Slashdot Mirror
OLPC Has Kill-Switch Theft Deterrent
Sid writes "Ars Technica reports that the One Laptop Per Child (OLPC) XO has an anti-theft daemon in the OS that can be used to remotely disable machines, much like WGA. The Project added the kill switch at the behest of a few countries concerned about laptop theft. From the report, 'OLPC has responded to such concerns by developing an anti-theft daemon that the project claims cannot be disabled, even by a user with root access. Participating countries can then provide identifying information such as a serial number to a given country's OLPC program oversight entity, which can then disable the devices in certain scenarios.'"
Wait vista can do this.
Kid gets out of line, discovers blogging .. time to shut off his access..
Like when a bunch of rebels steal all the laptops and start using them for crime? Wouldn't you want to leave the machines running so you could track what they were doing? What situation(s) exactly would warrant shutting off the machines?
stuff |
Psshaww... Sony's laptops have much more effective kill switches than this.
There are many tongues to talk, and but few heads to think. -Victor Hugo
Sadly, I would imagine it will be a very short period of time before the feature is defeated. It's still a deterent I suppose, just not as much of one ...
The potential for abuse here is pretty high. If the controlling government (Read: whoever controls the Internet connection and licensing servers, so maybe a corporation) wants to keep the people in line, they can just threaten to turn everyone's laptop off. If an invading nation wants an information blackout, shut everyone's laptop out.
..... Just look at what's happening to the guys who do DRM for the MAFIAA. Face it, ANYTHING can be cracked if you try hard enough.
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
Software protection?
Hmm, I believe the correct response would be ROFLMAO*. Seriously, what the frak? That's like saying they will put Windows on it so that no-one can pirate CDs thanks to it's protection.
*Yes, yes, I know it's not physically possible without severe injuries.
If the user has root access, then it is his box. Any component can be removed, including the dhcpcd client which attempts to enforce this rule.
It is only "possible" if you agree to run their software as installed.
Their reliance on GPL components should make it clear which components need to be replaced to avoid asking permission to continue using the software.
So, does this mean that the OLPC project is going to need a back-end infrastructure to support this Daemon? With the amounts of laptops considered in this project, that means that a pretty large back-end infrastructure is going to be needed to support this process.
In addition, there's going to need to be a tremendous amount of "process defintion" for something of this scale. What constitutes a "stolen" laptop in this case? How is it reported? To Whom? Who is ultimately responsible?
Sounds like a massive undertaking and far from clearly defined, other than a "Daemon is available."
Lindsay Blanton
RadioReference.com
I was able to do this and *much more* with Microsoft operating systems. I was able to turn off the computer, open the CD-ROM drive and even play sounds remotely using utilities such as black orifice or sub-seven.
Gosh, this is nothing new...
Ubuntu is an African word meaning 'I can't configure Debian'
I can see the writing on the wall.
...
Greetz griefers! Want to 0wn the n00b in your class? download this script and run it to disable anyone's OLPC.
Here's what you do:
Sounds to me like a convenient way to gag someone that a government doesn't want to be heard. "Are they making derrogatory comments about the leadership? Well then, just turn their computer off."
I suppose, it probably will only be a matter of time before some individual will figure out (in their mind) that this is a good way to extort money from someone else. "Send me $nn or I will disable your computer(s)." Then again, if they're using a $100 laptop given to them, what money would there be to extort?
tommy wouldn't go to bed at night so we decided to use the kill-switch on his OLPC.
That makes it too tempting to give the laptops to people you want monitored- For instance, I could give it to random kids, and then figure out their schedules, where they live, and when they are alone in the house. And that's just scratching the surface- give me some time and I can think of worse abuses you could do with some sort of monitor on the computers.
De-activating the laptops prevents people from stealing and using them, but it also means that if some hostile person has access to your shutdown keys, they can take your laptop but not your data.
You are reading a copy of my copyrighted post.
Why would anyone steal laptops that are supposed to be so cheap they're going to be everywhere? Won't they be so plentiful and such a commodity that they'll be cheap as dirt and every family will have several? Why would anyone want to steal them? George Orwell's thought police invent a secret, non-root daemon to control theft on every single one of these? What else can it do? It can't be to deter theft, because the history of these things shows they're usually cracked before the thing is officially released. I will be following this story to see what the real reason for including this "feature" is. Keylogger? Censorship? Backdoor for totalitarian governments? The stated reason for theft seems spurious.
That's the same functionality as in GSM and UMTS phones: You call, tells that device is stolen and wich IMEI-no. it has and it is then globally disabled.
