Slashdot Mirror
Ericsson and Intel Offer Remote Notebook Lockdown
MojoKid writes "Ericsson and Intel have announced that they are collaborating on a way to keep your laptop's contents safe when your laptop goes MIA. Using Intel's Anti-Theft Technology — PC Protection (Intel AT-p) and Ericsson's Mobile Broadband (HSPA)
modules,
lost or stolen laptops can be remotely locked down. Similar to Lenovo's recently announced Lockdown Now PC technology, the Ericsson-Intel technology uses SMS messages sent directly to a laptop's mobile broadband chip. Once the chip receives the lock-down message, it passes it to the Intel AT-p function, which is integrated into Intel's Centrino 2 with vPro technology platform. Unlike Lenovo's anti-theft solution, the Ericsson module includes GPS functionality as well."
And once the codes to do this leak into the wild, laptop hijacking and ransoms will be next.
now we need to go OSS in diesel cars
aside from the security risks, this can only become an effective deterrent if it sees widespread use.
good luck with that.
Beware the Jubjub bird, and shun the frumious Bandersnatch.
The question is if this... feature has a government backdoor to 'assist' in 'terrorism investigation.'
ELOI, ELOI, LAMA SABACHTHANI!?
So when they see that their newly stolen laptop suddenly stops functioning, what do they do? They ditch it somewhere, and I don't mean sell it. You'll NEVER get it back then. I mean yeah it's supposed to stop people from stealing your much more valuable personal data but that should be password protected anyway with a directory hider/protector (not like a compressed archive file with a password cuz that's too slow) so why bother? Now people can just fake the signal and shut your laptop off so it seems like it causes more problems than it fixes.
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
It won't solve for another problem: losing the computer in an area without signal (like a train).
If the thief is smart (which is normally not the case), he can remove the hard drive right on the train or in that same area and completely avoid the SMS message. Unless, of course, the SMS can somehow be sent to the security chip without the interference of an operating system.
When I lost my Treo in the subway, the Good administrator for my hosted email service could not remote wipe the phone because it could never find service. It's possible that someone removed the SIM right away, but I'm sure that I lost it while getting off the train.
Nonetheless, it's a great idea that covers many other common circumstances. Fortunately, most thieves are petty thieves and wouldn't know that this module is there in the first place.
I'm assuming they are using the secure instruction included in recent Intel CPU's to talk to the TPM1.2 chip in the laptop and deleting the decrypt key from the keystore therefore making the recovery from FDE like BitLocker basically impossible.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Here's how I would build a lock-downable laptop:
BIOS/preboot environment: Looks to an external device, probably a USB stick, for part or all of the crypto key. Use that to decrypt boot loader on hard disk or other boot device and follow its instructions. Of course this should have a passphrase.
Boot loader will look to whereever it chooses for crypto keys for the rest of the drive. These may be the same keys as the bootloader used or they may be something else. They may be partially or completely downloaded from the Internet, and once decrypted with a passphrase, are stored in memory or better yet only on the CPU in such a way as they are never stored in a paged-memory file.
Furthermore, really sensitive data can be encrypted in container-file partitions, encrypted compressed files, or what not using OS- or application-level-encrypted containers.
This, in conjunction with an "lock all I/O and networking and turn on the screensaver" software when the user is away from the computer, will render it very difficult to get at the data on the drive, difficult to deter all but the most determined adversary.
Now all the user has to do is remember to remove his USB stick after booting. Of course, if his laptop does get stolen he's still out the replacement cost of the machine and the cost of restoring his data from backups.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
No problem. Laptops are worth more when you sell the parts individually rather than the whole thing.
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
Taking the HDD out gains you NOTHING, in theory it's already fully encrypted with 256 bit AES which is uncrackable by any currently known method. The idea is that there is only one real vulnerability in a TPM based system and that is the TPM chip's keystore and the databus that the TPM chip uses to talk to the CPU, if you erase the keystore and thus makes sure that both those pathways are neutralized there should be no possible way to retrieve the data off the disk. There's still the cooled RAM trick and possibly a trace of the key left in the disk controller's cache, but those are both VERY sophisticated attacks that have a very low chance of working even in lab conditions. Oh and I just thought of something, if the TPM keystore is wiped then the TPM trust web collapses and the machine should reboot thus flushing the key from ram.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Another great "Big Brother" innovation. Can't you just imagine, during the next "threat escalation" all laptops get cockblocked "just in case" for the Greater Good ®, of the patriotic nation?
I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.