Tracking Down a Cell Phone Thief

Zone-MR writes "Last Saturday, MoDaCo (the world's largest smartphone community) held a get-together for their forum members. Unfortunately the positive community spirit was soured by an individual who decided to steal one of the charity raffle prizes - a C550 mobile phone. Check out the story of how we tracked the thief down, got the phone back, and secured the thief's place in the interweb's hall-of-shame."

Comments

Re:Interweb?

[Phosphor3k]

Yeah seriously. Everyone knows it's 'intarweb'.

Why would you do it?

[fgl]

That has to be the dumbest thing ever. Stealing something guarenteed to broadcast its presence. And from within a tech convention?

text of the article

[Anonymous Coward]

http://zone-mr.net/?act=entry&id=36

Last Saturday, MoDaCo (the world's largest smartphone community) held a get-together for their forum members. Unfortunately the positive community spirit was soured by an individual who decided to steal one of the charity raffle prizes - a C550 mobile phone.

On Monday, Paul O'Brien (MoDaCo founder) contacted me with information on the stolen phone's IMEI number. I operate the SPV-Developers community which offers the free online SPV-Services unlock tool for this type of phone. It seemed likely that the thief would attempt to remove the SIMLock using this service in order to switch the phone to a non-UK network - bypassing the UK's IMEI blacklist which renders stolen phones useless.

Initially it seemed like there was little I could do to help. The SPV-Services server was not programmed to log the IMEI numbers of it's users. It seemed like a dead end, until I remembered something. When a user unlocks their phone, our server keeps a backup of the phone's first flash block (kept for a few days, in case the changes need to be reversed). This block contains 64kB of RSA-encrypted data such as the phone's SIMLock state, Carrier ID, and other concealed information - it seemed likely the IMEI would be buried within it. Shortly my suspicion was confirmed - after decrypting the block, the IMEI can be found inside (albeit scrambled with a simple transposition).

I started writing a short script - which would check each backup in turn to see if it originated from the stolen phone. After 30 minutes of writing, testing, and running the script - we had a match! The stolen phone had been unlocked. The creation timestamp on the backup file gave us an exact time - August 21, 2005, 10:18:32 PM.

The next step was cross-referencing this information with our web server logs. When a user uses our software to unlock their phone the software uploads the encrypted block to our server, which sends back a list of modifications which need to be made in order to remove the SIMLock. As we knew the exact time when this happened, we could find the corresponding web server entry :

        2005-08-21 22:18:32 POST /services/simlock_2.php - 82.163.137.156

Bingo! I passed this IP address back to Paul who cross-referenced it with Modaco's database. From this, he was able to identify the guilty member. A quick lookup confirmed that the IP was used by the account "Cocky" - a member which had attended the get-together. The event registrations contained the name of our theif, and his mobile number. The next day, Cocky (AKA Krassen P.) received a short phone call:

        Paul: Hi, this is Paul from MoDaCo.
        Cocky: Er, Hi.
        Paul: You have something of mine, and I want it back.

Not surprisingly, Paul could hear the faint sound of the guy crapping himself at the other end of the line. The phone was returned, via special delivery, the following day. Moral of the story - even if you're enough of a cunt to steal from a charity raffle, don't be fucktarded enough to steal a phone from a community of phone experts.

Re:text of the article

[Necrobruiser]

I assume you are referring to the use of the word "cunt"?

From http://en.wikipedia.org/wiki/Cunt : "In British usage it is mainly directed at men, and is considered an insulting swear word."

I feel sorry for all of the people in your life, you probably have some of them fooled into thinking that you're not a judgmental ass.

Re:text of the article

[shirai]

Another slightly more detailed account of the same event:

Detailed Account

Mono, Orange and Microsoft arrived early, and set out all of the stuff for the event... including the raffle prizes. The prizes were, foolishly it seems, laid out in the corner... footballs, kites, goodies and an SPV C550!

We are not entirely sure at which point the phone was stolen... but a number of people witnessed what appeared to be the C550 being wrapped in a cardigan and placed in a bag along with a couple of other items including an Orange football, and a kite that was apparently discarded.

At some point, probably prior to the raffle, the thief or his companion probably left the building, and took the C550 somewhere for safe keeping.

As those present at the event will know, when the theft was discovered, Monolithix (who should be commended for staying calm!) offered the thief every opportunity to return the phone with no comeback, pointing out the phone would be useless anyway as it would be blocked on all UK networks... but nobody came forward. Having spoken to 'cocky', he said he was afraid to come forward.

At this point, there was not a lot more we could do... we liaised with the staff at the Microsoft building, and determined that although there was no CCTV in the room, there was CCTV in the foyer.

On the following Monday, I contacted Orange to ask for the IMEI of the stolen phone so that we could conduct investigations, which Orange duly provided. I also investigated whether we could determine whether the stolen phone had been used with an Orange SIM (99% necessary if the thief unlocks the phone), and Orange confirmed that they could do this, albeit with a 1 week delay. This provided us with one possible avenue... although for Data Protection reasons, pursuing this route would have required the action to be taken with the Police.

I considered it very likely that the thief would have tried to unlock the phone... so armed with the IMEI of the stolen phone... I contacted the key players in the C550 unlock scene, Florin from IMEI-check and zone-mr from SPV-Developers.

