Hacker News new | past | comments | ask | show | jobs | submit login
Why you don't steal from a hacker. (infosec20.blogspot.com)
272 points by gregcmartin on Aug 12, 2011 | hide | past | favorite | 152 comments



Glad the person got their Mac back, but why does this story and ones like it always end at the recovery of the property? Could we get an update on the punishment of the criminal? I'd like to know what kind of repercussions the criminals suffer--do they get prosecuted? I'm just curious if these software tracking systems have been used in court as evidence to convict any of these criminals.


I was wondering that too. I was thinking that perhaps this guy had gone and screwed around with his social network given the facebook screen cap at the end. Of course if someone steals your laptop, and using software you've installed you keylog all their secrets and you use their credit card to buy themselves a hundred pizzas each from 10 stores around town, that would be a bit much perhaps.

I know from experience (not me of course, but that of some kids who stole some stuff from a neighbor) that juveniles who are caught and convicted of petty theft basically get a slap on the wrist, a stern warning about what will happen if they do it again, and sent home.


I'm not sure if it's that easy for the victim to find that information. My family was robbed several years ago and while the police eventually reported that they caught the perps, that was all of the detail they left. Similarly, my girlfriend had credit cards stolen once and neither the police nor the credit card company gave any information except that they had found the people who stole the card. Perhaps this discretion is to prevent people from attempting vigilante followup actions?


I'm almost certain that (in the States at least) that information would be public record. After all, the person has to be arraigned and go to trial. Police reports are almost always public information, even reports that don't involve you personally. You just have to go to the station sometimes.


The police aren't going to report to you every step of the way, (why would they?), but that does not mean you can't find that info out. You could even talk to the police officers involved, they would be happy to tell you, if they know.


In the US, the perp probably always pleads guilty, so there ends up not being a trial where the victim would be able to learn more about the case.


  The story you have just heard is true. The names were changed to
  protect the innocent.
  
  On August 12th, trial was held in Department 98, Superior Court of the
  State of __London, in and for the County of __London. In a moment the 
  results of that trial.
  
  Shillip Herbert Keaver was tried and convicted of robbery in the first
  degree - five counts - and received sentence as prescribed by
  law. Robbery in the First Degree is punishable by imprisonment for a
  period of not less than five years in the __London penitentiary. Because
  of the viciousness of the suspect, it was decided that the terms would
  run consecutively.

  You have just heard "DragNet," a series of authentic cases
  from official files. Technical advice comes from the
  office of Chief Constable, Scotland Yard, __London.


This can't be the same person. The laptop was stolen from his house while he was away. This would mean it would be a burglary charge, not robbery.


This is a parody of an old TV show called "Dragnet". Each episode ended with a dramatic narrator reading something 99.9% similar to the comment you replied to. Same fixed format, everything.

Kids these days :) :)


still a burglary is when stuff is stolen when no one is there (as in the fine article). A robbery is when something is stolen from your person (like you are help up at gun point for you wallet).



the police probably haven't done anything yet


I don't think there is a need to use the tracking software to build a case against the burglar. They caught him with stolen property and have fingerprints. No need to go high-tech here.


Maybe the criminal was a minor. At least in my country (Bolivia) if he is a minor almost nothing is done, he'll walk out free. I'm sure this is not the case in every country.


Sorry I wasn't implying that the software I used made me a hacker, that is simply just my profession... I use the term very widely to be someone who codes, pentests, reverses malware or jailbreaks iphones...


Yes, I'm saddened by all the responses here making the basic logical fallacy of affirming the consequent.

It seemed perfectly clear to me that you meant that a hacker is going to have some means of finding his stolen laptop rather than that using Prey makes you some kind of hacker.

And to the criticism that you are running a product, that's ridiculous as well. Do we all solder our own motherboards? Devout Not-Invented-Hereism isn't a prerequisite for being a hacker, and in fact it probably makes you much less effective of one.


It's sad that many of the people who say the word "hacker" means all these positive and inclusive things are often the same people who lambast someone for actually using the word that way to refer to themselves.

Make up your minds. Is it the inclusive, "explorers of technology" meaning where it's more about curiosity and open-mindedness than skill level, or is it your little l337 boys club badge of honor?


It's highly desirable to be called a genius, but in general people calling themselves geniuses are looked down upon.

I think among people who do use the word "hacker" to mean someone skilled with computers, it's considered poor form to call yourself a hacker but high praise to be named a hacker. Eric Raymond wrote long screeds about this way back in the 90s when people still gave a damn about him.

