The Khaki Bandit Strikes At IT - 130 Stolen Laptops

destinyland writes "'The khaki bandit' posed as an office worker at several corporations and successfully stole over 130 laptops which he later sold on eBay. The ease of theft from the corporate offices (including FedEx and Burger King) shows just how bad corporate security can be. In some cases, the career thief just walked into the office behind an employee with a security badge. Two million laptops were stolen just in 2004, and of those 97 percent were never recovered. Ultimately it was the corporate headquarters of Outback Steakhouse who caught the thief with a bugged laptop that notified them when he re-connected it to the internet."

Comments

Look at the way many people treat their laptops

[elrous0]

Considering the cavalier way many people treat laptops and projectors, I'm not surprised. No one would think of leaving $3000-$4000 in cash just laying around in the open. But I've seen plenty of people where I work leave brand new laptops and projectors sitting out in the open, unattended for long periods.

In fact, just a couple of weeks ago, one of our directors went on vacation and left his laptop and projector just sitting on the conference room where he had last used it (a large, wide-open conference room used by hundreds of outside people each week). They sat there for several days before anyone noticed.

Re:Look at the way many people treat their laptops

[tommeke100]

people don't care when they don't have to pay for it.
It's the same at our company. You wouldn't believe the state some of our laptops are after just a couple of months. cracked screens, missing keyboard keys, full of spyware, coffee spilled all over it, ....
I don't think ppl would treat their laptops that poorly if they had to pay for it.

Re:Look at the way many people treat their laptops

[Four_One_Nine]

Apparently in most business we trust most people to not steal laptops, projectors, LCD monitors, etc.

However it seems that NOWHERE in corporate America does any company trust it's employees (at least the male ones) to not steal the paper towels out of the mens room. The dispenser is ALWAYS locked up !

Re:Look at the way many people treat their laptops

[j-pimp]

It seems that NOWHERE in corporate America does any company trust it's employees (at least the male ones) to not steal the paper towels out of the mens room. The dispenser is ALWAYS locked up !

It really comes down to the fact that paper towel technology has reached the point that the right balance of security and usability has been achieved. In IT we have to pick an extreme.

Re:Look at the way many people treat their laptops

[Corporate Troll]

Ehm.... I have a work laptop. I would have preferred a desktop, but I got a laptop. Why exactly would I need to pack up my laptop every night, and take it with me or even lock it in a closet if it is in the office? I mean, if my coworkers are going to steal it, then the company has bigger problems than me leaving the laptop unattended overnight and during my holidays.

The office is only accessible with a keycard in the first place, so that leaves the cleaning ladies as possible thieves.

I don't know, but unlike so many of my coworkers, I feel no need at all to take a work laptop home. I've got plenty computers at home, the work one isn't going to make a difference to me.

Re:Look at the way many people treat their laptops

[Hoi Polloi]

We must keep paper towels out of the hands of terrorists. Even the janitor's closet has better security than most offices.

Seriously though, companies will take you to court over stealing a few hundred bucks worth of equipment but if you rob the company blind with sleazy accounting, incompetence, and outright robbery as an executive you get let go with millions in severance.

Re:Look at the way many people treat their laptops

[Chosen Reject]

A few years ago I was working in IT for a university. One of the professors didn't like the buttons by the touchpad because he would bump it with his palms while typing and end focus would change to some other app. So instead of disabling the touchpad, he just broke the buttons off. That was fun to explain to the Dell rep when he had some other hardware problems that needed to be replaced.

Re:Look at the way many people treat their laptops

[Nimey]

Gods know that either understanding & fixing the problem or asking someone knowledgeable would be too hard or make him look weak.

I hope you got his supervisor to LART him well.

Re:Look at the way many people treat their laptops

[Psmylie]

Get a laptop lock, one of those cable locks. You loop it around part of your desk, lock it to the laptop, and you're done. A lot of extra security for a very low cost and maybe 5 minutes to install (unless you don't have anything to loop it around and you need to attach an anchor to your desk). If you ever do need to take your laptop, just unlock and go. It's corporate policy where I work, and we're in a secure building as well.

Re:Look at the way many people treat their laptops

[hodet]

We had a user check it with her luggage on a flight. She was shocked when it didn't come around on the conveyor belt with her suitcase. :-)

Re:Look at the way many people treat their laptops

[mikael]

I feel like that about the power switch on my laptop when it runs Linux. An ordinary user can no longer power down the system by typing "shutdown", but the slightest tap to the power button, and shut down mode is activated automatically. No grace period, no "Are you sure, please confirm", no "System is shutting down in 10 seconds, press [XX] to cancel". It's just "The system is shutting down now" and the desktop just disappears , goes back to the command line and that's it - system is off.

Re:Look at the way many people treat their laptops

[eln]

At my one true "dot com" job, they issued laptops to everyone. My first day, I got a new laptop, and was told that there had been a rash of laptop thefts in the company, so all employees needed to take them home or lock them in a drawer before they left. Of course, I got distracted by the whole "new job" experience and forgot all about it, leaving it on the desk when I went home.

Sure enough, when I came back the next morning, the laptop was not on the desk. Visions of being fired after my first day on the job, and after moving my family halfway across the country for the job, danced in my head. Luckily, it turned out that my supervisor had seen the laptop and locked it in my desk drawer for me. Since then, I always take my computer home with me, even though now I work in an extremely secure facility (Tier IV data center).

Re:Look at the way many people treat their laptops

[jkroll]

Take a hard look at your laptop case before you think this is any real security.

Many laptop shells are just simple plastic and the cable locks can snap out with only barely noticeable damage to the laptop shell.

Discovered this when a coworker caught their chair in the laptop cable lock one day and "disconnected" it from his Dell laptop.

Re:Look at the way many people treat their laptops

[vivian]

Mabey you want to consider changing the powerdown options n your laptop's BIOS.

Re:Look at the way many people treat their laptops

[Liquid Len]

Seinfeld, is that you ?

Re:Look at the way many people treat their laptops

[Psmylie]

Absolutely true, the main point of it is to add some extra difficulty to stealing it. It's hard to pretend to be "the IT guy" when you actually have to physically damage the laptop's case to remove it. Also, you can tell your insurance company that it was locked to the desk, and the thief must have broken the case to remove it, so you might get a break there (We do... our company premiums have gone down more than enough to cover the cost of the locks)

Speaking of being "the IT guy", I am so very rarely stopped when wandering around strange floors in my company, or when leaving with equipment. I could see why someone with a criminal mind would find it trivially easy to steal equipment from a large corporation. Asking questions is the easiest, easiest way to discourage theft. Start with, "Can I help you?" and go from there.

Re:Look at the way many people treat their laptops

[Anonymous Coward]

I mean, if my coworkers are going to steal it, then the company has bigger problems than me leaving the laptop unattended overnight and during my holidays

Cleaning staff? Delivery services? Third-party maintenance workers?

Re:Look at the way many people treat their laptops

[Corporate Troll]

Why exactly should I shell out the money for that? Sure, it's only 5$, but shouldn't the company provide me with such tools?

Re:Look at the way many people treat their laptops

[Corporate Troll]

Why should you be fired for a laptop being stolen when the laptop is on the company premises? It is their responsibility to secure the premises. I mean, if it were desktops you couldn't lock them in a drawer and could be stolen too.

As for your last remark: you do realise that taking your laptop home from a highly secured area is more likely to result in theft of data. (I hope it's encrypted) Personally, my belief is that a laptop must be safe at the company itself. If it's not, the company has gotten bigger problems than laptop disappearing.

Re:Look at the way many people treat their laptops

[Corporate Troll]

Makes no difference: if it were a desktop or an LCD screen, it would be as easy to steal them.

I already mentioned cleaning staff, so I am pretty sure that in case of a theft the person responsible for cleaning the premises would be easily findable. As for both delivery service and maintenance workers. Those should come during office hours. That either means there is somebody in the office *or* nobody is there and all the laptops are on the desks. It isn't as if anyone puts away their laptops when they go for lunch.

Re:Look at the way many people treat their laptops

[pedalman]

Actually, the professor should have been the one to call in to Dell for service. Let him explain why the buttons were broken off.

Re:Look at the way many people treat their laptops

[eln]

I don't know that I would have been fired, and in truth I probably wouldn't have been, but these are the things you think about when you screw up like that on your first day on the job.

Also, you may be right that the laptop would be safer at the office then it would be at home, but I do work from home on occasion, so it makes sense for me to take it home even when I don't plan on working that night. Plus, even though we know it's not really safer, it feels safer to have these things in our possession or close at hand. And no, the laptop is not encrypted, but it also doesn't contain any company data (other than maybe the IPs of their VPN servers, but you still need a password to log on to that). I never, ever have company data on my laptops, and my browsers are set to purge their cache on exit.

Re:Look at the way many people treat their laptops

[Bodrius]

Yeah, it's amazing how people have different expectations about the vulnerability of property vs untraceable cash.

I've even seen 30K+ vehicles parked on the street for HOURS, where anyone could pick them up with some minimal effort!

Re:Look at the way many people treat their laptops

[Anonymous Coward]

ppl

I'd like to buy a vowel, please.

Re:Look at the way many people treat their laptops

[Naturalis Philosopho]

If he'd been a student he'd have been arrested for vandalizing school property.

Re:Look at the way many people treat their laptops

[Anonymous Coward]

It is required for proper sanitation for them to be locked up.

Re:Look at the way many people treat their laptops

[Corporate Troll]

You only screwed up because you didn't heed the warning. That would perhaps have been a ground for being fired, but only perhaps. As I have said in another post: do people pack up their laptops when they go to lunch? If so, do they pack them up to go to the bathroom?

The problem is twofold: a) one needs to trust the employees, if you do not, then that needs to be fixed first. b) the premises need to be locked. An external person should not be able to access the offices where people work. They're harldy going to steal the iMac from the receptionist ;-)

Re:Look at the way many people treat their laptops

[Buran]

We had a laptop stolen out of a research lab here that WAS locked down with one of those. It was a Mac (most of the laptops here are) but I don't recall if it was an Al/Ti Powerbook/Macbook Pro (metal case) or older Powerbook/Macbook (plastic case).

The thief somehow either cut the lock or ripped the lock out of the case, and got away with the laptop within five minutes.

I'm pretty sure that lab doesn't leave laptops on desks in line of sight of the door anymore.

Re:Look at the way many people treat their laptops

[Buran]

At least it's gotten a lot harder to just make a wax key impression. My car won't start up without the right chip from the right key, but of course you could still drag it onto a flatbed truck and steal it that way. Sad thing these days is that people are so jaded to screaming alarms that they don't call 911 if they see a car, alarm screaming, being hauled on a flatbed. We see crime right under our noses and we're too lazy to care.

Re:Look at the way many people treat their laptops

[TooMuchToDo]

s/lazy/desensitized

Re:Look at the way many people treat their laptops

[Anonymous Coward]

Don't they do that in Windows? I know my laptop and desktop do, in both OSs.

You can disable it somewhere (in both), I can't remember where (in either).

Re:Look at the way many people treat their laptops

[Buran]

I'm not sure what's with that weird syntax, but I really think laziness is a big part of the problem. We can't be bothered to expend any effort on anyone other than ourselves. 'it's not my car, why should I go to the effort to give a damn what someone is going to have to go through now?'

Re:Look at the way many people treat their laptops

[Anonymous Coward]

Gods know that either understanding & fixing the problem or asking someone knowledgeable would be too hard or make him look weak.

He did fix the problem in a way that was suitable to him. And he's the guy who uses the laptop and must've been happy with his cheap fix. I'm sure that in whatever field he's a professor in, he probably doesn't make fun of you for not understanding something. He probably wouldn't even make fun of your poor choice of words with "Gods know".

Yours is a problem that many people have. Once you understand something, you can't understand how someone else doesn't understand that problem. Different strokes for different folks.

Re:Look at the way many people treat their laptops

[CFTM]

Yeah I am also an "IT guy" and I routinely leave the premises with faxes, printers, brand new desktops and 30 inch LCD flat panel monitors and no one ever says a thing...granted I'm leaving to delivery these things to the Chairman's house but just adding my anecdotal experiences...

