Tracking Stolen Macs with software
 

Could I get a few of you guys to chime in on your favorite 'stolen computer' tracking software / method / schemes...

ie, send out an identifying email or network location [ insert method and protocol here ] for getting a handle on 'where it is'

(And any good stories about 'recapture'. 8-)

Im about to do some travling with some VERY SENSITiVE DATA... and if the worst should happen.. I would like there to be SOME HOPE of getting it back or maybe deleting it if possible.

So guys... WHATS THE LATEST TRICKY STUFF...?

Thanks in advance

I read this story here a few days ago:

http://www.macnn.com/articles/07/09/...macbooks.back/

the software makes use of the IP address to help with locating it, as well as the iSight camera to take a picture of the thief & their location. pretty slick stuff.

I have a cron job that fetch a web page on one server of my own.

Thanks, I did not yet had to use it.

If you have so sensitive data, the best protection is to keep an eye on the laptop *all the time*.

Whatever your method, it will rely on the laptop being connected. Depending on who stole it and why, it could never happen.

If they do an erase & install, nothing you do with software will remain. :(

Yeah.. I know.. Bummer... but then most theves aren't that smart to begin with... or they wouldn't be theves.. eh..

Besides.. I have to at least try... and what are they going to do.. put in a windows disk in it.. BAH ha ha ha ha ha...

An just think... what is the thief going to think when he finds out who ratted him out...



THE FREAKIN THING HE STOLE....


________________________
Not the mama...
I'm the baby...
Gotta love me...
(Dinosaurs 1997)

And put the sensitive data in an encrypted disk image, or use FileVault.

This story is probably not exactly what you're looking for, but...

I once had a PowerMac G4 (with some pro audio cards and a fast video card installed) and CRT monitor stolen from my house. I did not realize that I had anything installed on that computer that would phone home, as one usually worries about theft of portables not workstations. But approximately a year later, I started getting e-mails from a Trip-wire like application that I had installed on the PowerMac G4 called Checkmate. I had Checkmate set to tell me if certain important files were changed to protect against crackers on the computer. It sent an e-mail to my account every evening at 1:00 am when it noticed any change. I could reset it, but if I didn't, it would send that e-mail every night.

For the first year, the thief was apparently on a different ISP, so standard SMTP server security (you can't send e-mails through an ISP's SMTP server that you are currently not connected through) blocked all of those e-mails. But then the thief got the same ISP as me (a big US cable internet provider. Name rhymes with Bombast) and those messages started getting to me.

And, of course, e-mail headers include IP addresses. So I knew the thief's IP.

And, I leave ssh running on my machines, at a nonstandard port. I wonder if the thief bothered to change that? Nope, sshd is running on my same nonstandard port, my account is untouched, I can log in to my own machine. My own machine that has been stolen. Yes, I still have sudo, so I have root. Yes, I have a VNC server installed on that computer, and I can start it quietly on the command line, so I even have VNC when I want to. Interesting.

Trevor

You could always set up an account at dyndns.org and run the IP address updater and at least you could log into your dyndns.org account and see what IP address it is using or last used (the dyndns updater runs in the background but may show up in your accounts log-in items, not at that computer right now so can't look to see)

Well, there is a school system where I live (I do not work for this one) and they just went to a 1:1 ratio with Macbooks for all highschoolers. We are talking over 6,000 Macbooks deployed this year. Our Apple SE is the same for the whole state, and he was telling us their security measures.

1) They have GPS tracking software, the second the computer goes online it updates its location

2) Locked down at the firmware level, so you can't boot to any external device or disk and erase and install

3) Ink tag system, if the ink tag is removed it creates a permanent water mark all over the laptop making it look obviously stolen.

I am friends with the IT manager over there I used to work with him years ago at a different job. I will try to touch base with him to find out the exact details. My Apple SE told me all about it a few weeks ago when he bought me lunch.

Keep your sensitive data in an encrypted disk image, then set up your work's network to synchronize mobile home directories, so every time you come back to your company it will synchronize your encrypted disk image. This also allows them to back it up. Of course the downside is you can't back up individual files because all you will be able to back up is a block of encrypted files. Also, never forget your encrypted disk image password, then your data goes bye bye.

Lojack works great for cars. Now they have it for laptops. http://www.lojackforlaptops.com/

@trevor

Another reason why Erase & Install is a good idea on a used Mac. You have no clue what the previous user did to it.

Somewhat related article back from around 2002:
http://www.ncc.up.pt/~rvr/SRS2.06/stolenIMac/index.html

The person used AppleScript and Timbuktu to recover his iMac. I think he was using OS 9, as he was referencing "System Folder" and "Startup Items".

Well, you could run this script at login, or set it as a folder action for a folder that a thief is likely to use:

I've commented out the display dialog, but you might want to remove the comment and set visible to true while testing.

Well, here's the thing, you should never have to worry about getting the data back. You should have a backup of it back at home base, so if it disappears, you never really lost it.

Regardless of how smart the thief is and their motivation (do they want to resell hardware and not care about the data, or are they interested in data and don't care about the hardware - two very different kinds of thieves), your potential losses come down to three things.
1. Value of data: Can be protected via backup.
2. Insecure release of data: Can be protected via encryption
3: Value of hardware: Can be protected by insurance

So, you should not have to worry about a lost or stolen laptop if you enabled all those protections. You can survive the loss of all three and also prevent a security breach, if you have prepared.

The whole idea of tracking and retrieving stolen laptops is just a bonus. It's nice if you manage to get it back. But you should not rely on it to either protect or recover a laptop or data. It's the least reliable option. Backup, encryption, and insurance will work for sure.

Also food for thought, thieves are not the only threat, laptop trackers cannot recover a crashed hard disk! But the three protections above, can.

actually, if you want something stealthier, then create a launchd agent that checks to see if the current IP is different from some approved list of IPs, and if so sends an email home using the unix mail command. this has several advantages over applescript: it doesn't invoke Mail.app or any other visible process, it's easier to secure and harder to find, and it's much less likely to throw an error that will alert a thief to its presence.

heck, if you want to be draconian, you could even use an agent like this as a time bomb, to automatically erase sensitive files at start up if the machine has a bad ip and the user can't authenticate. of course, if your kid accidentally starts up your machine while you're on a trip...

True, but getting unix mail to work is a bit trickier, and if you get the Applescript to work properly, you get not only the thief's IP address, but their email address too. It should be easy to track them down then!

not to be cynical, but my experience tells me that the real issue here isn't data or equipment. it's payback. I suspect many people would be completely satisfied if they could catch the thief, recover the machine, and then immediately trash it by bashing the thief over the head with it.

people, I tell you... :)

There is some value in that. If you believe in a judgement day, it may be easier to let go of something like the theft of expensive personal property and sensitive data. I think most people at least acknowledge the fact that there might not be a judgement day, in which case justice, or anything resembling it, can only be accomplished in the here and now.

Hmmm, living in the South has got me thinking about Religion more than I'd like. :(

I just installed iAlterU on my MBP, and it is pretty cool. It acts as a car alarm and takes a pic when triggered using the built in isight. It also will mail that pic to a specified email address next time it is online.

http://www.slappingturtle.com/home/

well, I'm not big on vengeance or on the idea of a Judgment Day. or even on the concept of personal property, really. if you really want to get yourself in trouble down there (or anywhere, for that matter) start pointing out to people that the basic principles of Christianity are almost identical to the basic principles of Marxism. sure to get you lynched in no time... ;)

I probably will, the next time some one looks at me funny and says "You're not one of those people that believes in Evolution, are you?" :D