[CNN] Stolen Laptops and lame 'solution'

reproduced under fair-use:

>                     PC, phone home
>
>                     Industry aims to stop
>                     theft of laptops
>
>                     June 10, 1997
>                     Web posted at: 11:45 p.m. EDT (0345 GMT) 
>
>                     From Correspondent Greg
>                     Lefevre 
>
>                     SAN FRANCISCO (CNN) -- Expensive, compact and
>                     frequently out and about, a laptop computer makes an
attractive
>                     target for thieves. 
>
>                     But the computer industry has devised some ingenious
ways to
>                     counter theft, including invisible software that
knows when the
>                     computer is in trouble. 
>
>                     "As soon as the thief plugs that machine into a phone
network, it
>                     will phone home," said John Livingston, chief
executive of
>                     CompuTrace Service. 
>
>                     The call goes to a Canadian office
>                     that in turn phones the cops. So far,
>                     it has a 100 percent recovery rate. 
>
======  100% of WHAT?  Systems with it installed which are stolen?   How
would you know what systems do NOT call in?  
It's like the question the clerk asks at the airport: "Did anyone put
anything in your luggage you don't know anything about?"

Now that the word is out, of course, the wily thief will eschew pluggin in
until the hard drive is reformatted and installed
with a clean OS.  As usual: the stupid will be caught.

>
> >                     The call goes to a Canadian office
> >                     that in turn phones the cops. So far,
> >                     it has a 100 percent recovery rate. 
> >
> ======  100% of WHAT?  Systems with it installed which are stolen?   How
> would you know what systems do NOT call in?  
> It's like the question the clerk asks at the airport: "Did anyone put
> anything in your luggage you don't know anything about?"
> 
> Now that the word is out, of course, the wily thief will eschew pluggin in
> until the hard drive is reformatted and installed
> with a clean OS.  As usual: the stupid will be caught. 

This has been discussed on this list before, about 1 year ago.  The 
Computrace software is installed on a place on the hard drive where 
DOS utilities like Fdisk and Format can not get at it.  This is the 
same as Diskmanager Version 7 or higher, Fdisk and Format will not 
remove this version of Diskmanager.

The Computrace software is configured to call the 1-800 number on a 
regular pre-assigned schedule and talk to the computers at Absolute 
Software.  If the notebook has been reported stolen the computers at 
Absolute will advise the subject unit to call back on a more frequent 
basis.  The Computrace software turns off all modem speaker 
functionality.

With all calls to a 1-800 number the calling number is reported to 
the call receiving site.  This is always the case and the calling 
party has no control over this feature, it just happens as the 1-800 
number owner is paying for the call.  As a matter of interest this 
type of business could not be based in the USA as it is unlawful to 
use the calling number information gained through 1-800 calls for any 
business advantage or use, including this one.  However, US LEAs have 
no problem cooperating with Absolute Software and they do cooperate.

I have no connection to Absolute Software other than I visited their 
web site and I have a pretty good idea how they perform their 
promises.  I have no idea on how to remove the Computrace program 
unless it is on a Seagate or Western Digital hard drive.  Both of 
these manufacturers make low-level format programs for their IDE 
drive products available on their web sites and a low-level format 
will remove Diskmanager and I assume Computrace.

I assume most notebooks which are recovered are found to be in the 
hands of a buyer rather than the person responsible for the actual 
theft.  But, the eventual buyer is indirectly responsible for the 
initial theft of the notebook.


Virtually

Raymond Mereniuk
Raymond@wcs.net

On Wed, 11 Jun 1997, Raymond Mereniuk wrote:

> This has been discussed on this list before, about 1 year ago.  The 
> Computrace software is installed on a place on the hard drive where 
> DOS utilities like Fdisk and Format can not get at it.  This is the 
> same as Diskmanager Version 7 or higher, Fdisk and Format will not 
> remove this version of Diskmanager.

Okay, so if format and fdisk won't get to it, then it must live in the
master boot record - (otherwise how would it run?)  Booting off a floppy
and running FDISK /MBR would wipe it.  If not, then a low level format
would.  If you lack the software for a low level wipe then a program that
zaps every sector of a drive including the MBR, and partition table would
fix it.  (If it lived on the boot sector than replacing it with the SYS
command would be possible.  If it lives in any other area, it can't
execute.)

Installing Linux with Lilo in the MBR would also zap it.  Can it work with
other operating systems?  Say NT, or Solaris x86, Linux, or OS/2?  It's
useless if someone can simply install a non-compatible OS.  If it still
works with other OS's, then it only runs durring the bootup processes.
Which means that you simply don't plug your modem on the phone line while
you boot up and that's that.  If it's only compatible with Win95 or DOS,
then you install NT or Linux, or Solaris, and that will bypass it.


[The other (unlikely) possibility is that it would live in the BIOS for
FlashBIOS machines, but this is not likely since if it were to go there,
chances are there would be bugs and incompatibilities between their
software and the BIOS that would damage the computer. ]
 
The 1st thing a smart theif would do is to remove the modem from the
notebook computer and sell it separatly.  That way until the sucker with
the stolen notebook buys and uses a modem, he's untraceable.  And he can
sell the modem to someone else.

