Slashdot Mirror
Lenovo Service Disables Laptops With a Text Message
narramissic writes "Lenovo plans to announce on Tuesday a service that allows users to remotely disable a PC by sending a text message. A user can send the command from a specified cell phone number — each ThinkPad can be paired with up to 10 cell phones — to kill a PC. The software will be available free from Lenovo's Web site. It will also be available on certain ThinkPad notebooks equipped with mobile broadband starting in the first half of 2009. 'You steal my PC and ... if I can deliver a signal to that PC that turns it off, hey, I'm good now,' said Stacy Cannady, product manager of security at Lenovo. 'The limitation here is that you have to have a WAN card in the PC and you must be paying a data plan for it,' Cannady added."
From a stolen lapt
They were right - the revolution did not get televised. It was posted on YouTube instead. All in 120 characters. SLOOSH!
Pretty interesting security feature but not if your buddies get a hold of your cell phone.
and what happens if they just reinstall the OS?
Things a thief can still do:
Honestly, this is completely useless against even a moderately sophisticated thief.
someone figures out the "secret" signal to send to a PC to disable it?
How exactly are they disabling the laptop? It can't be something superficial but with the amount of time a program has to work it probably has to be superficial to work. Will a program have enough time to do anything more then clear the cmos or erase the drive mbr? Even if it's a hardware disable the whole thing becomes parts worthy and the data on the hard drive essentially remains in it's entirety.
it would NEVER make sense to part out their new brick into say a cheap display, harddisk, dvd drive, ram, cpu, etc. on ebay.
I prefer the "u" in honour as it seems to be missing these days.
I've got a pretty good idea what that message would likely be. Or at least the general sentiments expressed (hopefully on the screen) right before its tiny heart goes pfft.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
My normal Slashdot cynicism wants to find a problem with this technology, but I can't so far, other than that a smart thief would just make sure to remove the WAN card and flash the BIOS (possibly with a new serial number or the remote disable, uh, disabled).
You win this time, Lenovo. *shakes fist*
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Steal the laptop, remove the WAN card before turning it on, and go to hack forum to find out how to remove or disable the process that makes this killswitch possible. Only slightly inconvenient.
The article is pretty slim on how this is actually going to work. Do I assume that I make the phone call once and Lenovo will constantly try to connect with it until it is successful? If not, how many times do I call it until I cut off my data plan?
I would like to be able to turn this off in the future when attempting to sell the laptop as well.
This would excite me more if I could send a remote command that would detonate a small brick of C4 in the laptop. Why disable the computer when you can disable the thief?
It's like the "LoJack for Laptops" that they'll sell you -- strictly part of the installed Microsoft setup.
Lacking <sarcasm> tags,
'You steal my PC and ... if I can deliver a signal to that PC that turns it off, hey, I'm good now,'
Apart from not having a laptop or your data anymore.
I'm not sure that can be described as being 'good'.
The "I'm dead" bit is in the BIOS, but the trigger is in the operating system. For many good and sufficient reasons, they can't have the BIOS hogging the wireless 100% of the time.
Lacking <sarcasm> tags,
I would pay for the version that explodes with maximum anti-personnel affect.
Bizarre that Lenovo is considering this instead of an el-cheapo GPS phone-home device.
A remotely accessible killswitch that could be fired even against the legitimate owner's consent... hey, isn't that exactly what Orrin Hatch has been requesting that the Righteous Inquisition Army of Autocrats be able to do to file sharers a few years back???
... your best enemy learns about caller ID spoofing.
This is stupid, disabling the device will only cause either physical attempts to remove the protections (bad for the hardware if done improperly) or disposing of the laptop in the first dumpster. The owner gets nothing.
I think the best idea is to start tracking the laptop. Send out GPS coordinates, send out IP addresses, send out _fingerprints_, take screen shots, etc.