US$100 may not be much here, but it is more than the majority of people make in a month.
There are many tongues to talk, and but few heads to think. -Victor Hugo
As I mentioned before, the whole concept of an unconnected laptop or one with minimal internet access (i.e wireless mesh) goes for a toss with this feature. The worst of the activation features which windows has, negating the real advantage of having a laptop you could take literally anywhere. Locking out someone just because they couldn't hook their PC into the network for twenty days is no way to make OLPC work. The real way to keep them off the black market is to reward those who keep their machines intact - just like the way to get kids to come to school has been a free lunch programme (and I sit in an Indian state with 99% literacy rates).
Or if you're really interested in reducing the utility of the machines, send an access code to the school master every month - for the laptops to get on the internet. You need to go pick up the coupon to get back on the internet and just kick the ones which are reported missing in audits - rather than go in for an active licensing scheme as mentioned in the document.
But in general, technical solutions for social (as well as economic) problems hardly work out, by themselves.
Quidquid latine dictum sit, altum videtur
It will be used to shut off the machines of disadents. Governments don't seem to care that much about machines being stolen, but they do care about giving power to political opponents. If I buy a machine, I should have complete control of it. No one should be able to remotely turn off the machine without my explicit authorization. I can't think of any way to make a feature like this safe from abuse.
-All that is gold does not glitter - Tolkien
www.ra
I have to say, I don't like the decidedly big-brother tilt the OLPC project has been taking lately. With all the news that has come out lately on OLPC, the whole "users will be able to read/understand/modify its source code" stance seems to have gone away.
If I can read and compile the O/S, who's to say I can't just remove the kill daemon from my build and then install it? In order to be robust, they'll have to lock down the installed software and make it impossible for the user to change. No community development; no share-and-share-alike; no software libre, counter to the whole "open source" philosophy they tout as the project's base.
This isn't a hacker's dream toy; its a business proposition to sell expensive supporting infrastructure and services along with a loss-leading locked-down client device disguised as charity in the name of educating the poor.
Yeah... its called the immutable bit.
My karma is not a Chameleon.
OK, I teach in a public school. My computers often are shut down for 21 days or more ... like over vacations. And with intermittent internet connectivity is often down for two months. That's here in a California public school!
And school thieves steal things with zero street value, including keyboards, cables, and AC power cords. Heck, someone stole three VGA monitors over winter break, saving us $30 in dump fees.
Several people, myself included, specifically pointed this out during the last story on OLPC's BitFrost system..
And can we please remember that it's One Laptop Per Child, and not One Laptop Per Slashdot-reading Guerilla Geek? Any abuse regarding deactivation of the laptops is more likely to be carried out by confiscation of the laptop by school personal.
Also, the feature can be disabled with a Developer Key from OLPC:
- http://dev.laptop.org/git.do?p=security;a=blob;hbMy Blog: http://nic.dreamhost.com/
chapta: repress
that is freaky
... the more likely it gets to fail.
When this (old) news first came out, I posted this gloom and doom comment, but after reading the spec, I realized that the picture was more complicated than my comment, or the summary above, indicates.
FTF Spec:
The anti-theft system cannot be bypassed as long as P_SF_CORE is enabled (and disabling it requires a developer key). This, in effect, means that a child is free to do any modification to her machine's userspace (by disabling P_SF_RUN without a developer key), but cannot change the running kernel without requesting the key. The key-issuing process incorporates a 14-day delay to allow for a slow theft report to percolate up through the system, and is only issued if the machine is not reported stolen at the end of that period of time.My earlier concerns were that this funcitonality was the same type of call-home spying and TPM kill-switch control that MSFT in its most evil moments would love to have over all of its users and that OLPC had totally screwed the pooch.
The spec makes it seem a bit more like a maximally secure default setting, whose override is difficult but still accessible. They are simply storing the lock (the laptop) and the key (the developer key) in different places. The keys won't be given out if the lock has been reported stolen, but if not, they are available to the machine's owner.
Something about this still worries me, though. The developer key makes this system radically different from something like the WGA's phone-home spyware "feature" in that it can be disabled by the machine's owner, but given that the default setting is so hard to override, is the effect really all that different? Is this going to screw over less techical users who make a mistake and somehow manage not to "renew their lease" frequently enough? Worst of all, if something goes wrong with the centrally-managed key distribution system, millions of kids will be left with fully locked down, unhackable, TPM machines that will brick in an instant if they wait too long to phone home to the server of a government that may be more interested in censoring them than empowering them.