Personally, I call somebody who is skilled at breaking systems a hacker. The guy who discovers how to Man-in-the-middle attack an SSL connection is a hacker. The morons in black trenchcoats and leather fedoras who then download a .EXE to automatically do just that and harvest passwords at Starbucks... are fucking scum of the earth script kiddies.


But is "hacker" really analogous to "genius"? I mean, we have a bunch of annual hacker conferences. If "hacker" isn't something you can call yourself, who is going to all of these things?


Joke answer: Have you ever been to Def Con? People who wear utilikilts and dyed mohawks unironically probably have no qualms about calling themselves hackers, deservedly or un-.

Real answer: I did actually attend Def Con this year, with the intent of learning about hacking, possibly from hackers. I wouldn't call myself a hacker, I just went because I wanted to learn about the subject. Really the whole topic is not something I worry much about... in my line of work we don't compliment people by saying "he's a good hacker", we just say "he's brilliant" or "she does really great work", which to my mind is a better and less ambiguous compliment.


>And to the criticism that you are running a product, that's ridiculous as well.

Personally, it's not so much using a product, but 1) giving access to a third-party (the Prey server admins) to his laptop and 2) being limited instead of having complete control.

Prey just seems a poor solution if you know what you're doing. For non-computer geeks is excellent, though.


That's a value judgement. As a hacker you can't do everything.

Prey is a polished product that you can trust to work. If you are into this sort of thing, certainly you can achieve more functionality and better security by rolling your own, but I don't consider it a prerequisite to hackerdom anymore than soldering your own motherboards. How often do you expect your laptop to be stolen anyway?


The thing is: rolling my own takes less time than installing Prey. Of course, it won't have bells and whistles, but it'll be much less limited.


I'm sorry but that claim has no credibility with me. Setting up the proper cron jobs, server-side components, and verifying that everything is working under a variety of circumstances will take much more than the 5 mins it takes to install Prey.

Just because you've already done it and you have a pre-rolled solution doesn't mean you didn't invest that time, and don't fool yourself.


You only need to set up a cron job to create a reverse SSH tunnel into your home server. That way from your home server you could SSH into the machine, no matter where it is.

It's one or two lines of configuration.


If it doesn't work when you really need it though, you can't fix it.


This is why I have file vault + password screensaver on my MacBook Pro + insurance. I'd sooner have to wait a few days to get a new laptop than rely on: a) the user not instantly formatting the computer, b) prey finding my laptop, c) the police doing something about it.


... why not do exactly that; but ALSO have a guest account, and prey installed. (Also re: not instantly formatting; put firmware and/or hard drive passwords on to slow them down -- most thieves are not computer experts)

I think you under-estimate the speed and hassle of dealing with insurance.

Also most insurance has a deductible. You're still out typically hundreds of dollars.

I had a macbook pro of one of our employees stolen. We used prey to get it back, with assistance from the police. Yes we have corporate insurance, yes we backup our data; but we were still very pleased to receive our stolen property back.


If you have a guest account you can't encrypt your whole harddisk. And if my laptop gets stolen I don't care about the money but about my data falling into the wrong hands.


Set up a honeypot account 'm[ou]m', with a visible password hint to the tune of 'Dammit m[ou]m, THE PASSWORD IS "Susan"'.

Make sure it has no access to the filesystem outside of its homedir, and you could even set some login items to watch for net access and push a notification.


The honeypot account still needs access to the operating system, and thus to the harddisk password if you use full-disk encryption.

Full disk encryption is more or less default for most Linux distributions and OS X Lion. In addition, it's the only sane solution if you want to securely encrypt your data.


the word 'hacker' has been diluted to a new low

first to 'somebody who can write a web app', to now 'somebody who can install software'


Reading comprehension fail. Just because the title asserts that the poster is a hacker doesn't mean that the post justifies why he is one. If I write something about "Why you don't steal from a Texan" I'm going to talk about you digging lead out of your derriere, not about where I was born.


In fact, he's updated his post to reflect this kind of comment:

"Updated: to quell the comments, I did not choose the title to imply downloading tracking software is hacking, I am a hacker by profession and have been all my life."


If the title was "You don't steal from a hacker," you might have a point, but "Why you don't steal from a hacker" implies the reason for that is exposed in the post.


A story entitled: "Why you don't steel from a Texan" would generally entail the thief getting shot. Shooting a thief doesn't make one a Texan, but it is the kind of thing a Texan would do. (Gross generalization for illustrative purposes only.) In the same way, having a software program installed on one's computer in case of theft does not make one a hacker, but it is in the spectrum of things a hacker might do. So I think that the title is plenty accurate.