When someone appearing to a PC guy grabs equipment people don't ask questions.

Re:Look at the way many people treat their laptops

[cayenne8]

"We had a user check it with her luggage on a flight. She was shocked when it didn't come around on the conveyor belt with her suitcase. :-)"

Now while I wouldn't every check mine, due to concerns over damage/rough handling, and the fact that I like to 'play' with my laptop while flying....I'd not automatically think it would be quickly stolen as checked luggage.

I'm hoping stolen luggage is a fairly rare thing? I've had luggage lost, but, never had anything permanently taken from me.

This is a pretty sad day in age when you can't trust anyone to transport your stuff when you travel if what you seem to assume is true. When exactly did thievery become accepted as the 'norm'?

Re:Look at the way many people treat their laptops

[cayenne8]

"Since then, I always take my computer home with me, even though now I work in an extremely secure facility (Tier IV data center)."

Wow!!

I am dumbfounded...just barely into reading this thread, and I see so many people that have to worry about having laptops and other items stolen from their offices/cubes?!?!

Where do ya'll work? What part of the country? I've never really experienced this before....except once, and they caught a cleaning lady stealing some CD's and spare money left in desks. But, other than that...I guess I've always expected a place where I worked at, to be operated under an air of professionalism. Most people I know make enough money not to even consider stealing stuff from workmates. It is one thing to have security against outside thieves, but, really....it seems here people are worried about their neighbors stealing from them at work!?!?

Wow...what has happened to our world? Are people not raised to respect other people's things? Other people's lives?

I know you don't just park your car and leave the keys inside, but, you shouldn't have to worry about leaving something out on your desk when you leave the office at night. You shouldn't have to worry about co-workers stealing your stuff....

Re:Look at the way many people treat their laptops

[metlin]

Seriously though, companies will take you to court over stealing a few hundred bucks worth of equipment but if you rob the company blind with sleazy accounting, incompetence, and outright robbery as an executive you get let go with millions in severance.

Hey. Be nice to Stan O'Neal.

Re:Look at the way many people treat their laptops

[veganboyjosh]

OT maybe, but an interesting look at an "experiment" done with bikes in an attempt to address a similar problem...

The sad thing is, none of it is really all that surprising.

Re:Look at the way many people treat their laptops

[MBGMorden]

Depends on if it was school property. I also worked IT for the college I attended, and back then (circa 2000-2003), we would provide support for any student's laptop if they bought the model recommended by campus IT. We even had loaner laptops that we would allow students to use while theirs was in for repair.

Matter of fact for basic issues (mostly network connectivity) we even would visit dorm rooms and work on student owned desktops.

Re:Look at the way many people treat their laptops

[MBGMorden]

Most of the time professors rank higher in the the general scheme of things than the IT guys at a university. Piss them off by making them do things like call Dell themselves can result in bad things like loss of job :).

Re:Look at the way many people treat their laptops

[ioshhdflwuegfh]

A few years ago I was working in IT for a university. One of the professors didn't like the buttons by the touchpad because he would bump it with his palms while typing and end focus would change to some other app. So instead of disabling the touchpad, he just broke the buttons off. That was fun to explain to the Dell rep when he had some other hardware problems that needed to be replaced. Did this Dell rep by any chance wore khakis?

Re:Look at the way many people treat their laptops

[beef curtains]

He did fix the problem in a way that was suitable to him. And he's the guy who uses the laptop and must've been happy with his cheap fix.

In this scenario, it doesn't matter that his solution was "suitable to him", or that "he's the guy who uses the laptop"...the fact of the matter is that he doesn't OWN the laptop, the university does. So basically he borrowed the laptop and broke it to suit his whims. That's generally not acceptable.

If you lent your laptop to a friend, and he brought it back with buttons crudely torn out because they were getting in his way, would you commend him on his clever workaround? Likely not (unless you have very little regard for your valuable belongings).

I'm sure that in whatever field he's a professor in, he probably doesn't make fun of you for not understanding something.

It sounds like the GP understands quite clearly: this professor damaged university property. If I was a student in this professor's class, and decided one day to demolish his overhead projector because it was blocking my view of the whiteboard (assuming professors still use overhead projectors & whiteboards...if not, substitute your own analogy ;) ), would he be wrong to be upset with me? Or would his displeasure merely demonstrate his lack of understanding?

He probably wouldn't even make fun of your poor choice of words with "Gods know".

Ah, the ad hominem attack...I now feel that I might be feeding a troll. Oh well, I've typed too much to delete it all, so I soldier on....

Yours is a problem that many people have. Once you understand something, you can't understand how someone else doesn't understand that problem. Different strokes for different folks.

Once again, I fail to see the GP's "problem"...he's stating that this professor damaged university property. Are either one of us missing something? "Different strokes for different folks" is completely invalid in this situation; the professor's "strokes" violated the ownership rights (and probably the terms of use) of the "folks" who owned the laptop.

Re:Look at the way many people treat their laptops

[fm6]

What did Stalin say? "One death is a tragedy. A million deaths is a statistic." This is the financial equivalent.

Re:Look at the way many people treat their laptops

[klx]

Nah -- well, yes -- but it's not just that.

I just came home from a coffeeshop where I saw a late-model Mac sit unattended for about 15 minutes. Now, this is a nice place, and on a weekday afternoon it's full of nice Emory and Georgia Tech students, comfortable retirees and well-off work-at-home types. It's in a snooty neighborhood, a solid mile from any housing under $1200/month. (Other than my place, that is.) Also, the music's generally okay. So I can kind of see how it's easy to get a little too comfortable and mistake the place for your own living room. Does that mean you should leave anything lying around? Hell no. But people do -- and coffeeshops don't even have keycards.

Re:Look at the way many people treat their laptops

[Anonymous Coward]

>Piss them off by making them do things like call Dell themselves can result in bad things like loss of job :).

You don't have to make them call Dell themselves... schedule the call, and when the technician arrives, tell the technician you're busy, and direct him or her directly to the professor's office. Then he can explain to the technician how the keyboard got broken :)

After the Dell technician refuses to repair the computer at all under warranty because it has obviously been abused, the professor's superior position in the university's hierarchy will come in handy when he goes to his department head to ask for the money to get it repaired.

Not that I've ever done anything like that... :)

Then, step in after the fact, and get it repaired under warranty, and tell the professor "Look, I took care of it this time, but you need to be more careful with your laptop, because I won't be able to smooth it over again".

It helps to cultivate a good working relationship with the manufacturer's field service technicians, BTW :)

Re:Look at the way many people treat their laptops

[Afrosheen]

This clearly illustrates the disconnect between IT and users' needs in large organizations. The professor needed a laptop, but he also needed a USB keyboard that would allow him to type naturally. He made his own compromise without knowing that he could have requested an external keyboard for the laptop. Then again, IT probably never followed up with him after doling out the laptop to see how he was getting along with it.

I'm lucky to work in a smallish organization where it's easy to track who has what and it's simple to follow up with anyone, new or old users, to see how their new hardware is working out.

Re:Look at the way many people treat their laptops

[gallwapa]

Doesn't do this on either of my SuSE 10.3 systems. I need to find where to set it that way, because I'm sick of hitting the button then waking up in the morning to find my computer still on. All those wasted cpu idle cycles!

Re:Look at the way many people treat their laptops

[Dr. Cody]

We must keep paper towels out of the hands of terrorists. Even the janitor's closet has better security than most offices.

http://www.georgetownbookshop.com/georgetown/bathroomv.jpg

Re:Look at the way many people treat their laptops

[torkus]

Isn't that the truth. Granted, I'm the Desktop Manager at my company and still have my hands in bits and pieces of support but i could easily go to one of our large offices where people don't know me and walk out with laptops. Heck, we use the USFF Dell's ... 2 of those would easily fit in a backpack.

How about this one...walk up to a user 'Hi i'm from the desktop team. We got a report that your laptop has a very bad virus on it. I'll need to take it for about an hour to remove it or reimage. Would lunch time be good'

I'm tempted to try this next time i visit a remote site...unfortunately they pay me enough that i'd rather keep my job than prove how easy social engineering is.

Re:Look at the way many people treat their laptops

[Anonymous Coward]

She could also have a brand-new personal laptop that only cost her looking like an idiot in front of IT.

Re:Look at the way many people treat their laptops

[Anonymous Coward]

Yeah, btw, this is the Chairman. My email's down so I'm just replying to your Slashdot comment instead. I've recently moved, so please make all future deliveries to this address:

John Q. Chairman
123 Main Street
Centerville, IL 54321

Thanks!

Re:Look at the way many people treat their laptops

[glittalogik]

If I was a student in this professor's class, and decided one day to demolish his car because it was blocking my view of the whiteboard...

Fixed your analogy for you =)

Re:Look at the way many people treat their laptops

[heinousjay]

That's not exactly the truth, but I applaud you for not letting the facts get in the way of a good populist rant.

Re:Look at the way many people treat their laptops

[Aczlan]

I beg to differ... there was an article here on /. a while back about spoofing the RFID chip in a carkey and here is another example

Re:Look at the way many people treat their laptops

[icebones]

This is a pretty sad day in age when you can't trust anyone to transport your stuff when you travel

it not just the the airline/airport employees that are your concern. it's the hundred other people waiting to get their bags too. all it takes, is someone that's dishonest seeing it come by on the conveyor before you do. they pick it up and walk away w/o any consequences and your just standing there waiting.... and waiting, until you realize it's not there and it's too late, because by that time, they are already out of the building.

Re:Look at the way many people treat their laptops

[Nimey]

It would have killed the professor to complain about the buttons instead of just destroying them, of course.

I don't know if you've ever worked in IT in a large-ish environment like a university, but I have a few hundred users and don't have time to just check up on people.

Re:Look at the way many people treat their laptops

[beef curtains]

Initially I was pretty confused, but now that I get it, it's pretty funny :)

Re:Look at the way many people treat their laptops

[bingoathome]

"When exactly did thievery become accepted as the 'norm'?"
In polite society about 30 years ago I reckon. Every where else always has been. Half kidding.

Re:Look at the way many people treat their laptops

[Anonymous Coward]

... or the user was using File Vault, had good backups, a reasonable amount of cash in the bank for a replacement, and iAlert running. I hate to admit it, but I've gone to the bathroom a few times while at cafes, leaving my laptop unattended -- with iAlert running. At least if someone did try to steal it, they wouldn't get out without making a scene. The hardest thing is giving the thief a valid warning, because few expect something like iAlert to be running.

Re:Look at the way many people treat their laptops

[glittalogik]

Thanks! I'm not 100% sure, but that may actually be the first time I've ever memed on /. Glad it wasn't too obvious =)

Re:Look at the way many people treat their laptops

[Buran]

Oh, I know about that... but your average crook on the street who wants a joyride probably isn't that sophisticated.

Re:Look at the way many people treat their laptops

[Nimey]

He probably wouldn't even make fun of your poor choice of words with "Gods know". Multiple gods.

English, motherfucker. Do you speak it?

Re:Look at the way many people treat their laptops

[Anonymous Coward]

I've flown LCD monitors, Mac Mini's, laptops, and other expensive items in my suitcases on several occasions on international flights to and from nations where theft is quite high. Maybe I've just been lucky. Yet, I always expected to have problems and did secure wipes of all data and/or encryption -- just in case.

Re:Look at the way many people treat their laptops

[mosch]

No one would think of leaving $3000-$4000 in cash just laying around in the open. Sure they do. Poker players (like myself) routinely leave chips on the table when off for food, bathroom or a cigarette. In middle limit games this is often $1-5k. In high limit games, it could easily beat $20k.

People are accustomed to taking small risks with valuable property, and almost never having a negative consequence. As such, we decide to leave our laptops unattended instead of hauling them around or locking them to a desk. We decide to leave thousands of dollars in cash on the table because we want to eat some steak.

It's just human nature.

