An open-source approach to tracking stolen laptops
SEATTLE--Imagine your laptop is stolen.
Set aside for a second the likelihood that if it was you wouldn't be able to read this story and think instead about how you might go about tracking it down.
There are existing services, such as LoJack, that are designed to help find purloined laptops by identifying the IP addresses where they are subsequently used and through other assorted methods.
(Credit:
Adeona, a project being run out of the Computer Science department at the University of Washington, aims to give people a way to track stolen laptops while also providing the kind of privacy that commercial services may not offer.)
But according to a team of computer scientists at the University of Washington, the price you pay for utilizing such services is a loss of privacy--as well as a reliance on a corporate third party to take care of you.
That's why the team has come up with its own alternative, which it is calling Adeona, the name for the Roman goddess of safe returns.
The idea behind Adeona, according to Tadayoshi Kohno and Gabriel Maganis, who gave a talk about the project at the Gnomedex conference here Saturday, is to give people a method for safeguarding their laptops that relies neither on proprietary commercial software nor the centralized servers of the companies that provide such software.
Adeona, they said, is the world's first free, open-source laptop-tracking system, and one that can be installed by users themselves, and which doesn't require a corporate intermediary.
The team is also developing a version of its software for iPhones, though it isn't ready for public use yet.
To Kohno, the danger associated with commercial laptop-tracking services is that it's never possible to know for sure that someone at a company that makes such software wouldn't exploit the company's possession of your personal information--and access to what's on your laptop--for personal gain. Or, he said, that information could be subpoenaed in court cases.
To be sure, it's a very unlikely scenario, but Kohno--the faculty leader of the Adeona project--pointed out several recent instances where companies in possession of people's personal information were either forced to give it up in court, or where it was stolen by employees.
With Adeona, however, a user needs only install a piece of free, downloadable, software on their computer, and then make sure to make a copy of a credential key that the software provides and that they must keep on, say, a thumb drive, and which is required to track the laptop if it's stolen.
In essence, Adeona works very much like services like LoJack. But because the tracking doesn't go through central servers, Kohno suggested that there is more privacy and less reliance on corporate middlemen.
To be sure, the information you can get from Adeona if your computer does end up stolen will not necessarily lead you directly to it. It would most likely still take a bit of sleuthing, Kohno suggested.
But the software does use several different methods for laptop tracking, some of which might offer quick recovery.
The simplest is that it can broadcast the IP address where the computer is used, and the owner can use that information to contact law enforcement to help find the specific location.
Additionally, if the laptop is a Mac--at least one with a built-in camera--the software directs the camera to take a picture every 30 seconds or so. This means that the owner--if he or she has the credential key required to communicate with the laptop--can get pictures of whoever is using it. In some cases, they might recognize the person if, say, it was stolen by a neighbor, a co-worker, or someone else they know.
It also can sniff the SSID of the wireless network the thief is on, something that could be useful in tracking down the location of the computer.
Of course, the utility of Adeona, and any other laptop tracking software, for that matter, relies on the thief not being sufficiently tech-savvy that they can discover it and uninstall it. Further, as a FAQ on the Adeona site points out, the software can be abused by the owner to track, say, what a girlfriend or boyfriend is doing with the computer.
But in most cases, users who are wary of trusting their privacy to corporations may find that software like Adeona gives them an alternative they like.
My sense is that this software isn't for everyone and that it would require more knowledge of technology than the average laptop owner. But for those who have the requisite understanding, it might provide some comfort to know that they can turn to open-source software that doesn't require going through anyone else's servers.
Plus, you get the benefit of being protected by a Roman goddess. And when is that not a good thing?
Daniel Terdiman is a staff writer at CNET News covering games, Net culture, and everything in between. E-mail Daniel. 
The stolen laptop would have to know it is stolen to "broadcast" its IP and good luck broadcasting the IP address to where the person who lost the laptop is currently connected. Even on a campus network, the laptop won't likely be able to broadcast across the entire network. If thief and victim are on separate networks? Yeah, right.
You didn't post enough details to know for sure, but this sounds more like a feel good measure that will only work if the thief is a total moron and that the planets align just at the right time.
Seems fairly straightforward. A few of the commercial tracking products do essentially the same thing. The only difference is that Adeona is decentralized.
You can't broadcast across the Internet and usually can't across subnets. Where is this "broadcast" going and how does a second computer with the recovery tools get the message?