So you're telling me there will be a GSM module in the laptop that is constantly connecting to my network to wait for such a kill signal? Like say, a tracing bug? I know it'll be a pain for the thief but what about me? What a craptacular idea. Having my laptop become my personal GSM tracking device. Where have I been? Wait lets ask my "anti theft"-device.
Seems to be some kind of revenge system.
"hey you stole my laptop, so now I've made it useless"
This doesn't prevent theft and because it's not likely to be the default behaviour of the laptop it doesn't even discourage theft.
...and that is all I have to say about that.
http://jessta.id.au
Duh, I read the summary as Lego novo service disables laptops with a text message
Well, back to the brute-force approach, minions. Go for the outlet! Go!
Is there a laughing animated skull on the screen when this goes off? If aliens stole your laptop, would it shut down their computer network, shields, and weapon systems? Do I need Jeff Goldblum to configure it for me?
The network card is not the only thing that is wrong with this, the fact that you now turned off the machine, states the machine will not turn back on...to give you a location of where it is.
Someone will open it up...change the network card with another...or just add a usb one...and there you go...problem solved.
I can see the funny hacks on this where some numbnut starts sending the disable code to everyone's laptop in the room. Sounds cute but ain't practical. Track it? Practical. Disable it? Limited use.
ACK
I would have thought it'd be more sensible to just have some sort of lojack equivilent. It'd be much more useful - you could find & recover your laptop (hopefully with your data still on it) and probably locate the criminal as well.
This feature doesn't seem to be aimed at stopping blackhats or organized criminals, two of the more "intelligent" varieties. No, this thing is meant to royally screw Joe Crackhead.
The feature doesn't appear as if it's ever going to stop a sophisticated high-tech criminal, naturally. Nor does this seem the intent. Identity thieves and data miners don't even need possession of the laptop, so no good there. Even then, the new feature is easily defeated. Organized criminals tend to know what they're doing as well, and any safety measure can be defeated by competence and planning. Still, they're both rare enough.
No, this sounds perfect for the two-bit junkie, the most common of criminals. Brick the laptop, especially remotely, and suddenly it's worthless for him to offload for his fix.
Do I get bonus points if I act like I care?
How about a text message that causes the system to monitor the cameras output until it detects a face, takes a picture. Monitors the fingerprint sensor (if one is present) and waits for a fingerprint and then gets it gps position and finally sends email to 911@-current county-.gov
Is that a new kind of denial of service?
This is exactly what we need in terms of laptop security. To you nay-sayers out there spinning doom and gloom scenarios about friends pranking your laptop with text messages, I can only assume that there is some secret passcode that you must send as part of the text-message to disable the machine. In fact, it should be convoluted, and hard to remember. Fortunately, as the proud owner of a brand-new Lenovo laptop, you can keep information like that stored right on the laptop, which you take everywhere.
So, as long as I know your cellphone number, I can remotely disable your laptop. Nice!
(n.b. it's easy to send a text message with a forged number as the sender, it's part of the message, comparable to the 'from' header in an email)
That most intelligent OSes do _not_ use the BIOS, don't you?
Like, Linux/BSD/MacOSX... they all bypass the BIOS. Once the laptop has booted, no BIOS code is ever executed again?!
How about setting up a simple script that periodically polls a remote site - say a web page under your control? If it can't reach it, or it reaches it and gets a default response, no action's taken. If on the other hand the page returns an innocuous looking kill code, a small program is run that disables the BIOS? On the server side, you'd be mailed the IP your stolen laptop connected from, which might give you some location info.
"with their freedom lost all virtue lose" - Milton
I hope they are not using caller-id to "pair" the devices... Actually, that might be kinda fun :)
Why not install Windows Vista, iTunes and the game Spore. That way you don't even need to send an SMS, just wait until code is activated progressively making the computer useless.
Phillip.