Re:Look at the way many people treat their laptops

[peacedog]

Seriously though, companies will take you to court over stealing a few hundred bucks worth of equipment but if you rob the company blind with sleazy accounting, incompetence, and outright robbery as an executive you get let go with millions in severance. I've always said... "NEVER EVER Steal $10, they will lock you down for 25 years. Steal $10 billion, then you get to enjoy the rest of your life floating on your $10 million yacht"

Re:Look at the way many people treat their laptops

[Anonymous Coward]

You're right. All of those executives from the S&L disaster wasted away in prison.

Re:Look at the way many people treat their laptops

[Yoozer]

The syntax is used in the programming language Perl to denote a replacement of a part of a string; in this case a word in a sentence. Read it as "replace 'lazy' with 'desensitized'".

Re:Look at the way many people treat their laptops

[mikael]

This link explains it all.

Indeed, my /etc/acpi/events/power.conf looks like:


# ACPID config to power down machine if powerbutton is pressed, but only if
# no gnome-power-manager is running

event=button/power.*
action=/bin/ps awwux | /bin/grep gnome-power-manager | /bin/grep -qv grep || /sbin/shutdown -h now


If your laptop had a builtin webcam, you could probably get it to take a picture when it was powered on, then E-mail the picture to somewhere.

~
~

if he was so smart

[loafula]

why did he not blow away the HDD and reload before putting the thing on the internet?

Re:if he was so smart

[$RANDOMLUSER]

...after taunting his victim from a payphone, the victim dialed *69, and Almly was arrested...

Yeah, smart.

Re:if he was so smart

[eldavojohn]

why did he not blow away the HDD and reload before putting the thing on the internet? Well, I believe he was doing that, from the article:

Later, at his $1,800-a-month apartment along Miami Beach, the burglar erased the laptops' hard drives and began selling them via services like eBay, where he had earned a 99.4 percent customer-satisfaction rating and tens of thousands of dollars in profit. And then later:

Thanks in part to the company's use of a clever antitheft device... They don't really go into details about it, but this might be something in the NIC chip or something else ingeniously specific to the hardware. They probably don't want to give out details as this was the only way to catch and stop this kind of outfit.

Re:if he was so smart

[Anonymous Coward]

They don't really go into details about it, but this might be something in the NIC chip or something else ingeniously specific to the hardware.

I doubt it. Most likely they got lazy and just cleaned XP without reinstalling leaving the rooted snitchkit to do it's thing. I guess if large access provider like T-Mobile's Hotspot had the MAC Address of a taken machine and a process to report to the right person it's presence on the network it could be traced. I also don't think MS is checking MAC addresses gathered from WGA against any criminal databases. Maybe an app on a separate, untouched partition and autorun but a simple drive wipe would've taken that out.

If you did devise a way for a MAC device to "call home" without user action then it would be easy to take the next step and turn it into a kick ass DDOS bot, something I don't think most device companies would risk.

Re:if he was so smart

[wangmaster]

The article states that outback used computrace lojack, which is software based antitheft. You connect online, it provides computrace with a bunch of info about your network connection and if you're stupid, they eventually trace you. i.e. the guy may have been good at social engineering to get the laptops, but definitely no good at the technical details.

Re:if he was so smart

[Bender0x7D1]

I believe most tracking software creates a separate partition that would survive a standard reinstall, but not a complete reformatting of the disk.

What I think would be very effective would be a laptop, created explicitly for businesses, that would implement the tracking system in hardware. If you added it to the integrated wireless networking, you wouldn't be able to shut it off, and you could track it whenever you needed to. If you are concerned about battery life, you could allow someone to shut it off, but have it wake-up every few hours just to check in. When it checks in, if it's labeled as stolen, the networking stays on, allowing for constant tracking.

There are some privacy concerns with a tracking device that can't be turned off, but that's why I said it would be explicitly for businesses, (or people who want that feature explicitly). For many businesses, the loss of privacy is less important that the ability to track their assets.

Re:if he was so smart

[CCFreak2K]

They don't really go into details about it, but this might be something in the NIC chip or something else ingeniously specific to the hardware. They probably don't want to give out details as this was the only way to catch and stop this kind of outfit.

When I got my Dell laptop in 2005, it was loaded with a little thing called Computrace. In the BIOS, it can be set either "permenantly" disabled or enabled (the default is a disable value in between); no software required. AFAIK, I needed to actually subscribe to the service for it to work, but it was there nonetheless as a kind of "computer lojack", if you will.

Re:if he was so smart

[HugePedlar]

On a slight variation, my friend's father works for a British security firm which deals with the Government. He told me I shouldn't pass this on, but I can't see the harm in sharing with a handful of slashdotters...

Anyway, they needed a way of determining where a seized laptop had travelled in the past. Many esoteric technical tracking methods were discussed, most involving network log analysis.

My friend's father suggested scraping the pollen off of the case fan.

Re:if he was so smart

[arpwatch]

Right.
We use Computrace here at work. We have x amount of licenses. The company gives us a custom build executable that latches itself into the BIOS along with setting up shop in the OS applications/programs. The only way to remove it is by using the custom executable to contact the local webserver that starts up on the machine. I guess you could reflash the BIOS as well. I haven't bothered trying to break it.
Supposedly all you have to do is "hit a button" and Computrace will take care of everything.(Contacting local and state authorities, ISPs, telling them approximate location based on IP address when computrace phones home, etc)

And yes, all the techs are itching for someone to steal one of our laptops so we can try the system out.

-arp

Re:if he was so smart

[Anonymous Coward]

AFAIK LoJack-Computrace is background/hidden application running on the currently booted OS so the question is how does it survive a MBR/drive format? As for the BIOS setting I suspect it's simply an on/off switch for the same application. Now if the entire app was in the BIOS (easy to do) and on boot quickly grabbed eth0 or wireless to "phone home" with the MAC and IP addresses maybe but I doubt that's the case. While the automobile version of LoJack works very well IMO this looks like a case similar to Ferrari selling it's name on laptops: it's pure marketing and nothing more.

Any kind of "phone home" feature that doesn't require user action to start can be easily abused. Just change the "phone home" IP address (via a buffer overflow) to dial the subject of a DDOS attack. One hit from tens of thousands of laptops each time they boot with no easy way to stop it.

Moral of the story: If someone have access to the hardware even a reboot monkey can clean out or modify any snitchware. To clean a MS Windows machine for resale it might mean a BIOS reflash, fresh copy of XP and using regedt32 to change the MAC addresses (on the OS level). Of course could your average laptop thief pull it off is another question.

Re:if he was so smart

[QuantumRiff]

just an FYI, most newer Dells (I'm assuming other brands have something similar) have the computrace software in a chip on the motherboard.. they can even format the hard drive to delete sensitive data.

Re:if he was so smart

[TooMuchToDo]

It would actually be easy to do.

1) Have BIOS boot using NIC every X boots.
2) Have NIC grab IP using DHCP (something that can be done on almost any network) and call home over HTTP (something almost never filtered).
3) If NIC calls home, and laptop is marked as stolen by HQ, wipe the hard disk and generate a support ticket for the IT department to pass along network info gathered to law enforcement.

All of this could be done in the background as well, masqueraded as an NTFS disk check. As Homer Simpson would say, "PATENT PENDING!" =)

Re:if he was so smart

[mlts]

HP and Dell laptops have the ability to have CompuTrace be permanently installed in the BIOS, where even a full reformat of the hard disks or a reflash of the BIOS will not remove it. If I were betting, I'd lay odds on this being the way Outback's IT department got their man.

Re:if he was so smart

[cayenne8]

"HP and Dell laptops have the ability to have CompuTrace be permanently installed in the BIOS, where even a full reformat of the hard disks or a reflash of the BIOS will not remove it. If I were betting, I'd lay odds on this being the way Outback's IT department got their man."

Do you have any links to this about Dell and HP computers? Is this an option or do they install it without you knowing or wanting this?!?!

Re:if he was so smart

[Anonymous Coward]

All of this could be done in the background as well, masqueraded as an NTFS disk check.

Ok, that's just plain evil. =)

Re:if he was so smart

[mlts]

There is a link to this on HP's website:

http://h20331.www2.hp.com/Hpsub/downloads/HP_Computrace_BIOS_FAQ.pdf

Its a PDF.

As for Dell:

http://www.dell.com/content/topics/global.aspx/corp/pressoffice/en/2005/2005_12_13_rr_000?c=us&l=en&s=corp

If one goes into the BIOS setup of a number of recent Dell laptop or upper end desktop, it will give you the option to permanently enable or disable Computrace's BIOS agent.

Re:if he was so smart

[uvajed_ekil]

HP and Dell laptops have the ability to have CompuTrace be permanently installed in the BIOS, where even a full reformat of the hard disks or a reflash of the BIOS will not remove it. If I were betting, I'd lay odds on this being the way Outback's IT department got their man

Note to self:

1. Steal more Lenovo, Toshiba, Sony, Apple, and Gateway laptops.

2. Avoid HP and Dell laptops.

3. Always wipe the drives before testing, and check the BIOS for oddities.

3. Profit.

Re:if he was so smart

[Anonymous Coward]

The so-called "integrated" wireless networking devices are not so integrated. They are (at least in my case it is) usually mini-PCIs that can be pulled out and replaced at will.

On the other hand, most Ethernet devices are really integrated---into the motherboard, that is.

Next time...

[Anonymous Coward]

from the article

"Larry Brass, the Tampa Police detective who arrested Eric Almly this spring, says he's not permitted to endorse a particular product. But he says if Outback's laptops were not outfitted with software called Computrace LoJack for Laptops, made by Absolute Software, there is "no question" Almly would be walking free today."

He will learn a valuable lesson out of this once he's out of jail: Wipe the laptop BEFORE connecting it to a network connection...

Re:Next time...

[Anonymous Coward]

>He will learn a valuable lesson out of this once he's out of jail:
>Wipe the laptop BEFORE connecting it to a network connection...

If the laptop has Computrace / Lojack for Laptops this won't work. Once you 'wipe' it the software re-installs itself from the BIOS. It will even survive a hard-drive swap. The only way to disable it is to install Linux, which most theives dont' do.

$150 a laptop?

[andy.ruddock]

From the article "Over the years he'd pocketed at least $20,000", which comes to a mere $153.85.
No wonder eBay shoppers were happy with the deals they got.

Re:$150 a laptop?

[Funkcikle]

Oh dear. Who will lead the OLPC initiative now that Nicholas Negroponte is in jail?

Re:$150 a laptop?

[omfglearntoplay]

This is a good example of that old saying from that old movie about old thieves. If you want to be a thief, do it once, do it big, and retire. Making 20 grand from 100+ minor stealizations is pure dumb (as is buying lottery tickets). I guess this also illustrates the fact that most criminals have low IQ. Good ole lead gasoline. ;)

Re:$150 a laptop?

[mrslacker]

Almost as dumb as "stealizations". Is that a friend of colorization?

Re:$150 a laptop?

[Artifakt]

I like it: "Stealization". Let's spredulate this meme.

Re:$150 a laptop?

[mrslacker]

memeization?

Re:$150 a laptop?

[Alzheimers]

It's a perfectly cromulent word.

Re:$150 a laptop?

[idontgno]

Hey, it embiggens the English languafaction. Give it a chance.

Laptops are easy

[necro81]

For the bold and motivated thief, walking in and then out with a laptop is easy. Just look like you are supposed to be there. Slipping it into a briefcase helps with the illusion.

On the other hand, someone waltzed off with a 24" LCD monitor from the desk of a co-worker not long ago. His office was the furthest in from the door, so someone needed to be particularly bold to go all the way in, disconnect the monitor, and walk back out. No one saw him either, which is impressive considering the size of the load he was carrying. It's a lot harder to look and act natural about carrying a large monitor than a laptop.

Re:Laptops are easy

[crafton]

are you sure it wasn't the co-worker that stole it?

Re:Laptops are easy

[oyenstikker]

Walk in, slap a big yellow sticker on it that says "Repair Ticket" in big letters, and carry it out.

Re:Laptops are easy

[Anonymous Coward]

Exactly. A lot of computer thefts are inside jobs. Of course, many employers don't want to hear about it when you mention that you have strong reason to believe that "Joe" may have taken that missing piece of equipment. This despite "Joe's" own allusions to having taken it.