That said, the title does prime one for an epic tail of recovery and revenge involving spoofed IP addresses and total identity theft. This story is a little bit of a letdown, but I doubt he meant for it to get the attention it got.


Yeah, if you dig through his blog, he has some really cool model train stuff.


hilarious!


MIT hackers back in the day had quite a lot of crossover with model train enthusiasts.


From his LinkedIn profile: "Greg Martin is a recognized Information Security professional with over 12 years experience and considered an industry expert in Network Security and SIEM technology." Sounds like the word hacker could very well apply. I think he used it in relationship to his profession, not to his installation skills.


I've read some really great stories in which real hackers used SSH to log in to their stolen computers, install key loggers, and custom tools. This obviously isn't one of those stories though.

I think it is great that the average person can now do all those things from a web app. It is funny though that they still consider themselves to be hackers because they can use that web app. Another example of misuse of the term hack that I see all the time is when people use someone else's logged in Facebook session and then claim they "hacked their Facebook" because that person left their session logged in. Silly...


Is this one of the example you are looking for? http://gizmodo.com/5717309/what-happens-when-you-steal-a-hac... (talk from Def Con '11)


The thief did more "hacking" by using the OSX install CD than him.


Semantics is one of the least interesting things to argue about on the Internet.


No it isn't! /python

;0)>

Sorry couldn't resist.


...says a guy who submits non-hacker news to Hacker News. =)


Next would be "Somebody who can use a computer"


It's amazing how when big media releases a story about "hackers ruining America", people come out of the woodwork saying "actually, the term for someone who practices forced electronic entry is 'cracker', and 'hacker' just means someone who writes code", but when someone uses it that way, the HN post fills up with comments about how the term 'hacker' has been diluted.

PICK ONE, GUYS.


The reason that people are annoyed is because the title of the article is misleading. Yes, this guy may be a "hacker" in the sense of the word that we all like to use (he's a programmer).

The issue is that the article is titled "Why you don't steal from a hacker". This is not actually an appropriate name for the article, because it's not the writer's status as a hacker that leads to the final result. It is the writer's position as an application user that leads to the final result. In that sense, this article be should called, "Why you don't steal from someone that knows how to use an application to track their stolen laptop". Hence, by replacing the the "application user" with "hacker" you are diluting the meaning of hacker that everyone here loves to use. I'm not trying to be critical, just explaining why people are stating this and that they are attempting to express a consistent stance. You may associate this type of activity with a hacker, but understandably, it is not what you'd come up with when you attempted to define a hacker.


I think the headline implies that a hacker/security professional is more likely to have something like prey installed than, say, someone like my non-technical mom.


I think that's also a very reasonable point of view. However, at the same time, I its also reasonable to say that there is a group that could include people we would consider non-hackers that use this type of application (e.g., those with any sensitive/private information on their computers). Maybe they wouldn't use the exact same application, but something to track their laptop may be of use. Then again, maybe those people can afford a system with a built in tracking devise that can't easily be removed (requires more than just wiping the system). Meanwhile, hackers are left to add a "hack" to their computer that can do the same thing.

Honestly, I see your point, and both sides. I've just met a few people that have a similar service installed onto their phones, and I certainly would not call them hackers. Similarly, if someone told me they had this installed on their computer, I wouldn't think, "Oh, cool! S/he's a hacker!" On the other hand, if I saw someone starting "Learn Python the Hard Way" I _would_ think, "Oh shit, s/he's becoming a hacker!". Anyway, I don't really care too much. You do make a good point though. In general, a hacker might be more likely to aggressively try to track you down :)


Well-argued!


I care more about the safety of my data than the safety of my computer, so I have FileVault full-drive encryption turned on. I don't think a thief could log into my computer without wiping the drive, which would wipe Prey if I had it installed. So I'm not going to bother installing it.


Yes, the new filevault does make things tricky in this sense... however its just a matter of time til someone improves prey project to install to the new OSX Lion un-encrypted install (the one your system boots to, and prompts you to enter your credentials, before booting into the encrypted drive).

There's apparently a safari browser-only mode which can be activated from the login screen there.

This would create the ideal scenario for the stolen laptop: Thief without the knowledge or ability to reformat (particularly if you've slowed them down further with a firmware password) can only use the safari-browsing guest mode; can't get to your full encrypted drive, and Prey is recording and sending off everything they're doing.


