"Back To My Mac" Catches a Thief

robipilot writes "Mac stolen, Mac comes online, owner connects using 'Back to My Mac,' owner takes picture of culprit, and voila, criminal caught. OK, it wasn't quite that simple, but here's an interesting story of using some built-in technology on the Mac to recover a stolen laptop."

Imagine

Thousands of peepholes for the guys in Cupertino to look through...

Re:Imagine

Presumably one must use a password.

Re:Imagine

Ah, yes. Very secure [slashdot.org] the Macintosh is.

Re:Imagine

Presumably one must use a password.

You could write a cronjob on the laptop to check an https "website" for a boolean value, and send pictures to the site if the boolean is set to true. Make it look like a weather applet for extra points.

Re:Imagine

in this case, the 'victim' had her IM automatically sign in whenever the laptop went online, and she got a call from a good friend, congratulating her on getting her laptop back. But the thing is, the laptop owner was paying '$99 a year' for the 'ability' from any 'mac' to sign in and control the computer from anywhere (including, taking a photo and sending it over IM)

now, you could have a an automatic program to upload to a web server, but in this case, the owner used a subscription service from apple to gain control of the camera remotely, and snap a picture, ironically, the laptop starts a timer , and he tried to raise his hand to obscure the camera, but apparently, the picture is taken too fast for a person to realize what's going on.

just the picture the cops said would have been useful in catching the crook (they would have given copies to the places that fence stolen stuff, and they'd call the cops while 'figuring out the value' of the goods before they knew what was happening... it's a crime to purchase stolen goods after all) but in this case, the person was an acquaintance of their roommate, so they went to the cops to tell then who had the stuff, before they had even fenced the goods.

so apparently, you should fence your stolen laptops without hooking them to the internet. (and with automatic wireless networking and people with open networks, that might be hard in some cities if you even turn it on)

Re:Imagine

Would Apple stand up to the NSA?

Well...this [nsa.gov] guide explains how to harden a Mac OS X system to NSA specs. I would also take issue with your description of Mac OS X as a 'closed source platform' as this [apple.com] link shows that a large chunk of OS X (particularly the lower level elements - yes, the GUI is closed, but things like FileVault are not) is, in fact, open source.

Re:Imagine

How long before the paparazzi start arranging for Macs to be "won" by celebrities or "given" to them as "thanks". For that matter how long before a stalker arranges such a prize/gift?

With this having been posted to Slashdot, Natalie Portman is going to wonder where all those Macs and cases of instant grits came from. ;P

Re:Imagine

You don't *have* to use the .Mac to do this, there are numerous different scripts people have made/thought of using the built in camera.

Taking iSight photos during invalid login attempts [macosxhints.com]
Take photos via cron every 5 minutes [blogspot.com]
Take a photo everytime the lid is opened [deography.com] (Includes all of his pictures.

Why do we... wtf is wrong with you?

We care because I have it on good authority that women often use their Macs after having just come out of the shower, a good workout, being smeared in grits, rolling in Jell-O, bathing in whipped cream, and/or while do a self-breast exam. That's why we care!

You act like you haven't had your domain sqatted on by Jenny's Personal Co-Ed Webcam Sexperience after missing a payment that one time that it happened to me.

Re:

(Score:0, Flamebait)

Ohhh, Okay... The girls can look, too.

Re:Imagine

Like most computers with built-in webcams, the MacBooks feature a prominent green LED that lights up when the camera is in use. This LED cannot be disabled in software. If Apple were actually spying on people with their computers' built-in cameras, someone would have noticed, fast.

Re:Imagine

The LED is probably sitting across the power lines to the camera. Camera has power = LED is on. there is no non-physical way to disable it.

Personally, I have Undercover installed on all my and my siblings laptops.

I wish the guy that wrote the command line tool (iSightCapture [macupdate.com]) to take photos would either release the source or make some updates. A video capture CLI tool would be awesome.

I'm thinking of writing my own poor man's Undercover using cron, bash scripts and curl. Attempt to curl a website which I have access to, all the website does is return a 1 or a 0. (Stolen, not stolen). If anything gets taken just update my website and next time my Mac connects to the net, it gets what it needs.

Re:Imagine

And, oddly enough, I have a .25" piece of tape which can defeat any malicious code anybody may have inserted.

Re:Imagine

here's a little poem i wrote entitled
"WHEN I STEAL YOUR LAPTOP"

When i steal your laptop
i'm going to use it offline
so i can harvest your personal info
with a data miner i have on my usb keychain
then i'm going to wipe the os clean
and change the mac address on your network card
and sell the fucker on kijiji
i'll meet you in the arby's parking lot
to sell you back your own machine
that you no longer recognize
because I put hello kitty decals on it.

A viola? Really?

I'm curious to know how would taking a picture of a musical instrument help in this matter...

Re:A viola? Really?

Because by using this technology violins was avoided.

Re:Rome was burning

I probably shouldn't...

