How Tracking Down My Stolen Computer Triggered a Drug Bust | Hacker News Reader

How Tracking Down My Stolen Computer Triggered a Drug Bust

blog.makezine.com

110 pointsscottshea62 comments

It is nice to hear a story involving the police in which they're helpful and effective rather than spraying protesters/journalists/bystanders with pepper-spray.

If that's what you think of police you've been reading reddit too much.

There's also a bit of the man bites dog thing going on. Nice police: Normal, not news. Bad police: Very unusual, so news.

I think the fact that the police officer was so involved with updating the writer is what stood out to me. It is rare that we see/hear a detailed explanation of what police work entails and unless we ourselves are the one they are speaking with it might never happen.

When I saw the title, I wondered how getting your laptop stolen could get you busted for drugs.

I can only suppose that, while I don't expect the average cop is a jerk, I did reflexively expect the average cop story to feature one.

I'd rather lose the laptop but have full disk encryption and keep my data secure.

I have the best of both worlds. Turn my laptop on and it will automatically boot into Windows without even so much as a password prompt. From there I have Prey installed so I can track it.

I never use this Windows installation though and it contains no valuable/personal data. It's effectively a honey-pot operation system. I have a Linux installation on there too (my "real" os) which takes up the vast majority of the drive and uses full disk encryption. I insert a USB stick at startup which contains the boot partition+loader and boot from that.

I wrote it up here: https://grepular.com/Protecting_a_Laptop_from_Simple_and_Sop...

Nice. Has all this effort ever come in handy?

Nope. But then neither has my car insurance. ;) I've only been running this configuration for a little over a year anyway.

I speculate an ugly not-too-distant future: Mike crosses US border from Canada to US. Fancy government computers "lookup" Mike and flag his name because of suspicious posts on "hacker" news. Fun ensues, when agents discover hidden/encrypted partitions on computer. Computer impounded for further investigation. Mike has a bad day.

But thanks to full disk encryption, his data is still safe from agents snooping through his cat photo collection!

They just keep him in prison until he gives them a password.

Luckily he's not identified as a terrorist. Because those people are subject to extraordinary rendition and intense interrogation techniques, and detained without trial.

Maybe this is a valid case for "security through obscurity". If you don't publicly proclaim you're doing something like this, who knows to look?

Pair that with a slightly stronger form of data hiding by using TrueCrypt's hidden partition feature to encrypt the second OS partition. Just make sure not to ever boot into the honeypot os afterwards, or it could overwrite parts of the hidden partition. You can safely load the honeypot os by typing in the hidden password as well so that true crypt can load the proper partition boundaries.

I'll just overwrite that partition with random garbage and use the Windows honey-pot OS for the duration of my visit, restoring when I get home. Well I might. Or I might not. Plausible deniability anybody?

Once they decide to investigate further, you won't have time or ability to wipe out the drive.

The point is that they cannot distinguish the encrypted partition from random garbage.

Maybe it'd be safer to swap out the hard drive with a brand new one before crossing the border? :)

The random garbage will probably get you in deeper trouble than the encrypted data -- they'll think that it is encrypted data, and ask you to decrypt it. Since it's garbage, you won't be able to; and then... I'll leave the rest to you imagination ;)

Overall, it's probably better to just give them your encrypted data. If you're not doing anything illegal, you don't have much to worry about. In my case, my data consists of software projects, personal diary/e-mails, etc. Nothing incriminating.

In principle what they're doing is wrong (violating your privacy and searching you without a warrant), but in the long run it'll probably just save you time to comply. Unless you're doing anything illegal, giving them your data shouldn't really be a problem.

If they "accidentally" share / release NDA'd corporate data (never heard of this happening), you can always take them to court. Heck, you can even take them to court for searching you without a warrant.

"Heck, you can even take them to court for searching you without a warrant."

Not at a border crossing - at least not for a non-US resident.

Actually you can be searched by federal agents inside the US within 100 miles of any "edge" of the border, even if you are not crossing...

http://www.wired.com/threatlevel/2008/10/aclu-assails-10/

Thanks for the introduction to Prey. Just installed it!

So you shut down your computer (as opposed to suspending it) every time you transport your computer from home to office and vice versa etc?

What's so unusual about that? I almost never suspend my laptop.

I almost never shut it down. Probably only once a month.

Waking from sleep is faster and I don't have to re-open my applications and documents. Shutting it down would save a small amount of power but that's rarely an issue (I'd shut it down if I was flying somewhere).

Are there some benefits to shutting it down I'm overlooking?

With SSD, on OSX, it's pretty fast to reboot. Most OSes can now be tuned to boot very quickly; the big thing was getting rid of the BIOS for EFI I think.

If you suspend, you are vulnerable to reading decryption key from RAM (firewire, ram freezing). If you are doing full disk encryption, then only shutdown or hibernate are secure.

My encryption key doesn't live in RAM because I use TRESOR. It's hidden in the debug registers of my CPU. There is still going to be other sensitive information in RAM though which I wouldn't want to be accessed.