There is no way to verify that this is not being used to invade privacy.
Learn to read.
This is how LoJack works, the difference being that LoJack can be nearly impossible to remove if it was purchased with a new computer. They have integrated LoJack with the BIOS of some new laptops so that it keeps installing itself on new OS installs. This one, being open-source and user installable could be removed by a simple OS reload. ...though in reality you'd hope your thief wasn't computer savvy.
So the question is - how is more privacy provided by your location data hopping all over the internet instead of at a central server? Even more importantly, can we rely on all the location data hopping around the internet being timely enough to even help you find your computer?
The answer, I guess, is encryption - except that I'm pretty sure encryption is something that close-source programmers know how to do, too.
Is it any surprise that Terdiman attempts to cover his ass from these kinds of questions with the typical "it's not for everyone" disclaimer. So, like many other OSS initiatives that aim to replace already commercially available solutions, it's just for the elite among us with the "requisite understanding..of technology". Somehow I don't buy this last statement. We're talking about a security tool that should have some pretty simple configuration and setup. I don't see what kind of "technical understanding" you would need, other than to explain why the tool can't find your laptop as quickly as the central-server-based solutions.
NO JOY... if thief does not have your OS level password
NO JOY... if thief does not attach to internet
NO JOY... if thief immediatel reformats harddrive and installs OS onto bare metal
NO JOY... if thief simply tosses laptop in trash (oh sure, there are no knuckleheads that nasty)
It is completely dependent on two things:
1. The True Crypt implementation has no exploitable flaws.
2. The passphrase is sufficiently strong
Otherwise you are not secure at all.
And any Mac owner who knows anything can easily set up their Mac to prevent the disk from being overwritten through a "reformat ... and install". RTFM, or even easier, boot from your installation DVD.
My only complaint about the software is that it is easy to uninstall. But, before you jump all over the developers, that is for a reason, while the software is still in beta form, and this "feature" is planned on being removed in the near future. You still need to get logged into the computer and be able to su or sudo to a priv'd account.
Overall, Adeona is at least equal to, if not better, than the commercial versions of the software out there. I do wish that people who didn't know what they were talking about would LEARN ABOUT and INVESTIGATE the software before making outlandish and irresponsible comments about a very useful program. At least read the FAQ on the UW site. Yeesh, people...
Okay, so you have anecdotal evidence on your laptop that it is tracking.. "something". You still haven't answered the biggest question that us ignorant nitwits have asked - how does the location of the laptop, and all those pictures, get back to the owner after it's stolen? There isn't exactly a magic internet out there for data to flow through without servers of some sort getting involved, though you and Terdiman wants us to think this. (yes, it's encrypted on "the internet" - so what's the internet, genius?)
Any Mac owner that knows enough to prevent booting from a system DVD (and no, it's not as straightforward as you think) also knows how easy it is to get around this "fix". There is a built-in reset on all Macs with this capability. If you don't know how to use the reset, any Mac authorized technician will be able to do it within about two minutes.
I would guess that your "overall" statement about Adenona comes from the same ignorance that you accuse other commenters here of. That is, of course, unless you have actually used some of the commercial equivalents and had your laptop stolen enough times to render an actual opinion. In that case, please accept my apologies on behalf of all us uninformed morons in this forum who don't read FAQs and accept them at face value.
Really, as inexpensive as laptops are today..... who would want to steal one, unless it's a super-expensive Alienware one? No one I can think of, not even professional criminals.
Same thing with bikes - make sure you keep it in your bedroom at night. Unless it's a cheap one like laptops are these days - you know, they don't ever get stolen, either!
For those lucky enough to be on a Mac, the Firmware Password Utility can be used to render your iBook/Macbook etc completely unusable in the event it does get pinched. Check it out.
I wouldn't want Fraus, the Roman goddess of treachery, watching over me.
PS: even tho the GPS would have to have a power source, couldnt there be a Little battery built in for that, and it charges when you charge the actual laptop battery. A gps would not require near as much power.
PS: even tho the GPS would have to have a power source, couldnt there be a Little battery built in for that, and it charges when you charge the actual laptop battery. A gps would not require near as much power.
- by seanlabs July 12, 2009 11:50 PM PDT
- there's another open source laptop tracker called Prey. I just switched to it from Adeona (now that open dht isn't working) and it works quite well. it works in windows & macs too. the url is preyproject.com by the way
- Like this Reply to this comment
-
(24 Comments)