The violin wasn't invented until many centuries after the burning of Rome. Nero did play an instrument, a cithra I believe it is called, and did consider himself to be quite a musician. (Oddly I don't recall any mention of his skill level in my studies, just that he was passionate and competed and organized competitions.)

Titicus (spelling?), the historian, was pretty clear in what Nero really did during the burning of Rome. He was much more effective than, say, FEMA. He rushed down, helped to fight the fires, gave shelter, and provided food at either a discounted or free rate. I'm not entirely sure if it was free or discounted and I lack the initiative to look this stuff up.

So, while the idea of a tyrant (which Nero certainly was) ignoring the plights of the people makes for great copy it just didn't happen that way. What did happen is that Nero used this fire to persecute the Christians but that was after the fire when the people were looking for someone to blame.

Anyhow... To the point... Err... Wait, no... I didn't have a point.

Re:A viola? Really?

No, you misunderstood. They were able to use the software with no strings attached.

Re:A viola? Really?

That's an awful pun. You should be ashamed of yourself, you've really lowered the tone in this thread.

Re:A viola? Really?

Come on. There's always time for a little off-beat humor.

Re:

If it were funny, sure, but the joke just fell flat.

Re:A viola? Really?

I thought it was rather sharp.

Re:

For whoever orchestrated that, would you all please stop droning on and on!
Geez I know I'm highly strung, but this is the pits!

Re:A viola? Really?

Yeah, people really need to learn how to better conduct themselves around here

Re:A viola? Really?

For good measure, just bar the original poster.

Re:

No need to be brass.

Re:

That is better then stringing him along.

Re:A viola? Really?

You should take a bow. That strikes a chord with me, no bars to use. No rest for the evil. And the finale! Sounds like the whole progression ended on a good note.

Re:A viola? Really?

Yes, but does it run C#?

(I don't know why I bother. Most /.'ers will probably not catch the musical reference anyway.)

their real occupation

Mr. Jackson said that Mr. Frias and Mr. Shahikian were arrested last year on a felony marijuana possession charge, but are not career criminals.

No, just career idiots.

Why take a snapshot?

At first, the photo application revealed only a smoky room and an empty chair, Mr. Jackson said, but then a man sat down. Ms. Duplaga, again using remote technology, typed in the command to snap a photo. When you take a picture with that computer, it shows a countdown, and when it does, this guy figures out whats going on, Mr. Jackson said. It all clicks for him, and he puts his hand up to cover the lens, but it was too late. She had already taken the picture.

If she could see him, why would she need to use the software to take a snapshot? Don't apple computers have Prnt Scrn or an equivalent button?

Re:Why take a snapshot?

I didn't realize that png format was considered "awkward." :-)

Re:

And using TinkerTool or other such applications you can change it to be:
PNG, PDF, TIFF, PICT, JPEG, JPEG 2000, BMP, GIF, PSD, CGI or TGA.

Re:Why take a snapshot?

You use CMD+SHIFT+3 to take a screen shot on a Mac. Then again, it saves it to a file on the desktop, and not to the clipboard.

Re:Why take a snapshot?

You use CMD+SHIFT+3 to take a screen shot on a Mac.

Macs are so intuitive!

Re:Why take a snapshot?

Its part of Photobooth, its to warn you its going to take a "flash" picture for icons or whatever. It flashes by turning the screen brightness up all the way and turning it white for a second. The countdown is an an aid to compose your pictures, I don't think stealth photos is quite what Photobooth is meant for.

Re:Why take a snapshot?

Actually, no. I did a little reading on Back To My Mac and it has nothing to do with the OS. It's an application that works through .Mac and uses IPv6, UPnP and one or two other technologies. It allows you to connect to your Mac no matter where it is located, but from the sound of it it is a finicky application. It only worked because the thieves had left the computer signed in to its .Mac account and had UPnP on their local router. It also means she either hadn't logged out or the computer was set to automatically log in, something that generally seems like a bad idea but in this case worked to her advantage.

Re:

Not having read the article, but inferring from ...

And, surprise-surprise, you are completely fucking wrong.

The Honeynet Project

did something like this in 2000. See p. 15 of this 3 MB zipped Powerpoint [honeynet.org].

See also P-p-p-Powerbook! [encycloped...matica.com] for a possible laugh.

Poetic Justice

I know, this being Slashdot we have to worry about the privacy issues, compare the Mac to somebody's Vista laptop, disparage the cops, fret about security in general, and not fail to point out that a viola is indeed a stringed instrument.

But there's just something so damned satisfying about imagining these two thugs being caught red-handed with the loot. There's the impression of the victim realizing that she may be onto something. Her "Now I've got you, you son of a bitch!" as the fatal snap takes place. The "Oh, shit" realization of the thief, probably followed by frantic thoughts of how he might go about flushing two widescreen TV's and assorted recreational electronics. The genuine gratification of being able to walk into the police station and say, "Here are photographs of the guys who ripped off our stuff, actually using some of our stuff, and we know who they are..." Perhaps then the THUD THUD THUD at the malefactors' door.

It's got all the elements of the classic cautionary tale, and just reading it should bring at least a brief and sarcastic smile to the face of anybody who's ever been robbed.

