<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:D="DAV:" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:Z="urn:schemas-microsoft-com:" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<title>Re: [Dataloss] [ekmi] Re: fringe: Open source laptop tracking</title>
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>We may be missing the bigger point, as security is both
technical as well as behavioral.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Yes, it is obvious this technology in its current state can
easily be undermined by a determined attacker. But will it be a deterrence?
Will it affect the casual laptop theft? Will it give pause to people
buying questionable laptops at the flea markets or from shady vendors?
Will it make laptops less attractive targets to thieves looking for any means
of a quick buck? Can it effect the resale economy of such ‘hot’
merchandise? Will it give employees a second thought about swiping extra
equipment for personal use? Maybe. This technology increases the risk
of being caught. If so, it will have an overall positive benefit.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>We all know an effective security program does not need to
provide real security. We have locks on our home doors which are a joke
to anyone who has the intention of getting into your house. But it does help.
It thwarts opportunistic attacks where the thief is looking for the path of
least resistance to reach their goals. If your house is locked and the
next house is not, then there is a good chance your neighbor will be the one victimized.
<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>I see this technology, which could be evolved into something
great eventually, as similar to engraving laptops with “Property of XXX
company” or something obviously not easily resold or used in the open.
It is a deterrent and lowers the target-attractiveness factor. I don’t
have any data handy, but last I read, most laptops are not stolen for their
data. Rather it is a hardware itself which is valued. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<p class=MsoNormal style='text-autospace:none'><b><span style='color:black'>Matthew
Rosenquist</span></b><span style='color:#1F497D'><o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='color:black'>Security
Strategist</span><span style='color:#1F497D'><o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='color:black'>Intel
Corporation</span><span style='color:#1F497D'><o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><u><span style='color:blue'>Matthew.Rosenquist@Intel.com</span></u><span
style='color:#1F497D'><o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:none'><span style='color:black'>(916)
356-4882</span><span style='color:#1F497D'><o:p></o:p></span></p>
</div>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
dataloss-bounces@attrition.org [mailto:dataloss-bounces@attrition.org] <b>On
Behalf Of </b>Brian Honan<br>
<b>Sent:</b> Thursday, July 17, 2008 5:56 AM<br>
<b>To:</b> 'Brian Krebs'; 'Allen'; 'Arshad Noor'<br>
<b>Cc:</b> 'security curmudgeon'; ST-ISC@MAIL.ABANET.ORG; 'ekmi';
dataloss@attrition.org<br>
<b>Subject:</b> Re: [Dataloss] [ekmi] Re: fringe: Open source laptop tracking<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:blue'>Brian</span><o:p></o:p></p>
<p class=MsoNormal> <o:p></o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:blue'>As has been pointed out this type of technology does nothing to
protect your data and provides some recourse to recover the physical device if
and when it connects to the Internet. Indeed in some countries you may
have to carefully consider the legal and privacy implications of using such
technology. The Data Privacy laws in some European countries
may restrict the use of such technology - this is something that I have
yet to research into further though. In a similar vein some police forces
may not be able to act on the information you provide to them.</span><o:p></o:p></p>
<p class=MsoNormal> <o:p></o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:blue'>The most useful application I have seen for this type of technology
is recovering computers stolen by employees. I know of one company
that installed similar technology onto laptops given out to employees and
as a result saw the number of "lost laptops" reduce. They
discovered that staff were reporting their laptop had been stolen or
lost but in actual fact were keeping the laptop for their own use. Of
course this measure may only be effective until employees realise how the
company is tracking their laptops and simply follow some of the steps outlined
in an earlier email to remove the software from it.</span><o:p></o:p></p>
<p class=MsoNormal> <o:p></o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:blue'>Regards</span><o:p></o:p></p>
<p class=MsoNormal> <o:p></o:p></p>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:blue'>Brian<o:p></o:p></span></p>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:blue'>BH Consulting</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div class=MsoNormal align=center style='text-align:center'>
<hr size=2 width="100%" align=center>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><b><span style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'> dataloss-bounces@attrition.org
[mailto:dataloss-bounces@attrition.org] <b>On Behalf Of </b>Brian Krebs<br>
<b>Sent:</b> 17 July 2008 04:18<br>
<b>To:</b> Allen; Arshad Noor<br>
<b>Cc:</b> security curmudgeon; dataloss@attrition.org; ekmi; ST-ISC@MAIL.ABANET.ORG<br>
<b>Subject:</b> Re: [Dataloss] [ekmi] Re: fringe: Open source laptop tracking</span><o:p></o:p></p>
<div id=idOWAReplyText16810>
<div>
<p class=MsoNormal><span style='color:black'>My big question is, assuming for a
minute you can actually zero in on the person who stole your machine (what
about crowded living areas, like apartment buildings), what is the likelihood
you'll be able to get the police to knock on someone's door with that evidence?</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><span style='color:black'>Doesn't seem all that bloodly
likely to me. Seems like it increases the chance that people running this
software will confront the thief on their own and possibly put themselves in a
