, what files to delete, what black box to smash with a ball peen hammer.

Especially with commodity-priced laptops, you're better off assuming your laptop WILL be lost or destroyed, which is why you clone your hard disk onto an external Firewire drive every other day. Way cheaper, and provides 100% peace of mind.

Actually...

[The42]

I had thought of something like this - but not for laptops. I was thinking that portable MP3 players, iPods in particular, could use something along these lines. Why? iPods are less modification friendly than laptops. The odds are good a thief would be stupid enough to plug it into an internet enabled computer - hell, he has to plug it into some kind of computer to format it. Not that it's foolproof, but I think it would at least increase your chances of seeing your device again, particularly if the tracking software was very agressive. I was thinking, basically install malware on the thief's computer that reports back to you via email. Again, a technologically competant person would probably catch it, but there are plenty of people who wouldn't.