Property for sale in Nice, France
write a script so anytime your laptop connects automatically reports its ip to a home machine
if your laptop is stolen, wait for it to connect, then ssh to it and do 'rm -rf /', or maybe `dd if=/dev/zero of=/dev/[s|h]hda`. Or for that matter, anything else you want, like perhaps instead of disabling it, monitor what the thief does with it, assuming he can get around the login prompt.
(Oh, what? Oh, this is for laptops running that toy OS platform that only the ignorant masses and corporate sycophants use? Oh, nevermind then. they are stupid enough to actually *pay* for a service like this - go ahead and make money off them - but I wonder, why post news about something like this to a site intended for non-morons?)
While of course this won't stop everyone stealing laptops out there, it might help in conjunction with the other antitheft devices like Kensington locks (but they are easily broken), and the alarm software that uses the accelerometer (http://www.musatcha.com/software/LaptopTheftPrevention/)
Couple this technology with the "caller id spoofing" company that's been mentioned here a few times and you have an interesting situation!
Oh the hackers will have a field day with this!
they disable every laptop and pc sold in the US.
There goes our military capability.
OUCH!
China starts cyberwar by remotely shutting off all Gov laptops
http://www.internetnews.com/infra/article.php/3679026
Any time you provide a tool like this, it has the potentiall to be used against the owner as well, especially if someone else with access to the equipment understands the tool better than the owner does.
I can see several scenarios, some more plausible than others where another party might be inclined to use it to lock the owner out of access to his own data.
Yes if the other party has access to the machine, they can always cripple it by other means but the beauty of this is that it can be used even after that party apparently no longer has access.
Umm, how does this get you your laptop back? Or does it simply become a case of I don't have it and he can't use it? Useful perhaps if you want to keep the data on it from prying eyes, but wouldn't just encryption solve the same problem?
Jealously hoarding mod points since 2007.
(The phone rings.)
Frink: Lab.
Homer's Message: Greetings, friend. Do you wish to look as happy as me?...
Frink: Why it's the AT-5000 Auto-Dialer! My very first patent. Aw, would you listen to the gibberish they've got you saying, it's sad and alarming. You were designed to alert schoolchildren about snow days and such! Well, let's get you home to Frinky. Hope your wheels still work, bw-hey.
(Frink dials a code into the phone, and the AT-5000 grows legs with wheels and attempts to escape.)
Homer: Oh no, you don't!
(Homer chases down the machine, removes its legs, and takes it back inside.)
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Well I was gently perusing the interweb this afternoon on my Thinkpad until suddenly this article smacks up in my face and, reading it too quickly, I interpreted it as some kind of government remote control thing and it scared the living daylights out of me!
A reread calmed the nerves.
The drugs don't work, you know. The tinfoil hat types will get to you in the end, if you use F/OSS and read this.
Good Thinkpad. You'd never disable yourself without my permi-
You say... like a cellphone?
so it's just a really elaborate, DIY version of computrace?
What's the benefit? I work for a university in the IT department, and we've been able to recover several stolen laptops using computrace, including one that some dumbass stole from the ROTC.
The laptop itself is irrelevant and easily replaceable, at least for the target customer of this feature. This is not for people who play games on their computer and only care about getting back the hardware and software. This is for people who have corporate or government data on their machine, which exists somewhere else on some backup or some file server or wherever. They don't care about getting anything back, they only care about preventing it from getting out.
If you have (say) all your customers personal information on your laptop (not necessarily a good idea in the first place, but believe me: it happens) then you don't want a thief to have that. If he wipes the hard drive you could care less. Compare a $1000 hardware loss to at least a $1,000,000 loss due to damaged image, lawsuits, etc.
I'm not defending this feature as well-conceived or impenetrable or fool-proof, but just pointing out that most of the criticisms are missing the point.
Seriously, perhaps next time you get spammed via an SMS text message you will also get a "buy my product or else" message included if they know you own a laptop.