Re:Laptops are easy

[Bee1zebub]

That has been reported in England with roofing slates. The thief simply drives up with a van painted as a roofing contractor, sets up a ladder and some scaffolding, and removes the tiles (this was some years ago, when health and safety regulations were less strict). When a home owner caught them, they simply presented fake documents for the house net door, put up a tarpaulin, and drove off.

People have also stolen the granite setts of of public roads with a digger, lorry, and a few cones.

Re:Laptops are easy

[Paradigm_Complex]

I've had to move in and out of various dorms on campus where I go to school at odd times throughout the year, and never once has anyone questionsed the 24" Monitor or ATX box I carried out. I helped friends carry large TVs in or out of their doors before/after videogame tournmanets I'd set up. No one even gave a second look. If one could just access the equipment without the origional owner knowning it'd be trivial to walk out of the dorm and throw it in the back of a car. Now add the fact that many RA's encourage students to post their schedual in a public area to help people from the same classes in the dorm to study together. I'm shocked at how rarely electronics are stolen, where as bikes on campus (which are chained up) go missing more often then not.

Re:Laptops are easy

[skiingyac]

At business park where the startup I used to work at was located, there was a guy going around swiping all kinds of stuff using the "look like you belong" tactic. He walked into our place in a fancy suit talking on a cell phone by following an employee thru the door. A few of us, not knowing about the other thefts but standing there in shorts & t-shirts, looked at each other like "who the heck is this guy?". A few of the biggest/scariest guys in the office helped him to the door after he mumbled something about being there to see some generic person and headed toward the sys admin corner of the office...

Too bad the owners never let anyone important enough to be wearing a suit anywhere NEAR there, and if someone important was coming we had a pre-announced "business casual day" just in case they wanted a quick tour. I think the only reason he wasn't tackled to the ground on the spot is because nobody knew about the other thefts at the time.

Re:Laptops are easy

[eth1]

Just use a wheeled cart like a deskside support guy might... throw some mice & keyboards on it, a few cables, and you can get away with walking off with all sorts of things

Re:Laptops are easy

[LrdDimwit]

Somebody stole the railing off a bridge that way (!). They set up traffic cones, acted like construction workers, and took down the whole railing across the entire length of the bridge (only on one side, I think). And they actually closed a lane of traffic! A hundred people easy must have seen them. Nobody called it in. Everybody assumed they were supposed to be there. The city (I tried to look it up, failed) said they'd have to close the whole bridge, since it was an unacceptable risk of loss of life.

Re:Laptops are easy

[fm6]

I assume people with valuables in their rooms tend to lock up? And the doors are solid enough to require significant effort to break down? The sound of splintering wood tends to attract attention. Though if I lived in a dorm, I'd still lock everything down with those security cables.

And bicycle thefts are probably more profitable than stealing electronics. High end bikes are worth thousands, and the typical laptop is only worth a few hundred.

A long time ago, I read an article about bicycle thefts at UC Berkeley. The campus cops recommended using heavy-duty locks, the kind you can't break without a huge bolt cutter, the kind that are impossible to conceal. So the reporters got one of those cutters, carried it openly onto campus, and pretended to cut the locks on several bikes in busy areas. Nobody paid any attention!

Thieves aren't that smart...

[Tastecicles]

...I work in a shop on occasion, and the number of stolen laptops that come through with people trying to sell them to us is simply mind-boggling. I'm not talking about pissy little Pentiums, either, these are the latest, greatest in portable number crunching. Some have passwords on them as their only real identifying feature (the serial numbers and Microsoft licenses are usually scratched off), which I tell the seller is not possible to circumvent (in some cases they're not, being on the BIOS rather than the OS). Other tricks they have is coming in claiming they've lost or wrecked the power adapter (how convenient) and need a cheapo universal one. Sure, I'll sell them the universal brick but they're not testing the thing in the store.

Net bugs are a good thing to have, I think (got one on here), particularly given the plentiful supply of open wireless points in most large cities now. Turn on machine, bug sends data burst, thief is cornered. Hell, he doesn't even need to physically connect to a network these days.

Re:Thieves aren't that smart...

[deftcoder]

Other people who aren't smart: those who don't realize it's possible to bypass "BIOS passwords".

Re:Thieves aren't that smart...

[Anonymous Coward]

Not for nothing, but BIOS passwords are usually really easy to circumvent, often requiring nothing more complex than popping out the CMOS battery for a second. I can understand you telling different to a probable thief, but you should know better.

Re:Thieves aren't that smart...

[TheRealBurKaZoiD]

So, the little device that caught this guy, the one that phoned home, is that strictly a standalone hardware device living inside the laptop with it's own embedded programming, or was this some software that phoned home the first time it booted up and found a network connection? I'm sure it's probably the former, but I didn't see it indicated anywhere in the article, and I'm afraid I don't have any experience with those types of laptop features.

Re:Thieves aren't that smart...

[tomz16]

Net bugs are a good thing to have, I think (got one on here), particularly given the plentiful supply of open wireless points in most large cities now. Turn on machine, bug sends data burst, thief is cornered. Hell, he doesn't even need to physically connect to a network these days. Haven't really thought this through, have you? Where do you send the police?

Re:Thieves aren't that smart...

[Calinous]

CMOS battery on a laptop? I haven't seen one (but on the other side, I haven't opened a laptop until all his internals were visible)

Re:Thieves aren't that smart...

[dintech]

It's a bit unfair to see he's not smart. It's just a piece of knowledge you have that he doesn't. And yes, I know knowledge is power...

Re:Thieves aren't that smart...

[d3ac0n]

Actually, it is indicated in the article, the second one linked.

Larry Brass, the Tampa Police detective who arrested Eric Almly this spring, says he's not permitted to endorse a particular product. But he says if Outback's laptops were not outfitted with software called Computrace LoJack for Laptops, made by Absolute Software, there is "no question" Almly would be walking free today.

So it's just some software. Which shows how incredibly stupid a thief he was. He wasn't even willing (or able) to formate the laptop with a fresh OS install. Basically he was just doing a data cleanup and software update, and then selling them as-is. No wonder the dumbass got caught. Ugh.

Frankly, the only reason he got away with it for as long as he did is due to the complete lack of any physical security that corporate types exercise with their laptops. And I would imagine that the lack of security will continue, until a major theft happens that ends up in the exposing of critical corporate data which brings down a company. Corporations ONLY change policy when they have to due to law, or they are scared into it. This story isn't big enough, but I'm guessing that there will be another one, and soon.

Re:Thieves aren't that smart...

[Anonymous Coward]

Many laptops put the BIOS password on the harddrive via a special ATA command. Depending on the methode choosen these can not be bypassed short of replacing the harddrive or using an expensive cracking tool.

Re:Thieves aren't that smart...

[Vindicator9000]

On the Thinkpad T43 I opened yesterday, it's right under the palm rest. You can get to it by removing about 8 easily accessible screws. I'd imagine most laptops have one.

Re:Thieves aren't that smart...

[Anonymous Coward]

>Other people who aren't smart: those who don't realize it's possible to bypass "BIOS passwords".

Not always - try it on any ThinkPad since the T40 series, for example.

Re:Thieves aren't that smart...

[Kamineko]

To the IP address, of course!

Re:Thieves aren't that smart...

[antifoidulus]

Is the real money nowadays even in just pawning the computer as quick as you can? I would guess that nowadays, esp. in the corporate world, the data is often worth more than the device itself. I'm surprised more enterprising thieves haven't either held the data ransom or sold it to someone else. But then again, as you point out, thieves aren't necessarily the brightest bulbs in the box....

Re:Thieves aren't that smart...

[TheLink]

Well look at it this way, he's stupid because that's a stupid way to make money.

Seems he didn't make very much per laptop. How long does it take to reformat and reinstall the different types of laptops he steals AND be sure the snitchware is really gone?

AFAIK if you're trying to install a vanilla Windows XP on some of these laptops it's a pain - drivers etc. Heck installing XP from scratch is a bigger pain than installing Linux. Most people don't know that since Windows usually comes preinstalled.

Where are you going to get the license key from? If you use the original "hidden/rescue partition" to reinstall, the snitchware might be bundled and slipstreamed into the final OS.

Reselling laptops with Ubuntu on them probably cuts into profits too and it still takes time to install Ubuntu on them.

He could have just sold the ram and parts from the notebooks he steals. Or got a proper job instead, work his way to the top and legally steal money big time ;).

Lastly, you can often report your computer as stolen to the manufacturer and they can help cause problems for the final user when they call up for support. It doesn't necessarily mean you'll get it back easily though - there's all that legal stuff that the manufacturer may not want to get involved with.

Re:Thieves aren't that smart...

[G Fab]

at least on that thinkpad, the password is stored on a special security chip. Removing the clock battery would not clear. You can use the ship to manage encrypting the hdd and for power on password.

There is almost certainly an override password, and you can replace this chip. I think that's all you can do.

Re:Thieves aren't that smart...

[d3ac0n]

AFAIK if you're trying to install a vanilla Windows XP on some of these laptops it's a pain - drivers etc. Heck installing XP from scratch is a bigger pain than installing Linux. Most people don't know that since Windows usually comes preinstalled.

Well, not that I want to help out any thieves, but it's not really THAT hard. Keep in mind that many of the large corporations (the kinds he was stealing from) use a standardized image whenever possible on their machines. Usually (if using XP) utilizing a corporate XP key. Since he has several PC's already, all he needs is:

1) A Pirated copy of a Corporate Version XPSP2 install CD. (easy to get)
2) A copy of Magic Jellybean Keyfinder on a USB stick to pull the corporate key off the laptop BEFORE hooking it to an Internet connection. (easy to get)
3) Drivers and software for various laptop types downloaded from the laptop company websites (easy to get)
4) An external laptop HD case, for pulling laptop HD's and FULLY wiping them (using a secure-erase utility on a lab-PC) (easy to get)
5) A little time and care.

Ultimately, the total cost for this setup is no more than the cost of a Lab PC, the external drive case and a set of small drivers for pulling the laptop drives. If you want to really go hog-wild, you could setup a Ghosting station too, but that's not really necessary.

Now, if the system uses one of the Hardware-based Lojack setups, you're pretty much screwed, just part out the laptop and junk what you can't sell. But for any software system, it's cheap and easy to bypass for anyone with even the tiniest bit of IT know-how.

However, I do agree, just going and getting a real job is a MUCH better way of going about making an income. Less of an adrenaline jolt, perhaps, but much more reliable.

Re:Thieves aren't that smart...

[Ours]

They are smart. Image the complexity of ransom. How do you get paid without getting traced? Who do you contact (1800-OUTBACKRAMSON)? How do you know what's important and what's not?
It's probably safer to steal bigger volume for a small profit. People watch too much TV.

Re:Thieves aren't that smart...

[Anonymous Coward]

>He wasn't even willing (or able) to formate the laptop with a fresh OS install

Even if he was, this wouldn't have worked. Lojack for Laptops lives in the BIOS, so if he reformatted and re-installed windows (or swapped out the hard disk), the application would have reinstalled itself and called home. Presto, one caught theif.

Re:Thieves aren't that smart...

[Anonymous Coward]

Since you've never opened up a laptop I guess that explains why you've never seen the battery.

Re:Thieves aren't that smart...

[Hoi Polloi]

He also has no qualms about breaking social rules we take for granted. We assume everyone in our nice, cozy workspace is friendly and professional and that everyone we meet in business attire must be ok. He just took advantage of that trust and those assumptions people make. It wasn't just smarts he had but a lack of shame and empathy for others.

Re:Thieves aren't that smart...

[idontgno]

It wasn't just smarts he had but a lack of shame and empathy for others.

There's a phrase that's rattled around in my (mostly empty) head. It was used in some piece of literature I read a mammal's age ago, describing the nature of such a person. In lieu of, or in addition to, what we've been calling "smarts".

That phrase seemed to perfectly capture the essence of such a person.

"Low animal cunning."

I like it.

Re:Thieves aren't that smart...

[Anonymous Coward]

A password on the BIOS is a show stopper...where do you work again?

Re:Thieves aren't that smart...