> The Computrace software is configured to call the 1-800 number on a 
> regular pre-assigned schedule and talk to the computers at Absolute 
> Software.  If the notebook has been reported stolen the computers at 
> Absolute will advise the subject unit to call back on a more frequent 
> basis.  The Computrace software turns off all modem speaker 
> functionality.

What if the notebook HASN'T been reported as stolen?  Then this software
can be used to track the location of the notebook computer, and as such it
is a privacy intrusion device.  I don't want some piece of software, even
if it protects my computer from theft to report on where I am at a given
time.  It is none of Computrace's business.

As for the silent modem functionality, I can simply attach a phone monitor
on the line.  A simple $19 box from RadioShack that hooks up to a tape
recorder can be hooked up to a powered speaker.  If the theif hears the
notebook dial the phone, he'd know it's there.

In any case, I'm not as worried about notebook loss as I am about the data
on it, so having a good hard drive encryptor is more valuable to me than
losing $2K for a notebook computer.  I don't trust this hackish bit of
software, especially if it will keep tabs on my location when the thing
isn't stolen.

(And yes I have that same sentiment about the LoJack car transponder, and
the EZ-Pass toll paying system, and cell phones.  Each of these
technologies can report on your whereabouts and thus pinpoint your
location at any given time.  They're all invasion of privacy things that
the masses are suckered into buying for either protection or convenience.
Uncool stuff.  I'd rather get comprehensive theft insurance, and pay tolls
in cash. FYI: I do have a cell phone, but I keep it off so it can't
transmit anything when I'm not using it.  Of course toll boths take pix
of the licensplates that pass by, but that's something I've no control
over.)

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.|  Ray Arachelian    | "Boy meets beer.  Boy drinks Beer,     |./|\.
..\|/..|sunder@sundernet.com|        Boy gets another beer!"         |/\|/\
<--*-->| ------------------ |                                        |\/|\/
../|\..| "A toast to Odin,  | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die.     |.....
======================== http://www.sundernet.com =========================

-----BEGIN PGP SIGNED MESSAGE-----

In <Pine.SUN.3.96.970612114018.14283B-100000@beast.brainlink.com>, on
06/12/97 
   at 11:57 AM, Ray Arachelian <sunder@brainlink.com> said:

> Of course toll boths take pix
>of the licensplates that pass by, but that's something I've no control
>over.)

A pickup truck & a little mud takes care of that problem. :)

Quite often there are low-tech solutions to high tech problems. :)))

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBM6Ah9I9Co1n+aLhhAQH2cQP9GUpDZx8borufNFCVnm5OVssWjiJMs0f1
VS60LZIJj4mCZgDcEWBx0bvDo7txRcmZS0bWRgW3H0uSOeQbUyuYFiFEOxEYNjAJ
WOWbRzIMwdqyyeIHT73OqCYJLqya/L0fi48x3tF/eeWw56D8oWlZmyKPVso1fzXW
QmaM0JZxsR4=
=050N
-----END PGP SIGNATURE-----

On Thu, 12 Jun 1997 11:57:57 -0400 (EDT), you wrote:

>(And yes I have that same sentiment about the LoJack car transponder, and
>the EZ-Pass toll paying system, and cell phones.  Each of these
>technologies can report on your whereabouts and thus pinpoint your
>location at any given time.  They're all invasion of privacy things that

  I agree. That's why I like my solution to finding my stolen car
better. A cellphone, GPS, and a little bit of glue electronics. If my
car is stolen, I call the cellphonein the trunk (or inside body panel,
etc.) enter my secret code and it reads out the current locaiton from
the GPS until I hang up on it.

  Brian

----------------------------------------------------------------------------------
Brian C. Lane             http://www.eskimo.com/~nexus                      KC7TYU
------------------  96B9 C123 5C90 BECC  6A1F 7DC6 4F2B A26E  --------------------

At 01:39 AM 6/13/97 GMT, Brian Lane wrote:
>  I agree. That's why I like my solution to finding my stolen car
>better. A cellphone, GPS, and a little bit of glue electronics.

If the cellphone is turned on, it can be tracked. If it isn't, you can't
call it.

Nice try,

--Lucky Green <shamrock@netcom.com> PGP encrypted mail preferred.

  Put a stake through the heart of DES! Join the quest at
  http://www.frii.com/~rcv/deschall.htm

On Wed, 11 Jun 1997, Raymond Mereniuk wrote:

> This has been discussed on this list before, about 1 year ago.  The 
> Computrace software is installed on a place on the hard drive where 
> DOS utilities like Fdisk and Format can not get at it.  This is the 
> same as Diskmanager Version 7 or higher, Fdisk and Format will not 
> remove this version of Diskmanager.