The best thing for a stolen laptop to do is getting online preferably with all sorts of user installed call home apps installed on it (or like the famous case have Seti@Home on it), not getting shut down.
I don't even see how this is really legal.
When they were releasing the last spat of gaming consoles, they were delayed in the US because the US govt found that there was a possibility for some of the hardware to be used as a guidance system for rockets.
With this Lenovo plan, you get a ready made world wide capable remote detonation trigger in a great disquise for easy infiltration and deployment.
This is targeted at IT purchasing managers, NOT people who know why it's technically a bad idea.
You're an IT manager, you're hearing about data theft all the time, you're getting pressure from the board to secure all the data on every laptop (as if that was possible).
This is a godsend to you. Sure, it probably won't work. Sure, it might mess up and cost you your data. But IF a laptop goes missing, and you lose data, all of a sudden it's not YOUR fault.
Technological boondoggle or not, this will sell. Tragically, most IT corporate purchasing people I'm aware of aware of will buy this. They need to answer the people screaming "What are you doing about IT theft?" at them. The boss is perfectly happy to sign up for "it will cause problems" if he can think he's solved the issue. After all, the issue are tech support's problem, and that's a different department.
I'm not sure this is to detour people from stealing your top secret data.
I think this is aimed at stopping the average junkie from stealing a laptop from a college campus or coffee shop. If he hears "They can just disable it with a text message." No one is gonna wanna buy it if he can't turn it on. So he'll just steal your ipod instead.
But I don't think this is done well, because the average person does not use a ThinkPad, that's more geared at business and industry people. To really detour crime on that level, Dell would have to implement this.
This won't do anything for the corporate world unless they can track it, because someone stealing corporate data was hired and knows what he's doing. He's not just taking your laptop to reuse or resell it.
I think it's good intentions, but a waste of money and time if they release it like this. But then again, I don't really know anything to begin with.
My honk botnet will crush your lame encryption in less than a day;
No, it won't. It won't crush it in a thousand years, either.
It's winnuke all over again.
And I bet the gov gets a masterkey.
So does storing 1000's of customer/student/employee records unencrypted on a laptop just waiting to be stolen at the airport, and yet we have to read about one of those incidents every month or so. If you're too retarded to protect other people's data, you deserve to have a system that errs on the side of being too easy to lock down. If I sound bitter, it's because I've been informed twice in the last year that my personal information (including SSN) has been compromised on a stolen laptop.
The laptop will get stolen and traded for crack before you realize it and can shut it down. The junkie isn't dealing with sophisticaed buyers, so as long as he demonstrates that the laptopn actually works 'now', the deal will be done.
Have gnu, will travel.
So how much will it cost a shady gov't organization to turn off any computer with this feature they want?
If I want to remote control my laptop, I'll figure out my own way that doesn't involve trusting any large corporations with the controls....
They are just looking quick buck which lazy laptop owners provide. People leave their laptops in hotel rooms and cars, which thieves know.
So you're telling me there will be a GSM module in the laptop that is constantly connecting to my network to wait for such a kill signal? Like say, a tracing bug? I know it'll be a pain for the thief but what about me?
What a craptacular idea. Having my laptop become my personal GSM tracking device. Where have I been? Wait lets ask my "anti theft"-device.
What, you don't already have a cell phone? You stay indoors all the time to avoid satellites? You don't have a car or a credit card?
You're 100% tracked already if anyone wants to bother. The trick is to make sure you don't seem worth paying attention to. And, fill the system with as much noise as possible if you care about individual freedom...
Your post gave me an idea. What if I pretend to be stupid and write down a fake password? Then I configure the computer so that, when the fake password is entered, the data is scrambled. (The real password is the fake password backwards, or every other letter, or something else.)
I wonder if there are any programs with this feature? If the disk is encrypted, writing a small bit of random data to the header should render the rest of the disk undecryptable. If we want it separate from any disk encryption (or are not using disk encryption) then we'd have to find some other setup.