[mgblst]

The majority of this are drug addicts. They don't have the time to wait, nor the intelligence to recognise sensitive data (to be fair, that can be very difficult), nor the want to be put up on very serious charges.

Re:Thieves aren't that smart...

[TheLink]

"5) A little time and care."

How much time actually? AFAIK he wasn't making that much per notebook.

fence price / total "work time" (stealing, reinstalling, selling) = ?

Sweet Christ

[Anonymous Coward]

Ultimately it was the corporate headquarters of Outback Steakhouse who caught the thief with a bugged laptop that notified them when he re-connected it to the internet."

Do I really need to write up a how-to for would-be criminals?

Virtualize the hard drive!
Remove networking from the VM.
Look for whatever goodies you're looking for on the HD.
Blow away the HD
Profit!

To quote discworld...

[Tacobowl8]

"If the theives guild invested in blue overalls with Al on them, they could get away with anything." Social engineering IS one of the easiest to exploit security holes. It isn't much of a surpise that laptops were stolen using this technique.

Khaki Bandit...?

[Anonymous Coward]

seems like UPS means "Unidentified PC Stealer" as well as United Postal Service.

absolute crap

[RMH101]

...this is categorically NOT possible on any significant number of laptops manufactured in the last 10 years. Modern BIOS passwords are secure enough to effectively brick any device where the password is lost, without significant expertise or specialist kit to bypass. Ric

Re:absolute crap

[Anonymous Coward]

Modern BIOS passwords are secure enough to effectively brick any device where the password is lost, without significant expertise or specialist kit to bypass.

Open computer, flip the jumper to the clear CMOS setting, put the jumper back, wipe and load your OS.

Re:absolute crap

[Ravenscall]

Actually, if you open up the laptop, there is still a reset button, not to mention a factory override password.

Re:absolute crap

[Anonymous Coward]

I've got a tablet here that has no jumper to flip. Pull the battery isn't going to work either. You HAVE to call into the manufacturer to get a special code to type in or you have a brick and that's it.

Re:absolute crap

[Anonymous Coward]

without significant expertise or precision screwdriver kit to bypass.

I fixed your post for you. Even on the latest laptops, there is a button cell used for the BIOS password as well as the clock. HTH!

Re:absolute crap

[Anonymous Coward]

Brick the device? Oh please. A Dell laptop I once serviced had this aforementioned "modern BIOS password" security feature. I couldn't enter the laptop's setup utility because of it. There was no battery on the motherboard to remove and I read on many forums that the only solution was to call Dell support and ask them for a "master code" to unlock the laptop. A quick check on Google brought up the BIOS password remover utility. -1 for Dell security. It could even null the asset tag and serial numbers and replace them with my own. The only problem with this procedure: my BIOS settings had to go back to default. Considering that I can only change the time and boot priority of devices, this wasn't a big deal to begin with (not like I have to write down the block, sector and cylinders of the hard drive, and whether it's in LBA mode or not).

Finding online videos on metacafe.com telling me how to bypass finger print security modules found on the latest laptops isn't that promising either. Best laptop security: keep the damn thing with you AT ALL TIMES. Never leave it in the car, even if you're running in and out of someplace for two minutes. It takes a thief five seconds to smash your car windows, grab the bag with your laptop and drive off in his car. I've witnessed it and it's horrifying.

Re:absolute crap

[Anonymous Coward]

care to back that up with a model number? or maybe mr fancy pants is afraid to get proven wrong?

Re:absolute crap

[antifoidulus]

Or you could set your wallpaper to the goatse man, get a custom goatse case mod, goatse keyboard...Nobody will want to touch that laptop!

Re:absolute crap

[RMH101]

for older (think CPa era), sure. For modern ones, no. BIOS p/w held in EEPROM, so not affected by removing any battery backup. Needs a replacement bios chip, which is not trivial. It's possible, and I have done it back in field tech days, but many laptops would require a good surface soldering kit to do this.

I repeat IT IS NOT EASY TO REMOVE BIOS PASSWORDS ON MODERN LAPTOPS.

check sunnyvale

[pak9rabid]

This sounds like something Ricky and Julian, er, I mean Cory and Trevor would pull

Re:check sunnyvale

[HalifaxRage]

No, they would just steal the power cables and try to sell them back to the owners.

Re:check sunnyvale

[Anonymous Coward]

Come on, you know those guys don't do theft over $1000.

Re:check sunnyvale

[mmxsaro]

Ricky: "Jeff or Paul or something sent us."
Manager: "Wait, you spoke with Jeff? Jeff sent you? From head office?"
Ricky: "Yeah, you guys will be getting new furniture in ten minutes."

Re:check sunnyvale

[pak9rabid]

Ricky: "I'm gonna need that table.."

No genius

[homey of my owney]

Admittedly no genius. But what about the state of our corporate security, when it takes a mega corporation like Outback to catch a idiot, and the meager FedEx et al just write it off.

Outback Steakhouse

[Anonymous Coward]

"No rules.* Just right."

* Except "Don't steal our laptops, mate."

Wrong P

[stomv]

United Parcel Service.

No, not so smart....

[mmullings]

FTA: "outfitted with software called Computrace LoJack for Laptops, made by Absolute Software"
It really is just a piece of software running in the background.
I was hoping it would be some sort of BIOS level code, but it looks like a system wipe would do the trick.

Re:No, not so smart....

[Anonymous Coward]

>I was hoping it would be some sort of BIOS level code,
>but it looks like a system wipe would do the trick.

Nope, a system wipe doesn't work. The app lives in the BIOS, so if he reformatted and re-installed windows (or swapped out the hard disk), the Computrace application would have reinstalled itself and called home. Presto, one caught theif.

Re:No, not so smart....

[Anonymous Coward]

>Nope, a system wipe doesn't work. The app lives in the BIOS, so if he reformatted and re-installed windows (or swapped out the hard disk), the Computrace application would have reinstalled itself and called home. Presto, one caught theif.

Simple: Re-install the original BIOS from the laptop manufacturer. Most provide them in downloadable ISO format, which results in a bootable CD. Pull the HD, wipe on another computer, to be safe.

Make the BIOS CD, boot from it, flash the BIOS, reboot. Put the original HD back into it, and install whatever OS you wish.

ThinkPads would be especially easy to "remanufacture" this way: Obtain a recovery CD set for the model(s) in question, and restore it to its condition from the factory... and the OS license is even legal, as they all come with an OEM OS license. Of course, you'd need one non-stolen laptop to provide the serial number in order to purchase a set... or know an IBM-certified tech... or just have access to the recovery set(s) long enough to make copies...

Install a current copy of Lenovo's System Update, let it download all the current drivers/software, reboot and you're done: One clean ThinkPad, with a legal OS install, patched to current, to boot.

You can change the motherboard serial number, too, if you have the software. Remove the serial number sticker from the motherboard, remove it from the bottom of the case. Reprogram the MAC addresses for the Ethernet and WiFi adapters... then the only remaining identifying information would be anything else that has a serial number and could potentially be tracked back to it, the hard drive comes to mind, as does the CD/DVD-ROM drive.

All of the preceding is just an intellectual exercise, BTW.

Not limited to technology

[hellfire]

Obviously laptops and similar technology are the most desirable things to snatch in the workplace, but this is by far a new story, and old fashion thieves still steal old fashioned things.

We had a thief walk in one day and snatch a purse right off a desk 3 feet from me. I wasn't at my desk at the time. The thief walked right out the front door and even nodded to the receptionist, who noticed him as unusual and didn't recognize him but didn't see the purse. She did remember it was a man and that's about it.

She quickly cancelled her cards and got a replacement cell phone and the thief fortunately only got away with a few bucks in cash. Since then I never leave my desk without my cell phone or my wallet (which I used to leave in my coat in the winter).

We all want to be trusting of everyone around us, because it makes us feel good, and we don't know absolutely everyone, even in a business of 300 people. We implemented security since this and other incidents around the building. The company's been around since the 1960s and it's the first time we felt we needed security.

Re:Not limited to technology

[Hoi Polloi]

I knew a woman who was a researcher at MIT in a biochem lab. Before MIT refurbished its biochem labs they were wide open. Anyone could walk into almost any room. Grad students were notorious for being lax about security. The local bums and thieves also knew this and would wander in and steal student's purses, wallets, laptops, etc. One day she came in and found that someone had rifled through a fridge full of bacteria in liquid media. Good thing for them they didn't think it was free Hi-C and guzzle it down or they would've spent the next week or so clutching thier stomachs on the toilet. If they'd played with the enzymes for running the electrophoresis gels they wouldn't have lasted much longer.

ID cards...

[Veetox]

...are really not enough for security. I work at a building that I need keycard access to, but cards eventually become worn and some break so that they cannot be displayed anymore, and the company won't pay for a new one every time that happens. So there are two results: People don't wear them explicitly, and people don't question who they are letting into the front door behind them. I'm personally in favor of having a guard stationed at a single entry, at least for larger buildings; someone who can recognize people's faces and can be held responsible for stopping people he doesn't know. ...There's the danger of him being an asshole, but I'd be willing to take that chance.

Re:ID cards...

[itsdapead]

There's the danger of him being an asshole

...there's also the danger of the guy he doesn't recognize and challenges being an asshole that goes to the same golf club at the CEO. It only takes a few SIPs* to throw a hissy fit after being rightly denied entry and the security staff, unless adequately defended by the management, will stop bothering and/or just hassle anybody that doesn't look like a big shot.

(* Self-Important-Persons)

Re:ID cards...

[jellomizer]

There is the case where there are a thrid party person to fix whatever... There have been cases where I was to fix a printer and I realized that I needed to bring it to the office for more diagonostics (aka I don't know what is wrong and have the experts take a look at it) So I tell the manager and walk out with the printer and no one stops to ask me or checks with managers I just walk right our without having an ID Card Becase I just sign the guest list going in. And the security guard asks me if I know where I am going (if I do) I go yes and walk straight there, and out with a $3,000 printer... The problem is people don't want to be jerks all the time and they feel better if they help people out.

Re:ID cards...

[un1xl0ser]

The problem here may be the technology (if the card wear or failure rate is very high). In the end your company just has to suck up the costs and deal with it. The idea of having someone who recognizes everyone doesn't scale, doesn't work when you have many entrances and doesn't work well when you terminate someone.

Re:ID cards...

[Isaac-Lew]

Why not simply charge the employee for a replacement card?

Re:ID cards...

[Anonymous Coward]

I used to work for a defense lab and had to take a laptop home for a business trip. I didn't realize I needed to sign it out and just walked out the door with it. In retrospect I could've pulled an Aldrich Ames and walked out with lots of classified goodies (not that I did of course). Even DOD labs have to ultimately rely on trust.

Re:ID cards...

[JimBobJoe]

Indeed. ID cards are a terrible solution--but one pushed hard by ID card vendors and adopted by quite a lot of businesses.

In a lot of instances, you'd be better off not having any type of security at all. Instead, your security would come from the micro level, by having all your employees well aware that anyone can walk into the building at any time and you must be vigilant at all times.

If you decide you must have entrance vetting, I believe that issuing a non-photo ID card and having a security guard is best. In lieu of the photograph, use descriptors (height, weight, eye color.) It forces the guard to study the card and the person thoroughly before letting them through, which is awesome, but it does have the down side that it's slow.

Re:ID cards...

[plover]

The fix to that is to gain the support of security initiatives from the CEO himself. It may take a pair of big brass ones to ask the CEO to wear a cheap plastic tethered ID card, but if he has any brains at all he'll understand why it's required of him. When the CEO himself has to badge in, the guards know they have the right to stop absolutely everyone who doesn't.

And the principle of "Monkey See, Monkey Do" ensures all the sycophants will fall in line quickly.

Bugged Laptops?

[scorpiowulf]

http://www.wulfram.com?mkid=31257 - Sounds like this is going to start a wave of corporations bugging their laptops to ensure employees don't steal them and reconnect to the net! What fool didn't format the bloody thing anyway?

Re:Bugged Laptops?

[Anonymous Coward]

I don't get the relevance of the link. Bernie's bugging his laptops?