very compromising situation.</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
</div>
<div id=idSignature78033>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'>Brian Krebs</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><a
href="http://www.washingtonpost.com/securityfix">www.washingtonpost.com/securityfix</a></span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>703-469-3162
(w)</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>703-989-0727
(c)</span><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
</div>
<div>
<p class=MsoNormal><o:p> </o:p></p>
<div class=MsoNormal align=center style='text-align:center'>
<hr size=2 width="100%" align=center>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><b><span style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'> dataloss-bounces@attrition.org on behalf of
Allen<br>
<b>Sent:</b> Wed 7/16/2008 11:01 PM<br>
<b>To:</b> Arshad Noor<br>
<b>Cc:</b> security curmudgeon; ST-ISC@MAIL.ABANET.ORG; ekmi;
dataloss@attrition.org<br>
<b>Subject:</b> Re: [Dataloss] [ekmi] Re: fringe: Open source laptop tracking</span><o:p></o:p></p>
</div>
<div>
<p><span style='font-size:10.0pt'>Arshad,<br>
<br>
I don't think you analysis, which I agree with, goes far enough.<br>
<br>
1) Steal laptop.<br>
2) Remove battery.<br>
3) Remove HD.<br>
4) Use HD cloning software such as Apricorn - hardware and software<br>
only $40 - and clone to any HD that is laying about<br>
5) Mount clone as USB attached to a desktop<br>
6) Attach old HD as USB attached and wipe old HD with DBAN or<br>
similar tool<br>
7) Use Aloha Bob or equivalent to selectively migrate OS and basic<br>
productivity software such as Office from clone.<br>
8) Remount HD in laptop<br>
9) Sell the sucker.<br>
<br>
Best,<br>
<br>
Allen<br>
<br>
Arshad Noor wrote:<br>
> Am I the only one who believes that an attacker (who is after<br>
> the data) with half-a-brain is going to make sure that the first<br>
> time they boot up a stolen laptop, they're NOT going to put it on<br>
> the internet, and they're going to disable any radio for wireless<br>
> communications. (Laptop companies have to provide an external<br>
> radio switch I imagine so that there is confirmation of the radio<br>
> being OFF inside an airplane - I'm not sure how the iPhone gets<br>
> away with a software switch since we all know software can be<br>
> buggy and the radio may not go off despite a visible indication<br>
> that it is off - but that's another discussion.<br>
><br>
> Alternatively, the attacker could boot off of a Linux CD and then<br>
> copy the entire hard-disk contents (or what was most interesting)<br>
> and then blow away everything on the hard-disk to reclaim the HW.<br>
><br>
> In both cases, they have the HW and the data without anything<br>
> "calling home" to give away GPS positions or IP addresses of the<br>
> machine. So, why do people think that this is an effective<br>
> counter-measure against data-theft? How long do they anticipate<br>
> this to work? And with which type of attacker? I've read examples<br>
> of attacks that go beyond anything most IT developers - or even<br>
> security developers - are capable of in the marketplace today, so<br>
> who is this expected to deter? The guy who broke into your car<br>
> to get the hub-caps and radio, but got the laptop instead?<br>
><br>
> Very puzzled.....<br>
><br>
> Arshad Noor<br>
> StrongAuth, Inc.<br>
><br>
> security curmudgeon wrote:<br>
>><br>
>><br>
>> ---------- Forwarded message ----------<br>
>> From: "Rob, grandpa of Ryan, Trevor, Devon & Hannah"
<rMslade@shaw.ca><br>
>><br>
>> I know some people who are going to be really upset by this, but<br>
>> personally, I'm delighted:<br>
>><br>
>> Researchers at the University of Washington and the University of<br>
>> California, San Diego, launched a new laptop tracking service, called<br>
>> Adeona, that is free and private. Once downloaded onto a laptop, the<br>
>> software starts anonymously sending encrypted notes about the<br>
>> computer’s whereabouts to servers on the Internet. If the laptop
ever<br>
>> goes missing, the user downloads another program, enters a username<br>
>> and password, and then picks up this information from the servers, a<br>
>> free storage service called OpenDHT. (The Mac version of Adeona
even<br>
>> uses a freeware program called isightcapture to take a snapshot of<br>
>> whomever is using the computer.) Adeona provides the IP address that<br>
>> it last used as well as data on nearby routers. Armed with that<br>
>> information, law enforcement could track down the criminal. Because<br>
>> Adeona ships with an open-source license, anyone can take the code and<br>
>> improve it or even sell it. The researchers say they’re hoping
that<br>
>> software developers will build all kinds of new features such as<br>
>> Global Positioning System-aware tracking systems for new platforms<br>
>> such as the iPhone. Later this month, the Adeona team will give a<br>
>> technical presentation at the Usenix Security Symposium in San Jose.<br>
>><br>
>> <a
href="http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9110128&taxonomyId=17&intsrc=kc_top">http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9110128&taxonomyId=17&intsrc=kc_top</a><br>
>><br>
>><br>
>> <a href="http://adeona.cs.washington.edu/">http://adeona.cs.washington.edu/</a><br>
><br>
> ---------------------------------------------------------------------<br>
> To unsubscribe from this mail list, you must leave the OASIS TC that<br>
> generates this mail. Follow this link to all your TCs in OASIS at:<br>
> <a
href="https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php">https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php</a><br>
><br>
_______________________________________________<br>
Dataloss Mailing List (dataloss@attrition.org)<br>
<a href="http://attrition.org/dataloss">http://attrition.org/dataloss</a><br>
<br>
Tenable Network Security offers data leakage and compliance monitoring<br>
solutions for large and small networks. Scan your network and monitor your<br>
traffic to find the data needing protection before it leaks out!<br>
<a href="http://www.tenablesecurity.com/products/compliance.shtml">http://www.tenablesecurity.com/products/compliance.shtml</a></span><o:p></o:p></p>
</div>
</div>
</body>
</html>