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
Interesting. From time to time we hear about how the police won't try too hard to catch thieves because they have bigger fish to fry. Seems that in your case the cops were fairly efficient. Any ideas about why? Maybe it was because yours was more than just a theft, but direct robbery (which I would guess constitutes violent crime)?
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
Summary of the clip: The best way to protect something from pro thieves is to put the item where it is hard for even you to get, e.g. seal behind drywall near an outlet in case they use a metal detector (and the item you are hiding is metal).
Sprint offers a similar service with some of their WAN cards. The difference is that the Sprint card acts as a key to full-drive crypto. No card, no data. If the card is remotely disabled, no data. Really seems like a great way to lock down your laptops containing sensitive info.
How generally easy it is to spoof a mobile number, I think I'll pass on this Lenovo trick.
Periodic "Prove It" prompts. When it's on, you have to every (user-set period; for enhanced security, periodicity not displayed) period, enter (user-set-number of various-password-levels) passwords, and if you miss a level (due to some interruption), it suspends/snapshots & shuts down. On reboot, if you enter a duress code ONCE or a wrong password (user set-number) a number of times, then it implodes.
If you have on it something worth DYING FOR, then a duress code would be useful. Just have subcutaneous or anal-activated cyanide capsule to avoid enduring torture, and, have no loved ones in your life who's be your torture proxy.
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
Does anyone else remember this article posted less than a month ago? http://cryptome.info/0001/manchu-chip.htm
Text messages are unreliable. You may think you've disabled the machine, but you'll never know if you actually did.
...until I read the headline again and found that it didn't actually say "Lenovo Service Disassembles Laptops With a Text Message".
Being able to remotely pop out all of the screws, clips and other fiddly bits would have been much cooler than just shutting it down.
We reviewed a similar, web-based product here at my place of employment that provides similar features such as tracking and remote "bricking." The rep claimed, like their website, "Most Computer manufacturers also provide embedded support for Computrace in the BIOS or Firmware of the notebook computer" which would indicate that any BIOS updates would include the firmware. The firmware rebuilds the client software on the machine so it may "phone home" and enable deletion of files and the OS. However, the software is dependent on Windows. The representative conceded that installing Linux renders the firmware useless.
A thief looking to offload your laptop to get his fix is likely going to sell it as soon as possible. So it will be the naive kid or pawn shop owner who gets burned by this long after the thief has burned up his money in drugs.
A good thief might be able to unload your laptop before you even realize its gone. Think about how much time you spend buying groceries or eating lunch, etc...
The society for a thought-free internet welcomes you.
THis is kind of wicked. SO&SO decides to buy one of these laptops. Person sends it, gets the money. Several days later, SO&SO finds the system dead. Calls original seller and finds out that it will take another 500 to undo it. Nice way to black mail ppl.
I prefer the "u" in honour as it seems to be missing these days.
I'd like to thank Lenova for making our mischief-making even easier than it was before.
Silent non-trackable audit system that responds to a text message by allowing tracking data to be found by the cops - good idea. Even if it could be used - and will be used - for nefarious reasons ("wonder where Cindy is?" thinks stalker fanboi ...)
Text-enabled shutdown exploit - priceless!
-- Tigger warning: This post may contain tiggers! --
Hmm, a remote DOS attack would be interesting.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Hmm..A Chinese made laptop with an online kill switch. I'm quite sure that that wouldn't bite the military in the ass if we got into a conflict with China.
If I'm worried enough about someone accessing my data to use this service, then sending the text isn't going to set my mind at rest, since there's no way to know if it worked or not. So I'd still be worrying "did it work?". Once the laptop is shut down it can't send an acknowledgement that it did so, can it?
"we have detected an unauthorized copy of file xyz, your laptop is now being disabled".
Or "file with forbidden knowledge of the day"
---- Booth was a patriot ----
my macbook has ssh too