-An ex-Bolt

LoJack for laptops

[Fezmid]

The article says it's Computrace's LoJack for Laptops. We looked into the corporate version awhile ago due to the remote-wipe feature.

If the laptop has the proper version of TPM, it will even automatically re-install itself if the thief reinstalls Windows. Not sure if that's a good thing or a bad thing, having the BIOS infecting the machine... If it's stolen though, it's a good thing.

Re:LoJack for laptops

[AeroIllini]

Why would you pay for a program like that? Couldn't IT just hack up a perl script that pings a company server with a bunch of relevant data (traceroute, dns lookup results, whois data, whatever)? The script would run on network start and the server just logs the info somewhere until you grep for the stolen laptop id. Make it part of the standard company disk images.

Seems pretty simple to me.

Re:LoJack for laptops

[Fezmid]

You really think you'll be able to convince the police to get the stolen laptop for you by providing some logs that they don't understand? I think a big part of the money you're paying is for their relationship with law enforcement and judges (for warrants).

Plus, the commercial version (with data wipes) allows you to blow away the entire harddrive, even if the bad guy installs a new copy of Windows on it. The code from the TPM chip installs the software back onto the OS automatically, it phones home, sees it's still stolen, and formats the drive. In essence, it gives the thieves a brick that they can't do anything with unless they install Linux/*BSD.

Not really news

[Opportunist]

I was working in a high security environment. You know, the whole thing with magnetic cards, guards sitting there and watching people going in and out of the building, timestamps everywhere, in short, the company knew down to a second where you've been all day.

Or rather, where your key card has been.

You guess what happened? Exactly. One of those cards was stolen, one of the high level IT cards to boot, and the thief just waltzed in and went out with 2 servers. Nobody bothered to ask him what he's doing there. He has access to highly sensitive areas, so why bother asking why he's hauling around servers. That's his job, you know?

When nobody is supposed to do something, nobody expects anything's wrong when someone does what isn't supposed to be done. Especially in a high rotation hire and fire environment. Do you think anyone would question it when you put on a uniform and a trainee button and just go behind the counter of some fast food restaurant? Just tell everyone you're the new guy and avoid the manager.

It works.

Re:Not really news

[everphilski]

I was working in a high security environment. You know, the whole thing with magnetic cards, guards sitting there and watching people going in and out of the building, timestamps everywhere, in short, the company knew down to a second where you've been all day.

A couple of things:
1) add a photo.
2) add name, company affiliation and division.
2) add personal information on the flipside. My badge has my height / eye color / hair color.
(Back when I worked for the Army, it also had things like the contract I was on, weight, etc.)
This requires either (a) modification of the card or (b) the thief to pick off someone very similar, and dress the part. Not to mention rote memorization. When I enter and leave where I work, I don't just have to wave the RFID over the door, there is a guard who physically inspects my badge, seeing if I look like the guy and match the description on the back.

That, IMO, is about as good as you can get, short of a DNA sample every time you come to work. You need to be able to match a keycard to a person, you need multiple facets to make a unique match.

Re:Not really news

[Opportunist]

1) Only helps if someone actually cares to look at said picture.
2) Only helps the thief knowing where to go and what security level he has.
2 (the other 2) See 1.

I agree with you that some physical inspection by a person is the ONLY way this can be avoided. But try to convince a suit that they should hire new people for something a machine can do. Well, the machine can't, but it's good enough for standard situations.

What suits don't seem to get is that security ONLY deals with non-standard situations. As long as it's just a standard situation, you don't need security at all. But don't say it too loudly, or they just hear that they could cut costs by eliminating security altogether.

Re:Not really news

[everphilski]

Only helps the thief knowing where to go and what security level he has.

Not really, in my case anyways, I'm a contractor so I work in a mixed facility with a bunch of other companies on several projects. It's easy for a guard to flip over the badge and interrogate you. Knowing the contract and company name will not help you find my desk :) In a smaller company setting, which I guess you were percieving, you would have more limited data. to work with, but there is still data to be had. Title, tenure, etc.

I agree with you that some physical inspection by a person is the ONLY way this can be avoided. But try to convince a suit that they should hire new people for something a machine can do. Well, the machine can't, but it's good enough for standard situations.

Part of it is skewed, I guess, because I work on a military arsenal. Every car gets stopped with guys with guns, and everyone in the car hands over a badge to the guy with the gun. No badge, you turn around, and yes, they carefully inspect the badge.

I can see a small business having problems coughing up money for physical security, and large businesses trying to preserve the bottom line, but if you think about it, if your IP is truly valuable to you then spending some money on physical security is a requisite. Some people just have to learn the hard way.

Re:Not really news

[xyankee]

What kind of a high security environment was this? I work for a DoD contractor in a high security environment and all of access points must have at least two security measures, so there's keycards + PIN numbers for the mag locks (this is just a regular building, not a SKIF). The idea of just a key card as a security measure is dumb for obvious reasons. Tie it to a PIN and the keycard alone is useless.

Re:Not really news

[Opportunist]

You know, I know, but the reading thingies that also accept PIN would've costed more. Go figure.

Re:Not really news

[HeadlessNotAHorseman]

The problem with this is, who bothers to check the cards? A place where I used to work had a policy requiring all employees to have their id card (with photo) on visible display, above waist height at all times. Of course, people would do this for a while, then just go back to sticking the cards in their pockets or on their belts where they can't be seen etc. Management tried to get the security guards to enforce it, but then they got all drunk on power and upset a few people by being too vigorous.

Technological solutions are easy. Finding the right balance between being suspicious of everyone (which is bad for morale) and being welcoming to everyone (which has the risk of "baddies" like Almly coming in) is the first challenge, and getting people to meaningfully follow any security policies that are implemented is the second, even harder one.

Of course, we can solve the security issue for government organisations very easily: all we have to do is sack everybody and then seal the buildings against all human entry. With no people, there will be no security issues, and I predict that very few people will notice the difference in output!

And here's how he was caught:

[farker haiku]

I couldn't find the post asking how the guy was caught (i.e. what software), but here you go.
FTA:
Larry Brass, the Tampa Police detective who arrested Eric Almly this spring, says he's not permitted to endorse a particular product. But he says if Outback's laptops were not outfitted with software called Computrace LoJack for Laptops, made by Absolute Software, there is "no question" Almly would be walking free today.

Here is how it works: after a computer is stolen, the victim notifies Absolute's recovery team. When the thief accesses the Internet via that computer, the Computrace software on his computer silently broadcasts information that allows the team to determine his physical location.

With a street address in hand, police can make an arrest. The corporate version of the software gives subscribers the ability to remotely delete sensitive information from a computer.

Re:And here's how he was caught:

[Anne_Nonymous]

>> how the guy was caught

It was an Outback Steak-Out.

Re:And here's how he was caught:

[Isaac-Lew]

Will this work if the thief wipes the drive & re-installs the OS? On my new laptop, I did notice a BIOS setting for some type of tracking system (which I enabled - I'm sure the powers-that-be would have other means of tracking me if they really wanted).

Re:And here's how he was caught:

[madigan82]

We have Computrace installed on over 5,000 laptops in the field. It is installed in the BIOS so a simple format won't get rid of it. In fact, if they format it, the BIOS agent actually reinstalls the OS agent. One thing they don't mention is that you need to file a police report on the stolen laptop first before you can track it. But it works nice. We've had several that were "stolen" to wind up at the user's house or a friend's house. Not sure if any were actually ever stolen though since I don't handle that stuff.

Re:And here's how he was caught:

[jollyreaper]

With a street address in hand, police can make an arrest. The corporate version of the software gives subscribers the ability to remotely delete sensitive information from a computer. Laptops are only worth a few thousand bucks, a reputation is priceless. I say put Sony batteries in the fuckers. Once you have the thief pegged, send a remote command to detonate. Nobody but nobody is going to steal from you after you blow up a thief. And if you've got a webcam built into the thing, put his final moments on youtube.

Re:And here's how he was caught:

[Jaysyn]

Any O/S?

Re:And here's how he was caught:

[madigan82]

We're a Windows shop so I can't say yes or no to that. I highly doubt they would steal a laptop to but a free OS like Ubuntu on it. This is a theif afterall. If they stole hardware, just as likely to have stolen software.

Ebay enables this

[Jeff1946]

As the article says Ebay doesn't require listing laptops' serial #s. I would want to know the serial # of a laptop as a buyer to be sure it wasn't stolen.

Re:Ebay enables this

[PTBarnum]

How would you as an individual know that the serial # was clean? Are there websites that maintain lists of stolen laptops?

Re:Ebay enables this

[crossmr]

or what would prevent a shady seller from using a pool of "clean" serial numbers for all their laptops. What buyer is really going to complain if the item shows up working and as described but the serial number doesn't match?

Computrace

[Anonymous Coward]

From what I've heard, the piece of software in question (Computrace) works by installing itself to the Windows partition (so it will auto-reinstall when Windows is wiped and reinstalled). Of course, it will not work if the thief simply installs Linux.

Ahh... the power of money

[sootman]

Ultimately it was the corporate headquarters of Outback Steakhouse who caught the thief with a bugged laptop that notified them when he re-connected it to the internet.

Which is funny as hell, because I've read several times on Slashdot (sorry, no time to search) about people who have their laptops set to do just that, but when they inform the police that their laptop is in use by a customer of this ISP with that IP address, they're told to go pound sand, that the police don't have time to go catch criminals that you can lead them to. It's trivial--especially with MacBooks--to have it send you not only the IP address but a picture of the theif if you want--but it seems to do no good.

Maybe the thing to do would be to get laptop insurance and then have the info emailed to the insurance company.

Re:Ahh... the power of money

[anticypher]

Which goes to show the difference in professionalism between an individual with l33t hacking skills and a corporation that does bugging/tracking as a business model.

The tracking companies hire ex-police detectives to speak "cop" when asking for an investigation to be opened with a police force. They are experienced in providing testimony before a court, filing paperwork, and saying the right thing to the right person to start a case. You, and all of slashdot, really, REALLY, want to maintain the current situation where an ISP only turns over customer records in a validated and ongoing criminal investigation, and under no other conditions. If it weren't for the necessity of a properly framed investigation, the MAFIAA would run rampant over file sharer's rights.

One company I know of in the UK specialises in contacting police forces for high-tech crimes. That's all they do, get the police to open a case for something as obvious as a stolen router or to report an employee downloading p0rn onto his laptop. Police forces know about things like stolen cars, burglaries, or murders. Anything falling outside their extremely narrow scope of daily activities might as well not exist. Any crime involving the internet or computers tends to be ignored by police forces, because they know they have no officers capable of understanding what, if anything, might have happened to break the law. Being able to speak "cop" and "tech" is apparently much more lucrative than even the highest paying hi-tech jobs.

the AC

Re:Ahh... the power of money

[homer_ca]

When you mentioned insurance, I went to check prices for coverage. I know Dell sells insurance to coverage accidental damage, but I see they now offer Computrace Lojack and accidental damage insurance for the same price as what they used to charge for just insurance, $120. There's no subscription fee. The Lojack coverage runs as long as the warranty.

Re:Thieves aren't that smart...?

[Anonymous Coward]

Disclaimer:

Educational purposes only - submission as evidence by prosecution and/or plaintiff constitutes mistral, dismissal with utmost prejudice and/or overturn on appeal.

~ Gloves first
~ Use Isopropanol wipes to remove fingerprints
~ use hydrogen peroxide wipes to destroy DNA residue; don't use bleach for it is a corrosive.
~ Research make and model for security features, such as BIOS level wireless ID broadcasting (such info may not be published due to public policy reasons).
~ Do NOT power up laptop as is.
~ Remove NVRAM battery to clear NVRAM.
~ Remove any devices in the card bus slots and identify. If such are NICs, dispose (MAC addresses are unique therefore traceable)
~ Remove hard drive and copy contents thereof onto desktop system (dd if=/dev/hd? of=/home/spy/hdimage)
~ Wipe laptop hard drive clean (dd bs=256k if=/dev/zero of=/dev/hd?)
~ Disable any and all integrated NICs because there may exist BIOS level 'rat code'.
~ With all NICs disabled, copy and reverse assemble BIOS to check for any such code.
~ For those with $$$, build a copper RF shielding box (NSA, anyone?) with a WAP inside tied to a PC running tcpdump (isolated subnet) to see if it is trying to 'phone home'.