Florin confirmed that the phone had not been unlocked with IMEI-check... however zone-mr couldn't confirm immediately, as he only retains an temporary backup of encrypted data from the phone, which he wasn't sure included the IMEI

A couple of hours later, on Monday evening, zone-mr contacted me to let me know he WAS storing the IMEI... and we had a match! Our thief HAD unlocked his C550... at 10:30pm on Saturday in fact! Even better news... careful analysis of the server logs on the spv-developers unlock server gave us the IP address of our thief!

The next step was to find out as much information as possible about the thief. We determined their ISP and some other information, and thought about how to proceed. On an off chance that the thief was foolish enough to unlock the phone from the same connection they used to browse MoDaCo... I checked out the MoDaCo logs, and the MoDaCo sessions table.

Success!

Our thief was logged on, and the logs were full of the IP address in question... all pointing to one user.... COCKY!

Cross matching this address with the Event registration list confirmed that cocky HAD attended the event... and not only that... upon further consultation we determined that cocky was the person that witnesses had cast suspicion on.

The next step was how to decide how to proceed, armed with the evidence that we were sure conclusively led us to our thief. I stayed up late on Monday night and prepared a dossier of evidence, with excerpts from server logs, witness statements etc. to pass to the Police. After a late night... I decided to sleep on it before deciding how to proceed.

Tuesday came, and I decided that I was going to contact the Police... and spoke to both our contacts at Orange, and a contact at Orange security, about how to proceed. As the morning prog

some good detective work...

[wcitech]

...and a little luck.

While some good detective work was done by the MoDaCo admin(s?), a lot of thanks can be given to chance, because the cultprit was stupid enough to unlock his phone a) from a source well known to MoDaCo and b) from the same IP address. I'm calling it 25% good sleuthing, 75% dumb criminal.

Re:some good detective work...

[Alex P Keaton in da]

Most crimes are solved because the criminal tells someone, or does something stupid. (I don't mean miniscule stupid things like you see on TV with CSI, I mean really dumb things...)
Sure there are some good, and thus rich criminals out there. But the majority of them are fairly dumb.

Re:some good detective work...

[rzebram]

You mean to tell me that real police officers can't zoom in on footage taken from a $5 security camera and enhance it enough to read the room number off the keycard in someones hand? Or that they can't pull up a guy's life story and his current location based on a fingerprint left on a furnace in Bangladesh?Blasphemy!

Re:some good detective work...

[empvirus]

Reminds me of a story a retired officer told me. Here's how it goes: A guy goes to rob a quickie mart with a plastic bag over his head, yet forgot something seriously critical to the "mission". He forgot to make an air hole so he could breathe. And while attempting to rob, he began to suffocate. The officer got there just in time to save his life. He would not stop thanking the officer as he was arrested. It's amazing how stupid some people are.

But... never steal a camera phone

[XplosiveX]

oh the reasons you couldn't steal.. It is worth a laugh.

http://www.longislandpress.com/bb/viewtopic.php?p= 2037&

And I would have gotten away with it

[Anonymous Coward]

...if it weren't for those lousy kids.

The rat speaks

[Anonymous Coward]

Here is the turd making a comment on the thread regarding the event and the missing phone.

http://www.modaco.com/Event_pictures_and_a_plea_-t 225214-s15.html

What an idiot.

Re:can you say misogyny?

[GreenHell]

cunt
      noun (vulgar slang) 1. a woman's genitals. 2. an unpleasant or stupid person.

You've obviously never heard UKers insult someone before.

Re:Interweb?

[TummyX]

Nope. Wikipedia disagrees. But mentions Intarweb as an alternate spelling. http://en.wikipedia.org/wiki/Interweb


You must be fun at parties.

Re:Set a Thief To Catch a Thief

[Nogami_Saeko]

Did you even bother to read the article?

The only "personal info" they found was the IMEI (serial number) of the phone that was unlocked, and the IP address that the request was generated from. Neither of which is "personal", BTW (the phone was stolen, and the IP address belongs to his ISP).

They just matched that IP address against people who post in their usergroup forum and tracked the guy down.

So the only "personal info" they used was the phone's serial number and the IP address the server logged the request coming from. So I fail to see the point of your rant.

N.

Department of Homeland Security Response

[f4phaedrus]

If this had happened at the US Department of Homeland Security, they would have raised the alert level to Orange and we would be told to be on the lookout for slightly overweight middle-aged men with glasses, wearing dockers, using a cellphone.
Anyone seen using a cellphone in a dark corner or putting a cellphone in an inside pocket (trying to conceal it!) will be immediately taken in for questioning.

Henceforth, all cellphone usage will require a licence at the county courthouse, and people must submit valid reasons for having one, and give their fingerprints and DNA for registration.

Re:Happened to me

[ImaLamer]

Someone stole my sisters phone in high school (just about a year and a half ago). I just kept sending the phone text messages like:

"This is the Cincinnati Police. This is a stolen phone."

"Cincinnati Bell Telephone Theft Tracking Services - LAST CELL TOWER CONTACTED: #28302"

"THEFT NOTICE: ALL CALLS ARE MONITORED AND RECORDED"

And so forth... The next day she got it back before her first class started. It passed through six hands all with the note: "Return this to Sadie XXXXXXX"

Re:You are missing the real issue. These guys are

[Zone-MR]

I'll bite this troll.

We have repeatedly stated that we keep a TEMPORARY backup of the flash block we change - generally as a precaution in case we screw something up and need to restore the phone.