Slashdot Mirror
Lenovo Service Disables Laptops With a Text Message
narramissic writes "Lenovo plans to announce on Tuesday a service that allows users to remotely disable a PC by sending a text message. A user can send the command from a specified cell phone number — each ThinkPad can be paired with up to 10 cell phones — to kill a PC. The software will be available free from Lenovo's Web site. It will also be available on certain ThinkPad notebooks equipped with mobile broadband starting in the first half of 2009. 'You steal my PC and ... if I can deliver a signal to that PC that turns it off, hey, I'm good now,' said Stacy Cannady, product manager of security at Lenovo. 'The limitation here is that you have to have a WAN card in the PC and you must be paying a data plan for it,' Cannady added."
From a stolen lapt
They were right - the revolution did not get televised. It was posted on YouTube instead. All in 120 characters. SLOOSH!
Pretty interesting security feature but not if your buddies get a hold of your cell phone.
Things a thief can still do:
Honestly, this is completely useless against even a moderately sophisticated thief.
My normal Slashdot cynicism wants to find a problem with this technology, but I can't so far, other than that a smart thief would just make sure to remove the WAN card and flash the BIOS (possibly with a new serial number or the remote disable, uh, disabled).
You win this time, Lenovo. *shakes fist*
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
The article is pretty slim on how this is actually going to work. Do I assume that I make the phone call once and Lenovo will constantly try to connect with it until it is successful? If not, how many times do I call it until I cut off my data plan?
I would like to be able to turn this off in the future when attempting to sell the laptop as well.
This would excite me more if I could send a remote command that would detonate a small brick of C4 in the laptop. Why disable the computer when you can disable the thief?
It's like the "LoJack for Laptops" that they'll sell you -- strictly part of the installed Microsoft setup.
Lacking <sarcasm> tags,
The shutdown is supposed to be utilised with hard disk encryption - the whole point is that your data is better protected. The disabling is carried out by the BIOS; presumably it checks the disable bit before booting the OS and allows the legal user to enter a recovery password.
'You steal my PC and ... if I can deliver a signal to that PC that turns it off, hey, I'm good now,'
Apart from not having a laptop or your data anymore.
I'm not sure that can be described as being 'good'.
Of course it requires the use of a cellular network. That means that if the would-be thief really wants to steal your notebook with data intact, all he or she needs to do is either A) pull out the cellular card or B) if the cellular card is built-in, encase the laptop in a carefully-crafted metal box to designed to block the cell signal.
Either way, it's only a deterrent to people who don't know what they're doing.
My blog
I would pay for the version that explodes with maximum anti-personnel affect.
Bizarre that Lenovo is considering this instead of an el-cheapo GPS phone-home device.
So you're telling me there will be a GSM module in the laptop that is constantly connecting to my network to wait for such a kill signal? Like say, a tracing bug? I know it'll be a pain for the thief but what about me? What a craptacular idea. Having my laptop become my personal GSM tracking device. Where have I been? Wait lets ask my "anti theft"-device.
The network card is not the only thing that is wrong with this, the fact that you now turned off the machine, states the machine will not turn back on...to give you a location of where it is.
Someone will open it up...change the network card with another...or just add a usb one...and there you go...problem solved.
and dismantling the entire laptop to reset the BIOS is actually FASTER than an OS reinstall..
Defective Logic
This feature doesn't seem to be aimed at stopping blackhats or organized criminals, two of the more "intelligent" varieties. No, this thing is meant to royally screw Joe Crackhead.
The feature doesn't appear as if it's ever going to stop a sophisticated high-tech criminal, naturally. Nor does this seem the intent. Identity thieves and data miners don't even need possession of the laptop, so no good there. Even then, the new feature is easily defeated. Organized criminals tend to know what they're doing as well, and any safety measure can be defeated by competence and planning. Still, they're both rare enough.
No, this sounds perfect for the two-bit junkie, the most common of criminals. Brick the laptop, especially remotely, and suddenly it's worthless for him to offload for his fix.
Do I get bonus points if I act like I care?
It's not meant to discourage theft, it's meant to protect your data.
If the HDD is encrypted, you can lock the thief out.
Gone!
This is exactly what we need in terms of laptop security. To you nay-sayers out there spinning doom and gloom scenarios about friends pranking your laptop with text messages, I can only assume that there is some secret passcode that you must send as part of the text-message to disable the machine. In fact, it should be convoluted, and hard to remember. Fortunately, as the proud owner of a brand-new Lenovo laptop, you can keep information like that stored right on the laptop, which you take everywhere.
If you think Phoenix is that smart, well I have a bunch of bridges to sell you.
This isn't the first security gimmick they've deployed. They've had the internet version of this sort of thing for years now (Computrace / Lojack). It's a software client that runs in the taskbar, Windows-only, that triggers the BIOS kill bit.
I wouldn't be surprised if this "new" cell-based feature were just a new client app working with the same kill bit as the old ones. That makes it easier to develop and deploy, since it would only require trivial changes in the BIOS code that can be implemented on any machine, regardless of vintage.
-Billco, Fnarg.com
It isn't quite that simple on a ThinkPad - the BIOS password is tied in to the TPM chip. And I really doubt your average thief is going to be building custom hardware and soldering it to the laptop mainboard...
How about setting up a simple script that periodically polls a remote site - say a web page under your control? If it can't reach it, or it reaches it and gets a default response, no action's taken. If on the other hand the page returns an innocuous looking kill code, a small program is run that disables the BIOS? On the server side, you'd be mailed the IP your stolen laptop connected from, which might give you some location info.
"with their freedom lost all virtue lose" - Milton
Why not install Windows Vista, iTunes and the game Spore. That way you don't even need to send an SMS, just wait until code is activated progressively making the computer useless.
Phillip.
Property for sale in Nice, France
what makes you think they wouldn't just put the dead laptop itself on eBay? They claim it is "recently untested but worked a while ago" and some sucker buys it. I mean we're not talking about honest people here are we?
I have to disagree with you on this point. Nothing, I repeat, nothing, pisses me off more than a thief. 90% of the time they no have no interest in what they stole, they just want money for it.
If I can catch you, I will beat your ass. You have a duty to protect your property.
http://www.internetnews.com/infra/article.php/3679026
If it has a webcam, add mugshot. Compare the image on a local mugshot database, get some likely culprits and their last known address. Then maybe automate the search warrant, police report, and insurance claims process and you've got a real solution. Of course, the search warrant part is now optional, I believe.
If you never make mistakes, it's probably because you're not doing anything.
Any time you provide a tool like this, it has the potentiall to be used against the owner as well, especially if someone else with access to the equipment understands the tool better than the owner does.
I can see several scenarios, some more plausible than others where another party might be inclined to use it to lock the owner out of access to his own data.
Yes if the other party has access to the machine, they can always cripple it by other means but the beauty of this is that it can be used even after that party apparently no longer has access.
You say... like a cellphone?
Sprint offers a similar service with some of their WAN cards. The difference is that the Sprint card acts as a key to full-drive crypto. No card, no data. If the card is remotely disabled, no data. Really seems like a great way to lock down your laptops containing sensitive info.