Mug shots

It was nice of those guys to stand in front of her computer and pose for her like they were in mug shots. It's almost like they knew they did something wrong! Oh wait...

Maybe I'm being stupid, but

the following point comes to mind. The owner of a computer was an employee at an Apple store and, according to the article, therefore knew how to use the "bells and whistles" of the stolen Mac. And yet she was able to take a photo of the guy using the laptop. Now, this suggests to me that she hadn't set a password on the laptop; otherwise how would the thief have been able to log in so that the iSight camera was activated?

It seems to me that the real idiot here was the owner of the laptop.

Re:

The thing is, most people haven't enabled a password to log into their computer or to wake it from sleep mode. It certainly is smart to have a login password, but the vast vast majority don't, and most also don't even realize that you [i]can[/i] have one.

Undercover

Undercover does this sort of thing. It transmits network information, screenshots, and pictures from Macs with iSights. http://www.orbicule.com/undercover/ [orbicule.com]

Phoning home not just for "them."

I was thinking about something like this for a while, and this is a practical example, albeit, with different technology.

Did anyone see the movie, with Patrick Stewart, "Safe House?" To make a long story short, he has to enter a password every day to ensure an automated system does not activate. If he ever fails to enter that password, the system assumes he's dead and will let loose damaging blackmail that keeps him alive.

Anyway, a system like that would be very cool for home users. A small "safe house" program that gets run at startup that prompts for a password and gives you a number of tries. If the password is unsuccessful, the camera is activated, and web cam photos are sent to a known server when the network comes up, along with sound as well. Possibly key strokes and new documents web traffic and sites. All this happens quietly, in fact, there is no feedback as to the password being unsuccessful after the second try.

This information, along with the IP address, can be used to identify the thief and recover the property.

Home Version

I run Ubuntu on my home PCs and changed the default login screen to list the users. I created a 'Guest' account and in it's description I put 'Password = 123qwe' (not the real password). The assumption is that a burglar , not knowing much about OS'es, will want to use the PC and will choose the easiest path to gain access. When they turn the PC on the login screen gives them a list of users and an option of choosing "Guest Account with the Password shown. All household users have been told to *never* use this account and why.

This 'Guest' account is CharRooted and has Firefox, IM and other Internet clients all on the desktop but that's about it. Under the hood it opens up SSH, VNC, Terminal Server and every other conceivable way of gaining access. It starts a script that every 30 minutes emails my Gmail account with IP address and connection information. Also, logging on to this account invokes a 'Nuke' scrip that will DBAN type wipe the system if I don't deactivate it within 7 days.

It's not a perfect solution but it has all the capabilities and features of the subscription tracking services that can cost hundreds a year and it's all pretty easy to setup. If any thief steals my PC and uses it to connect to the Internet I will know everything about their connection and have full access to the machine. If it's truly lost and I can't regain control after they login, it self destructs.

Now that I thinks about it, this should be a Ubuntu package or at least a HowTO.

-[d]-

Re:Privacy concerns

This is no different than any webcam. The fact that it is built-in and constantly connected physically is a problem, but it can easily be disabled [macobserver.com].

A short applescript could be make that would enable/disable the iSight with the click of a button. Hella easier than having to unplug a USB cable...less wasted motion and lord knows I hate having to do anything physical because I post on slashdot.

Step away from the tinfoil, man. Are you a little concerned that people can study your online habits because you broadcast that information over the World Wide Web? A webcam is a useful thing, and all useful things can be used or abused; that's a fact of life and there's no getting around it. So either put up with some security concerns or live your life in a padded room (though, admittedly, this will only mitigate security risks, not eliminate them...)

Re:

the TFA...this acronym redundancy brought to you by the makers of the NIC card and ATM machine.

Off topic - example of poor journalism

Mr. Jackson said that Ms. Duplaga did not wish to be interviewed. On Friday, no one answered the door at the beige colonial-style house on Ridgeview Avenue where she rents an apartment diagonally opposite a church. The neighborhood is on the edge of the city's downtown; in recent years, many of the prewar homes have been renovated.

Gee, anybody in White Plains want to have a go at tracking her down? Thanks to this superfluous info, you now know:

a) She lives on Ridgeview Avenue.
b) She's at the edge of the city's downtown.
c) Many of the homes in the area have been renovated recently.
d) She lives in a colonial-style house.
e) The house is diagonally opposite a church.

If that's not enough info:

One of the laptops was a Macintosh belonging to Kait Duplaga, who works at the Apple store in the Westchester mall and thus knows how to use all its bells and whistles.

Just tail her from where she works.

The only info in this that's actually relevant is the fact that she works at an Apple store, and that's she did not wish to be interviewed. The rest is either a reporter padding an article with irrelevant information, or attempting to indirectly violate her right to privacy.

Either way, very poor journalism.

Re:Off topic - example of poor journalism

His first draft containing her Social, Blood Type, City of Birth, and Mothers Maiden name was lost when his notebook was stolen.