I'd be curious to hear what Stallman has to say about this project, especially this aspect of the security system. I think everything else about this project would suit even his lofty standards to a tee, but I think OLPC is walking a fine line with this anti-theft system.
No jokes, please
In most cases the value to the thief is not in the object itself but in its resale value. If they know that the laptops will be bricked before they can shift them, it might deter some people from swiping them.
It will deter few. I recall looking at computer equipment in a pawn shop. I was excited as I saw some IBM Model M keyboards. Upon inspection I found that the keyboards had not been unplugged, the cables had been cut. I expect many thieves will have difficulty telling OLPC systems from normal systems at the time of the robbery. I also expect that highly organized thieves will not shy away from stealing a large shipment of these laptops, and stripping the RAM and HD for salvage.
Also, "resale value" may be misleading. It is rarely sale to an end user, rather a middleman, as in pawned, laundered, fenced, etc.
"Hi, my name is Valerie Victim. Somebody stole my laptop. It's serial number is 123-456-789. Can you disable it?"
"Certainly."
"Thanks!"
Monique Malicious chuckles, then walks away, her handiwork complete, her rival's laptop disabled.
I certainly hope they've prepared to prevent such scenarios. Granted, you need to know the serial number, but if it's printed on the back of the thing...
If corps don't like what you are doing with their hardware, BZZT!
What"s with this "slave the user's machine to the mothership" mentality? "The system allows countries to optionally establish a "license" period for the laptops, such as 21 days. Laptops which are not renewed within the timeframe will lock." Get too far from the local wireless node and your machine dies? And they want to deploy this in third world countries?
That makes life easier for terrorists. The Taliban, which is coming back in Afghanistan, is going to exploit this. Destroy the local school (standard Taliban operating procedure) and its wireless node, and all the kids' computers die. Today at least the parents and kids can hide some books. With OLPC, it's easier for Islamic fundamentalists to destroy knowledge.
There is no HDD. There's like 128 MB of RAM, and 512 MB of Flash (expandable). You couldn't sell a 128 MB stick of RAM for any sort of large profit (most retail sticks start at 256 MB or 512 MB), and a removing the flash and consolidating it into something useable to any other product would exceed the costs of bulk flash in the first place. The displays probably need a custom driver. The only thing really useful is the battery, and even that's low-end.
The fact remains that when you take into account the costs of stripping the OLPCs for parts and selling the parts on the black market, you quickly exceed the possible resale value of the parts.
Maybe they shouldn't be so quick to disable or even interrupt service to stolen laptops. Even in the wrong hands, these laptops are not that useful for anything besides learning. Who knows how children of the rebels would be transformed by learning to program Linux.
Say what you will - it's great to hear that Macrovision and Microsoft have decided to participate in this worthy project!
#DeleteChrome
$5 says criminals find a way around this in the first week or so, and the only people who continue to be bothered by it are the legitimate users...
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
Call me a sceptic but I don't think that theft has anything to do with the motivations for this "value add" here. Afer all, you could always take out the hard drive if the data is what you wanted (assuming unencrypted). You can reformat the hard drive and reinstall puppy linux if you just wanted the hardware. Data could be encrypted to keep people from stealing data. So what does "disabling" the laptop OS do to deter "theft"? With a techie, (or even a smart high school student) absolutely NOTHING. It won't stop anyone from stealing a laptop which in some countries are worth a lot even for the parts alone. This is really about "big brother". Pure and simple. Governments want to keep tabs on what people do on the Internet and possibly track where people are, just like in China and a few other countries. If the governent doesn't like what someone is doing, they disable the laptop to stop any "anti-government" e-mail, blogs, chat..word documents, whatever. By "stamping" the laptops in this way, its easier to get a positive ID on the last person the government "allowed" to have it. This is nothing to do with theft deterence. This is about controlling the activities of the population. Wait till China starts this in Red Flag, the Chinese made Linux distro. (Come to think of it, its likely they've built that in already and kept it "hush hush").
"Imagination is more important than knowledge" - Einstein
An even better reason to build in a deterrent. A 'dumb user' may see a laptop and not know the kill switch exists but you can be sure the middle men know what they're buying.
Yes, some thieves are idiots but I'd presuppose that most are just desperate to make any kind of money in order to support substance abuse.
Bye!
And it will be called ' brick your friend's PC '.
Great fun ahead !
---- Booth was a patriot ----
I'm frankly quite amazed that there doesn't seem to be a single comment acknowledging that this is in fact a very important, even essential, feature.