There you go, assuming DOS is the centre of the universe again.
I haven't seen this, but there's a pretty good chance that reformatting
the hard disk as a Linux partition and installing LILO would clean
that nuisance right up.  (If it didn't, you could probably just
use your favorite disk editor to find the Computrace code and zero
it out.)

OC this is all above the means of the average laptop thief, but the
dedicated ones probably have a staff techie.

dave

-- David E. Smith, P O Box 324, Cape Girardeau MO 63702
(573)334-0950  dave@[clas.net | linuxware.com | ml.org]
PLEASE ensure your mailer acknowledges my Reply-To: hdr
Keywords: CPSR EFF ACLU DS6724 Delphi SF bureau42 Wicca
HWG Dilbert crypto Millennium Linux YDKJ PGP single! ;)

On Thu, 12 Jun 1997 07:50:49 -0500 (CDT), you wrote:

>On Wed, 11 Jun 1997, Raymond Mereniuk wrote:
>
>> This has been discussed on this list before, about 1 year ago.  The 
>> Computrace software is installed on a place on the hard drive where 
>> DOS utilities like Fdisk and Format can not get at it.  This is the 
>> same as Diskmanager Version 7 or higher, Fdisk and Format will not 
>> remove this version of Diskmanager.
>
>There you go, assuming DOS is the centre of the universe again.
>I haven't seen this, but there's a pretty good chance that reformatting
>the hard disk as a Linux partition and installing LILO would clean
>that nuisance right up.  (If it didn't, you could probably just
>use your favorite disk editor to find the Computrace code and zero
>it out.)
>
>OC this is all above the means of the average laptop thief, but the
>dedicated ones probably have a staff techie.

  I think that a simple fdisk /mbr should take care of the problem.
The drive is booted from the master boot record. There is no way
around this without a bios change. LILO overwrites the MBR with the
LILO program to boot Linux (and other OSes on the system) so it too
would defeat their software.

  Doesn't sound like too much of a solution when you're dealing with
even a slightly knowledgable thief.

  Brian

----------------------------------------------------------------------------------
Brian C. Lane             http://www.eskimo.com/~nexus                      KC7TYU
------------------  96B9 C123 5C90 BECC  6A1F 7DC6 4F2B A26E  --------------------

-----BEGIN PGP SIGNED MESSAGE-----

In <Pine.LNX.3.96.970612074651.9609A-100000@bureau42.ml.org>, on 06/12/97 
   at 07:50 AM, "David E. Smith" <dave@bureau42.ml.org> said:

>On Wed, 11 Jun 1997, Raymond Mereniuk wrote:

>> This has been discussed on this list before, about 1 year ago.  The 
>> Computrace software is installed on a place on the hard drive where 
>> DOS utilities like Fdisk and Format can not get at it.  This is the 
>> same as Diskmanager Version 7 or higher, Fdisk and Format will not 
>> remove this version of Diskmanager.

>There you go, assuming DOS is the centre of the universe again. I haven't
>seen this, but there's a pretty good chance that reformatting the hard
>disk as a Linux partition and installing LILO would clean that nuisance
>right up.  (If it didn't, you could probably just use your favorite disk
>editor to find the Computrace code and zero it out.)

>OC this is all above the means of the average laptop thief, but the
>dedicated ones probably have a staff techie.

I would imagine that some enterprising programmer will write a program
that removes this crap from the users HD.

- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.amaranth.com/~whgiii
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html                        
- ---------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: cp850
Comment: Registered_User_E-Secure_v1.1b1_ES000000

iQCVAwUBM5/0XY9Co1n+aLhhAQHApwQAyhPjOudMdxooIJn0u6eHar6W9GN2UHCq
T1kOkfBmbtPk4AQ7R5UB7tuZCrJX8rsZuk8q8pWVQ/lKvVSAPJ/8LTBNWdilHQlC
3pvglNXOIRvNKmJPHThCdnTY0yuwnHLuk7BuhDx/tPS1yMZtdEc1D8Zvu2C1rJBp
mOffghXFm0o=
=WSu3
-----END PGP SIGNATURE-----

At 10:22 AM -0700 6/11/97, Raymond Mereniuk wrote:

>I assume most notebooks which are recovered are found to be in the
>hands of a buyer rather than the person responsible for the actual
>theft.  But, the eventual buyer is indirectly responsible for the
>initial theft of the notebook.

I could not disagree more.

The buyer of some item, be it a laptop or a bicycle or a painting, is not
"responsible" in any way for actions taken by others at earlier times,
unless he speciffically commission a theft (as happens in some markets).

It may be that the buyer of some item may have taken away from him, as the
item was in fact stolen property within some reasonable time window (*),
but this has nothing whatsover to do with the buyer of some item being
"indirectly responsible" for the theft.

(* I mention "reasonable time window" because there are moves afoot to try
to have 50-year-old purchases of art negated, because of allegations of
Nazi looting.)

--Tim May


There's something wrong when I'm a felon under an increasing number of laws.
Only one response to the key grabbers is warranted: "Death to Tyrants!"
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1398269     | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."