As for the net bug feature, that has some false incrimination potential.

Re:Thieves aren't that smart...?

[Ihlosi]

~ Remove any devices in the card bus slots and identify. If such are NICs, dispose (MAC addresses are unique therefore traceable)

Actually ... they're "kinda" unique, but not "really" unique (they do get reused after a couple of years or whatever the "design life" of NICs is). That should make for some interesting false accusation scenarios.

Re:Thieves aren't that smart...?

[Ihlosi]

~ Disable any and all integrated NICs because there may exist BIOS level 'rat code'.

How (apart from physically separating the NIC from the rest of the system, i.e. rip the chip off the board or cut the relevant PCB traces) would you go about that ?

Security at my company is good!

[internetcommie]

It consists of never buying new equipment unless it is absolutely necessary, and then buying second-hand if at all possible.
If a thief made it into the building and walked out with all the computers here, he might make $150 on ebay if lucky.
But he'd be more likely to just get a hernia.

Re:Security at my company is good!

[Anonymous Coward]

But the emnployees would immediately throw a party...

Re:Security at my company is good!

[sjames]

But he'd be more likely to just get a hernia.

Followed by a scummy lawyer and a big fat settlement check!

Try airport mainframes

[Simon]

Laptops are for pussies. Try mainframes from international airports:

The brazen airport computer theft that has Australia's anti-terror fighters up in arms

--
Simon

Re:Try airport mainframes

[Anonymous Coward]

That sounds an awful lot like bad security, unless the article left out the "forged property receipts" part. Some places I've worked issue them like IDs that allowed you to carry junk out the door, and others required a form with serial numbers of the hardware on it, and stamped/signed by a clerk in charge of issuing equipment, and even then the guards would stop us and call the name on the receipt when we were moving even small equipment. As for "top secret" mentioned in the article, that couldn't have been serious.. if they don't verify equipment coming or going, only a fool would secure something considered "top secret" with such poor security.

Re:Try airport mainframes

[cthulhu11]

Mainframes? Hard to say. The article says they put them on "trolleys" after all, which I'm guessing is Australian for a cart. More likely they ripped off a pair of Mac Minis or such.

Re:Try airport mainframes

[Simon]

The article says that it took them two hours to disconnect the two computers. Big mac minis.

--
Simon

Two million in one year?

[LoudMusic]

Somehow I have a hard time believing 2,000,000 laptops were stolen in a single year. That's nearly 5,500 per DAY. I don't think Dell even move than many laptops in a day. And I don't know a single person, personally, who had their laptop stolen. Ever. Where do these numbers come from? Are people just reporting stolen laptops for insurance claims? And now they have two laptops?

Re:Two million in one year?

[Joe the Lesser]

My bad. My friend and I have a competition to see how many times we steal this one laptop from each other. Everytime he goes to the bathroom I grab it from his cubicle...that's probably throwing the numbers off.

Re:Two million in one year?

[crossmr]

that's often the way. Every time I hear statistics about how frequent something is, it sounds ridiculously high. You begin to look around at your coworkers and friends and think 3 of you will be dead by the end of the day if this it be believed...

Re:It's in the BIOS

[InvisiBill]

http://news.thomasnet.com/companystory/471725

VANCOUVER, Dec. 13 /PRNewswire-FirstCall/ -- Absolute(R) Software ("Absolute") (TSX: ABT), the leading provider of computer theft protection and secure asset tracking solutions, today announced a milestone in the company's efforts to drive the standard for PC theft recovery and Secure Asset Tracking(TM) - the availability of Computrace support in the BIOS across all four of the top tier PC manufacturers' commercial notebook lines.

Absolute first announced BIOS support for its theft protection technology with IBM/Lenovo on February 1, 2005; followed by announcements with Gateway on August 9th and HP on October 4th. Today, Dell announced a set of customer solutions that leverages Dell's embedded BIOS support for Computrace allowing customers to address issues of regulatory compliance, data protection and PC theft recovery.

We don't use it here, but I believe once you enable it in the BIOS, it can't be disabled. Obviously, there's always a way to disable everything, but it's not a matter of formatting a drive or changing a BIOS setting. It comes down to hex-editing the BIOS data or replacing the BIOS chip or something.

97% not recovered, you say

[Anonymous Coward]

Right. My question is:

What percent of ALL stolen property is ever recovered. I bet it is no different than laptops. Heck, laptops seems likely to have a BETTER rate of return.

My experience is that if you get robbed, the cops fill out a report so you can send it to your insurance but otherwise have important speeding tickets to give out.

Not smart

[pinguwin]

This is a comment I posted on Fark: I kid you not, I know this guy. In the early 90's, we had a landlord who put a stove on our porch. It sat there for six weeks. We finally put it on the landlords porch after repeatedly requesting it be moved and were evicted for said offense. Our friend moved in after us (even after being warned) and so did this Eric guy. We knew Eric as we would go visit our friends who still lived there. One day our friend went downstairs into the basement and it was covered in dust. It turns out that he had broken into a real estate business (might have been home based) and stole a safe. He was breaking the safe open with a hammer and concrete dust was everywhere. The police were called and to misuse a fark term, jailarity ensued. Our friend was then kicked out for stupid reasons and Eric had a new home for a while courtesy of the state of Minnesota if you know what I mean. He really was a one-kid crime wave. I'm not going to give Eric a lot of credit for being smart, as when he was breaking open the safe he was smashing through the top which was quite thick instead of the bottom which was much thinner. Maybe a dumbass tag is appropriate ... A really smart thief gets someone else to do the dirty work for them, IMHO, of course (not that I really know :-)

Social Engineering is not new

[aarenz]

Went to school at local Tech College about 20 years ago. Guy parked a van right outside he building on a sidewalk, came in and took several IBM mainframe terminals on a cart and left. The person who was monitoring the lab helped them load them onto the cart. They were worth about $1,000 each back then. He had overalls that had an IBM logo on it and a big white van. No one said anything until later. That is the biggest issue for all data and equipment at a corporation. People give out their passwords over the phone to the "IT Department", who should never need it. People need training, technology can not solve the problem of stupid people.

Re:Social Engineering is not new

[__aawdrj2992]

The local Best Buy had something similar happen two years ago. Back then the Xbox 360 had just come out and they prominently displayed it. A theif wearing a fake Microsoft ID lanyard walked up to an employee and told him he was here to pick up the console. The employee unlocked it without question and the theif walked off with the Xbox.

I can tell you this works

[Sait-kun]

What this guy did I've done many times. Sure I didn't steal anything but using this tactic to get the advantage over others is dead easy. for example... long line in front of a store selling the new Wii "sorry, passing trough - sorry i work here." and 5 minutes later I walked out with my wii while others spend hours waiting. It just takes a certain aura really when people see you walk by they have to think "he belongs here" you'd be surprised how easily I can cut a line in a attraction park wearing a old repair company jacket I got for a spare time job. Why wait a hour or more if you can just walk past everyone... I'm pretty sure I could walk in most large companies take almost anything I want and walk out without anyone questioning it. As mentioned above just stick a big sticker "RMA" or "repair" on a 30" monitor and walk outlike you're just doing your job. I wonder if this falls under social engineering.. I mean you're basically (ab)using the people around you to believe you're someone else.

Re:I can tell you this works

[Anonymous Coward]

It is amazing what you can accomplish if you don't care what people think of you.

Re:I can tell you this works

[Buran]

So you're the asshole who flies down the lane that's closing and forces me to slam on my brakes as I pass the huge flashing LED arrow and the orange and white construction barrels. Thanks, prick.

Re:I can tell you this works

[pandrijeczko]

If there's one thing worse than someone who "leeches" off of the foibles of everyone else, it's the person who brags about doing so.

I pity you & maybe when you're on your deathbed dying alone because you've spent your selfish life screwing everyone else over to the point that they don't want to know you, maybe you'll understand what living *WITH* other people is really about.

Re:I can tell you this works

[Anonymous Coward]

Why wait a hour or more if you can just walk past everyone...

Because not all of us are supreme douchebags.

Re:I can tell you this works

[Stephen Gilbert]

Why wait a hour or more if you can just walk past everyone...

Because I try not to be an asshole to everyone around me?

Re:I can tell you this works

[Anonymous Coward]

Why wait a hour or more if you can just walk past everyone... Because [insert troll food here]

Re:Thieves aren't that smart...?

[Anonymous Coward]

with a WAP inside tied to a PC

?? Alright, so I kidnapped some dude chanting "Yankees Suck!" in the North End, but how exactly do I tie him to the PC? I thought bungie cords might do the trick, but fuck is this guy greasy.

Illegal wiretap

[SnarfQuest]

This is another case of an illegal wiretap of American citizens! They did not get a warrent from the FISA court before installing the software on his laptop, making it completely illegal. This is an abuse of private citizens by an overzealous government! This poor fellow should be immediately freed, his criminal history cleared, and an apology with monetary reimbursements for his trouble! The owners of the Outback Steakhouse should immediately be imprisoned for casuing this travesty of justice!

Re:Illegal wiretap

[junglee_iitk]

Reminds me of an incident that happened to one of my friend when he was in University of Aachen (Germany). He was returning to his room from somwhere when he saw a couple with a big rucksack leaving the hostel compound. After coming to his room he discovers that the couple were thieves! They broke two rooms and stole two laptops from there, third room was my friend's room, who was visited by another friend at that time. So it had two laptops, and two mobile phones, and a Canon PowerShot S2 IS (~400 EUR then). So they didn't go for the fourth room :)

Anyway, police arrived shortly after. My friend gives a call to his mobile phone and it rings! But the police denied tracing it down, saying it required paper-work. Of course his phone never rang again after a couple of hours... he was very pissed!

Re:Illegal wiretap

[Anonymous Coward]

The sad fact of the Internet is that there is no way to tell if you were making a bad joke, or if you are an idiotic right-winger who should be shot in the face.

I'm guessing it's the latter. Am I right?

MAC address registration

[InsMonkey]

The university I work for requires that all devices used on campus have their MAC addresses registered. If a device is reported stolen we can then find out which switch port or AP the thing is connected to. I've recovered several notebooks this way for users who had been ripped off by someone on campus.

Re:MAC address registration

[crossmr]

really only useful in a limited sense. Assuming whoever steals it hooks it in to the campus network or doesn't know how to spoof it.

Re:MAC address registration

[plover]

really only useful in a limited sense. Assuming whoever steals it hooks it in to the campus network or doesn't know how to spoof it.

Which is still really useful in practice. Thieves are generally both stupid and lazy, they're usually criminals of opportunity who will take only an easy-to-steal unlocked device if they think nobody's looking, and (don't know how|won't bother) to cover their tracks. A fairly large fraction of these thefts are likely to be resolved quickly, and in a university environment expulsion is a pretty good tactic to help reduce repeat offenders.

Of course you can't count on MAC addresses to solve every single laptop theft, but if you can recover more than about 3% of them you're still doing better than the police.

Re:MAC address registration

[crossmr]

and that really only lasts as long as the secret stays secret. As soon as someone lets it slip and word gets round people who want to steal them will just move them off campus and either use them there or sell them. As has been pointed out many times here social engineering is the real downfall.

We were hit by him

[Anonymous Coward]

The reason I know we were hit by him is that one of the surveillance camera photos in one article was taken with our surveillance camera.

Why was it possible? Several people in that office, lots of walk-in and walk-through traffic, and nothing was locked down. We provided and required the use of locking cables, but the employees there hated locking things up. Someone needs to invent a locking docking station with fingerprint reader to release the lock.

Losing things is part of corporate business, and if things aren't encrypted (even on desktops), then it's your fault. Every place I have worked has had a slow, steady trickle of laptops departing by way of cleaning staff, terminated employees, underpaid employees, and the normal dishonest employees.

His eBay profile

[ackthpt]

Can be seen here

Ironic someone said they didn't trust him, he was a fraud. At least one bidder got the scoop.