Those laptops are meant for people who could otherwise never possibly afford to buy a computer. This means that they have a very high value in those places, often places where there is a high crime rate and a tendency toward extreme violence even for simple thefts.
I would not want my kid to walk home from school carrying something that might be worth several months salary (and everybody knowing about it). The only way to protect the children from getting robbed and possibly killed for their laptops is for those laptops to have zero resell value for thieves.
Seems to me this could be misuded by a goverment for political suppression.
Speakin' of the batteries, I heard these things have some form of crank-generator so you don't need to plug-in. I'd KILL to have that on my $1500 lappy....no worries if I forgot to charge before I left the house or forgot the charger somewhere...just crank it a bit and I'm operational. If I had a $1500 lappy and I saw someone with a $100 lappy with a hand crank, they'd have a hard time keeping it for that reason alone..heh.
0x09F911029D74E35BD84156C5635688C0
"It's not like I'm using, It's like my body's developed this massive drug deficiency." --every geek better know where that came from.
0x09F911029D74E35BD84156C5635688C0
How hard is to take out a simlock from a mobile? Guess how hard it will be to reflash the memory to get rid of this daemon?
You guessed correctly - in no time. That technology should be incorporated in hardware (something like in Thinkpads).
And another thing - they will steal it - just for a spare parts for other ones. Plus guess how many will be blacklisted, and how many left alone because nobody would care to go to speak with corrupted police?
They go to third world, there everything is possible. Company I worked for used to build GSM masts concealed as palms, if not they would be stolen!
Any more questions?
"an experienced, industrious, ambitious, and often, quite often, picturesque liar" - Mark Twain
Assuming the connectors and the voltages and stuff match up (which I doubt), the handcrank doesn't produce a lot of power. Sure, it's a decent amount in relation to the ultra-low-power OLPC, but it's not gonna do much compared to a Merom or Turion with 1-2 GB of RAM and a HDD with a full color display. I mean, I bet the crank-time-to-powered-time ratio would be essentially reversed at best (you'd spend twice the time cranking that you'd get in battery time).
ask anyone with thirdworld roots - where the XO is intending to go - and they'll tell you that the families will take the money every time.
www.itjerk.com
OLPCs give the possibility for the masses to communicate and organise in the way that these regimes do not like. Said regimes will want a kill switch etc to control the citizens.
Engineering is the art of compromise.
Didn't you mean pwned?
(sorry) :-)
Like in the case of political subversion. Let's hope we can disable the disabler. "Laptop theft" indeed. That has to be one of the lamer ruses I've seen in a while.
What?
If I can replace the boot media, even if it requires replacing chips, the system can be defeated.
This whole system is open-source, right?
I expect most sophisticated thieves would pull the boot media and replace them with their own, perhaps one with nefarious keylogging or other evil software.
If it's protected at the firmware level, then it's DRM'd and therefore evil.
BTW, to the person who claimed that root=own, that is only true if the kernel and lower-level software make it so. If the kernel doesn't provide any control interface to a particular function, then userland applications cannot control that function, root or not. If the functions necessary to modify the boot sequence and boot kernel and load kernel modules are not provided, then you cannot change them from within a running system. Time to get out the screwdriver and try for a hardware mod.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If these computers can be bricked it they're stolen, then they're less likely to be stolen.
Although these are 'low cost' to most of us, in many of the places they're going, these are going to be comparatively expensive bits of kit (and easily the most expensive item a child is going to be carrying about).
Anyway, if the laptop can be made just a bit less stealable, then the child carrying it is that little bit safer - which is surely slightly more important than a load of self-righteous geeks blathering on.
I dunno. Is it printed somewhere in my Texas Instruments TTL Data Book? (hardbound, orange cover)
Or am I not a 'geek' for not knowing key pop culture references?
How many rhymes do you know that aid in remembering the resistor color code?
I think you meant Back Orifice, Black Orifice is something altogether different and has little to do with computer security!
If you can read this, it's already too late.
When I read the title I associated something like in South African cars...
But seriously, this is worse than WGA. This is pure Borg think.
Circumcision is child abuse.
As far as I know the entire OS will be on a flash ROM in any case, so switching that won't be an issue. However, if they include the possibility of booting from USB or CD-ROM, that might be a different story altogether...
That was "Back Office", a product by Microsoft (IIRC, they renamed it later because of that trojan malware).
Sorry, no "pop" culture to it unless your version of pop is over 20 years old.
0x09F911029D74E35BD84156C5635688C0