Absolutely. My previous laptop was a Macbook that I used to just suspend to RAM. When I decided to start taking my security/privacy seriously I decided I would start shutting down my machine when not in use. Even though TRESOR keeps my encryption key out of RAM, my RAM is still going to contain sensitive information when suspended. I can't suspend to disk because I've disabled swap. I did this because I use an SSD and wanted to avoid unnecessary wearing.

I suspected that I might be frustrated by having to boot up my machine every time I use it, because I'd become accustomed to suspend to ram. It hasn't turned out that way. It doesn't bother me at all.

How much slower is an encrypted partition? (SSD) - Anyone have benchmarks?

Modern intel CPUs have AES-NI which accelerate AES-decoding:

http://www.remkoweijnen.nl/blog/2011/03/11/aes-ni-benchmarks...

I had a similar experience that took place over the course of a single day in which I tracked down that thieves in real-time and confronted them in a parking lot. Instead of calling the cops, and since they had taken money and not an actual laptop, I had them give me collateral and gave them 2 weeks to give me money back in exchange, which they did after.

I actually did write up and submit a police report, but it was about 3 months before I heard anything from the police.

Lessons learned: (1) sometimes it's better to roll up your sleeves and do it yourself and (2) some (most?) people legitimately want to come clean.

If they had taken money instead of electronics, how did you track them?

I trailed one of them.

Too bad that some guy is going to spend years and years in prison over drug charges when he should really only be charged with theft but I guess the lesson is don't go stealing traceable devices when you're running a dope operation.

Seems more likely he accepted the laptop as payment for drugs. The original thief was smart enough not to turn it on, hence taking a couple days to show up.

In what way could that possibly be 'too bad'??

"Too bad that some guy is going to spend years and years in prison for provable murder when he should really only be charged with stealing candy"

Idiot gets caught and gets what he deserves. All is well.

Possession of marijuana and murder, two completely analogous things. I certainly hope all the people he victimized with his marijuana possession get compensated.

Great read.

I am going to make all my mobile devices hit a webpage on a few of my servers silently on bootup (if there is a web connection) so I would at least have that ip. Also embedding a hidden image into the browser about:blank (startup) page.

I wonder if you could install something on the BIOS as well in case they try and wipe the Operating System (which they really should do if they want to be safe).

Just use FDE; if the thief doesn't know the password everything is effectively wiped already.

That's how lojack works. You probably have it installed in your bios now.

No need to engineer this yourself: http://preyproject.com/ has open source anti-theft apps for most platforms.

As someone said in the article comments, if you liked that story, go watch:

http://www.youtube.com/watch?v=U4oB28ksiIo

      Defcon 18 - Pwned By the owner
      What happens when you steal a hackers computer zoz

Mostly agree with his conclusions, but for one. I didn't think Batman was all that great.

Oh Make Magazine, please put your "close this slide show" button on the upper right instead of the upper left. I'm conditioned to look for X icons to close out of modal windows on the upper right not the upper left. Thaaaaaaanks.

I have no way of minimizing your "toolbar" at the bottom of your web site either. Weren't you created by O'Reilly.com?

great story! A friend of mine got her iPhone stolen, Find My iPhone didn't render anything for days so she gave up on it and got another one. This kind of technology should be standard on any new device

It's surprising that apparently almost no laptop thief takes the time to wipe the laptops.

That's the first thing I would do if I were in a business like that.

They probably aren't really laptop experts & don't have the install disks either. But you'd figure the word would have gotten around by now that these things can phone home.

I have heard of muggers stealing cell phones and taking the time to demand the pass code as well, so they're getting smarter about it.

Great read and this brings me to ask what options there are for hard drive encryption on OSX?

OS X offers FileVault natively for full-partition encryption. There are also myriad 3rd party options.

EDIT: See larry's coment :o)

Pedantic note, it's actually full-partition encryption. The recovery partition and boot camp partitions, etc, are not encrypted.

Too true! My mistake, edited my comment to reflect this.

So it would still be possible for the thief to boot to the recovery partition and wack the encrypted partition. Clean machine but at least none of my data.

Is there a Boot Loader or Bios password type option to beven prevent the user from holding down 'Option' and selecting a boot device..

NOTE: Yes I know it is EFI, but everyone knows what a BIOS password is, I think.

>Is there a Boot Loader or Bios password type option to beven prevent the user from holding down 'Option' and selecting a boot device..

If they know to hold down "Option," chances are they also know how to open up the case and swap out the HDD.

Backup, encrypt, insure. It's the only way.

When Firmware Password is activated, you can't use other HDs without entering the PW.

There are ways around the fw password, so it's an additional layer against the uninitiated but probably won't help you much and can cause problems for legitimate users.

Don't those require going to an Apple store, officially, which gives them a chance to check serial # vs. stolen list? (It used to be possible by pulling the RAM, but on modern MBA's, the ram is soldered to the main board.)

Yup, just set a firmware password.

http://www.chriswrites.com/2012/02/how-to-set-the-firmware-p...

Oh, right, I seem to read a lot of trouble with FileVault and I should have mentioned that I have a MBP with 2x750GB striped using SoftRAID 4.3.3 as the driver. Obviously my superdrive is gone.

Brilliant story!

Idiot. Who leaves valuables in a car in Detroit? Are you not aware that the windows are all that keeps someone from popping the trunk?

Reply on news.ycombinator.com