Re:His eBay profile

[vivtho]

I don't know about US law on this issue... will the people who purchased stolen laptops from him have to return them? Or does he have to make good the cost of the laptops to the companies he stole them from?

Re:Thieves aren't that smart...?

[Zenaku]

To disable ethernet, just don't plug a cable into it. To disable 802.11, physically move the machine to anyplace that is NOT in a wireless hotspot.

Outback is not Australian

[WML MUNSON]

It's an American restaurant. They just use Australian marketing themes.

Rootkitting the BIOS?

[eniac42]

So its basically Root-kitting the BIOS via the Flash-ROM? Ok, you might want to do this to retrieve stolen laptops, but isnt this an obvious security issue? Should there be an open-source BIOS rootkit detector? This might not be too hard - just scan the BIOS ROM, generate checksums and check against a database of legitimate BIOSes..

Interesting - did they fix Lojack then?

[cheros]

AFAIK the product and its support was found to be rather deficient [PDF file].

Could be a good marketing coup, but I'd like to know how such a program could survive. To stick it "in the BIOS" implies deep knowledge of the BIOS (and a lot of space) of each system, so I have trouble believing that statement, especially if it then also does a re-install. Sorry, I have occasional attacks of gullibility but that is just too much to accept..

Re:Interesting - did they fix Lojack then?

[Anonymous Coward]

I have trouble believing that statement, especially if it then also does a re-install.

You can read more here:

http://www.absolute.com/products-bios-enabled-computers.asp

Re:Interesting - did they fix Lojack then?

[hotgigs]

Hmmm... perhaps Sony was just trying to help people "locate" stolen computers when their root kits were installed...

Re:Interesting - did they fix Lojack then?

[cheros]

LOL - but you do have a point. I just posted another reply in this thread.

On balance, I think it's a relatively useful idea (it requires an above average criminal to zap it), but it seems Lojack has in the process of creating this managed to open Pandora's box of self re-installing trojans. The potential of someone writing a hack to take over the HPA segment is something that worries me.

I give it 6 months before someone finds a trojan that manipulates the HPA to replace Lojack code with itself. For all I know, it may have already happened - for commercial espionage the incentive is definitely there as such a hack would survive the traditional company 'build' process.

So, interesting product, worrying implications. On a volume basis this is indeed a deterrent, it just enables other capabilities I'm not so sure I'd like to have in my BIOS. Going back to Sony it makes me happy I totally nuked the hard disk and installed Linux - that will stop at least factory installed rootkits :-).

Re:It's in the BIOS

[Anonymous Coward]

Its not true. Just remove battery from mobo for few H and BIOS password/settings willbe restet.

Hmm, here's someone who begs to differ..

[cheros]

See http://www.trust-us.ch/cryptome/01-Cryptome-061213/lojack-hack.pdf. Maybe they did solve the problem, but that still makes me worried about responses to vulnerabilities.

And I don't like the idea of a system reporting to some 3rd party where it is. I have no way to check that information is only used in a benign way..

Re:Hmm, here's someone who begs to differ..

[madigan82]

I don't doubt that there are flaws and Computrace doesn't claim to be perfect. But how many theives do you know (stop associating with criminals!) that will install FreeBSD (like the guy in the article) to get around the security. The person in the article 1) knows that Computrace is installed 2) has researched ways to get around this security 3) assumes theives are smart enough to know what about the registry, the host file, and proxies AND how use them I'm not questioning the fact it isn't perfect. But for us, it works out pretty nice.

And cat hair! And crumbs!

[Anonymous Coward]

I'm appalled at how much cat hair I get in the keyboards of the laptops I get back from some of our employees! The CPU cycles being used by the virus spam mailers must be warming it up for the cat to snuggle with.

And crumbs too! "I'll tell you why your keyboard isn't working. It's got a full tablespoon of Dorrito crumbs spread evenly under every fucking key."

Stolen laptop thefts

[Anonymous Coward]

Maybe the thieves are stealing from each other.

It's more and more like an urban myth ..

[cheros]

I'd be rushing out to buy the product if I was convinced the statements I find are credible, but that's where my problem starts - the longer I look at what they're claiming the more problems I have with it.

The issue is the survivability of the software - they claim it will survive a reformat, and so far I heard a couple of theories how. Neither stacks up.

In principle, the claim is that they have somehow manage to write something with the capabilities of a boot sector virus, but which can hide itself in the system BIOS to survive a full reformat (to be precise, I don't think that was THEIR claim, someone else offered this as a theory ).

Let's consider how the code could survive.

(1) Read-only hard disk sector. There's no such thing, because it would be a dog to update. and to implement without special hardware, which would require device AND version specific code. I don't buy that.

(2) Hidden partition. This would mean they'd somehow managed to bribe M$ in using code that wouldn't look at a hard disk and spot the boot link to the code. Well, BIOS limits apply: it starts with a boot sector, and that gets overwritten. Bye bye code.

(3) Parked in the BIOS waiting for a bootup. Given the number of BIOS' out there and the variation per system and revision thereof I don't buy that one either. If it's so easy to do I would like to ask 3 questions:
- why can't the Linux BIOS project do the same
- why would a manufacturer leave so much on-chip space
- would you be happy with something going to close to the metal with respect to system stability? I wouldn't trust a laptop to boot up from a copy of Ubuntu if someone had messed with the BIOS, let alone Windows, and I don't believe you have enough code space there to hide something that is sophisticated enough to (a) detect the OS and (b) insert the correct code.

Based on the above, I think the more realistic scenario is that the guy jacked in the laptop BEFORE he reformatted it and thus triggered the transmission, but that wouldn't sound so swell in the article. The nice thing for the company selling Lojack is that it simply has to abstain from commenting for the sales-driving myth to grow. I can see lots of CEOs already calling their CIO and mandate this as a corporate standard - but AFAIK it's based on complete BS which makes me not just wary to buy the product, I would now actively avoid the company because it's selling a product that is mediocre at best. You get a hint of that by their claims that they employ ex law enforcement personnel. Start thinking as a business, and you'll soon start asking the question where the sense would be in that.

In conclusion, I don't buy it in more ways than one. I've been messing with PCs since the IBM XT got cloned, and I will need some serious convincing before I'd believe/buy this story. My theory is that the reporter misunderstood the technology and the reseller is happy to let the myth build.

Which says: AVOID! You will end up with people having a false sense of security, which is worse than having none - and that is unforgivable.

Re:It's more and more like an urban myth ..

[madigan82]

http://www.absolute.com/products-core-technology.asp

No offense but do some research and look at Computrace's website.

The Computrace® Agent is a small software client that can be embedded into the BIOS firmware "at the factory", or installed like most software applications onto the hard drive of a computer. When embedded in the BIOS of computers by major OEMs, such as Dell, Fujitsu, Gateway, HP, Lenovo, Motion Computing, Panasonic and Toshiba, the Computrace Agent can survive operating system re-installations, hard drive reformats and even hard drive replacements. This isn't something you can easily/possible get done after it is shipped. All of our laptops come with it already.

Re:It's more and more like an urban myth ..

[Anonymous Coward]

I don't buy that one either

Here's the list of manufacturers who have Computrace pre-installed in their BIOSes:

http://www.absolute.com/products-bios-enabled-computers.asp

And another thing..

[cheros]

If this was remotely possible, don't you think there would be legions of professional criminal coders busy working out how it was done?

It's the holy grail of Trojan engineering..

Just checked their website - no claims!

[cheros]

Interesting - you appear to state something that the supplier itself categorically avoids addressing on their website.

So we have now unsubstantiated claims in the wild the code will survive a reformat - but the manufacturer itself avoids any mention of survivability. I guess it's too obvious an instruction for wannabee thieves: zap the box before you plug it in. BTW, this is why I tend to remove recovery partitions - why help a thief to the original software? We have a DVD backup of it anyway (the Sony laptops need a dual layer one just to hold all the crap they install on top).

How did you arrive at the idea that Lojack survives a reformat? Do they state that in the product docs or FAQ? I'd be interested in the specific quote.

So, the conclusion is that this product requires a combination of dumb thieves and dumb buyers to work. That's still a pretty large group given the amount of Windows users (cough :-), but the supplier carefully leaves the obvious question unanswered.

Which is an answer in itself.

Re:Just checked their website - no claims!

[Anonymous Coward]

How did you arrive at the idea that Lojack survives a reformat? Do they state that in the product docs or FAQ? I'd be interested in the specific quote.

It's right here:

http://www.absolute.com/products-core-technology.asp

"the Computrace Agent can survive operating system re-installations, hard drive reformats and even hard drive replacements"

A laptop, like a car, is a tool, not a holy fetish

[Anonymous Coward]

> A few years ago I was working in IT for a university.
> One of the professors didn't like the buttons by the touchpad because he
> would bump it with his palms while typing and end focus would change to
> some other app. So instead of disabling the touchpad, he just broke
> the buttons off. That was fun to explain to the Dell rep when he had
> some other hardware problems that needed to be replaced.

So what is wrong with that?

A laptop is just a tool - unless you work in advertising and use a Macbook Pro, that is :-)

If you are a mechanic and feel that the long handle of the hammer is getting in your way when using it, you will saw off an inch or two.

Unless you share the hammer with other people who might need the extra length, that seems perfectly o.k. to me.

It is a longstanding tradition that professional craftsmen would improve and hone their personal tools to improve their efficiency.

You would expect a professor to be a outstanding mind and find creative solutions to all sorts of problems.
You probably do not have this kind of "problem" with the accounting department.

Could you imagine a guy like the late Feynman, wasting three hours of his time googling for tips on how to disable some keys, when a pair of pliers and 30 seconds would have solved a problem that began to annoy him some saturday evening when working on a difficult paper? Or him getting a ticket with IT on monday morning, so they get it fixed at some time during the week?

Standard TF2 reply

[rabiddeity]

Yeah we've been having similar problems where I work. This guy, he keeps dressing up like a security guard, coming in, sabotaging security equipment so he doesn't get caught, and stealing the briefcase that a manager left on his desk. On top of that he somehow must access to our database, because the nametag on his security badge always has one of our names on it. On one occasion he was brazen enough to stroll in dressed like ME! I've tried to warn my people to keep an eye out at the entrances but they keep claiming they never saw him. It's like the guy's got some kind of cloaking field or something. I'm sick of getting stabbed in the back by these kinds of people. I swear to god, one of these days I'm gonna have to resort to just shooting everyone that walks in the door just to make sure they are who they appear to be.

$20k? Career thief or career loser?

[Anonymous Coward]

"Over the years, he pocketed at least $20,000"

I would have thought that several years' worth of illicit labor should be worth more than what a minimum wage job pays in one year. 130 laptops, if laptops average $1000, well that's $130k. Of course, when it's stolen you want to move them for whatever price you can, but that still seems like he made very little money.

And now he's getting married to his cellmate. Doesn't seem worth it...

So it IS a benign trojan then..

[cheros]

Thanks, I didn't find that in the regular product descriptions.

The HPA area isn't that well protected but it would take at least a much smarter kind of criminal, and if you're that smart you could make a living in IT instead (there's an inclination and risk vs reward debate lurking here which I'm leaving aside :-) - that addressed the size issue, although I found that it apparently needs a working copy of Windows re-installed before it can reconstruct itself. This seems to imply that the BIOS component merely kickstarts the install of whatever lives in the HPA, which would makes sense given size constraints.

BIOS resident functions have implications for maintenance as you now have two different parties who have to collaborate for a BIOS patch, so I suspect this is based on some sort of API to keep it manageable. The ugly thing is that Lojack thus appears to have at least identified a potential route to write a TSR (Terminate & Stay resident) trojan, which is a door I would have hoped to stay closed a bit longer. I give it a couple of months before code appears to target that HPA component, and then the fun *really* starts - the moment someone finds a way to crack what's in the HPA you can replace it with your own version of the cookie monster and then all hell will break loose. This approach could offer a bigger industrial espionage backdoor to global information than Windows could ever present by itself.

This could get more interesting than I originally thought..

Thanks for the data.