This is neat, but it only works if your setup is simple enough to be usable by a random thief so that they can get an Internet connection ready so that the machine can phone home. Were someone to steal my laptop and boot it, they would reach a tty login prompt in a dvorak layout, and playing around in grub would also lead to an LFS install with a patched agetty greeting them in lolcat. (My LFS was just for fun, so I did silly stuff with it.)

In other words, they would probably just wipe the computer and install Windows, and I wouldn't hear about the machine. I guess I could have a Windows install ready with a guest account and sneaky tracking software just for the benefit of an hypothetical thief, but it doesn't seem worth the effort.


Perhaps you are also meticulous enough to not allow your laptop out of your sight in the first place.


using a laptop recovery service to do exactly what it was intended to do. sweet hack, bro!


You're missing the point. To paraphrase: "As a hacker, I had the good sense to make sure I had tracking software installed. I take security seriously."


[deleted]


Thank you for pursuing this enlightening thread further.


>Luckily the thief was a smart little bugger and he was able to bypass the password by using an OSX install CD to create a new admin account.

So why did he rely on luck instead of SSHing to the laptop and unlocking the machine?

>I cranked up the frequency of reports to one in every five minutes to try to get a screen capture of him using gmail or facebook so I could snag a name or login credentials.

Hmm, start a keylogger (and a sniffer) in the background and then scp the logs a couple hours later?


>So why did he rely on luck instead of SSHing to the laptop and unlocking the machine?

I don't know of a single person who directly connects their laptop to the internet. This would have been sitting behind a NAT device which, unless port 22 was explicitly forwarded to the IP address that his laptop happened to get via DHCP, would have stopped him from SSHing in :)


That's why I have a two line shell script that creates an SSH tunnel to my server if I put a file called 'reversessh' on my webserver.

I mean, basically doing what Prey does, but without relying on a third-party service and having much more control over the machine.


See also AutoSSH: https://secure.wikimedia.org/wikipedia/en/wiki/Autossh

"Autossh is a program to start a copy of SSH and monitor it, restarting it as necessary should it die or stop passing traffic."


Now that's hack-zore :).


Would you share that script?



Consumer routers will typically have port 22 firewalled for incoming trafic.


Ok, I'll rewrite: Why wouldn't he use his reverse SSH connection* to do that stuff?

* Reverse SSH: if wget http://myserver.com/sshreverse; then ssh -R 2900:localhost:22 User@myserver.com; fi

Stick this in a file, chmod +x, then add an entry in cron to run it every hour or so. After that, you just need to create a file in your web server called "sshreverse" and you'll have an SSH tunnel to your laptop.


You forgot the part where you ensure that the ssh-key for user@myserver.com can only be used for this particular reverse-tunnel and not to, say, login to myserver.com...


Id do one thing slightly different.

I would set up an icmp proxy with ssh on top of that. And there would be a few good reasons for that. 1: it bypasses a whole lot of firewalls and captive gateways. 2: few hackers would expect such a communication mechanism like that.

Of course, this solution works only if the computer isnt reformatted, as i would do if i ever got into petty theft. So one would need the computer to have an open and easy to get into account. If you use linux, have home directory encryption on and the account called "Administrator".


Run SSH on a non-standard port. Or you can have your laptop set to open a reverse ssh tunnel to another trusted machine on some event, like a file changed on your website, etc.


My mom is a hacker too. She hacked her own gmail account the other day by recovering her password, she even had to remember the name of her first pet!


Here is a much funnier and more technical account of someone retrieving their stolen computer. In video form!

Skip to 3:15 http://www.youtube.com/watch?v=OAI8S2houW4


I've been thinking about that video... the guy says it started connecting to the network over 2 years after it was stolen. It seems unlikely (or at least plausible) that the guy who had it was the guy who stole it... or did I miss a key bit of info that justified it all?


That's true. He did say that he gave up looking for it on Craigslist and eBay after a while, so it may have changed hands after he gave up the search.


Am I the only one who feels that it's wrong to put someone's personal information and picture on the internet just because he stole a laptop? Of course you get your personal information stolen as well, but in my opinion that doesn't justify spreading his image and name all over the internet. that kind of intrusion into privacy (of the thief) is a much bigger crime in my eyes than the loss of some laptop.


We had this discussion the last time something like this was on HN, so I’ll try to summarize things from my biased point of view. The first thing is, some people (myself included) would say this fellow is a suspect but has yet to be convicted of a crime. Some people would wait until a conviction is registered to publish details like this.

Others take a pitchforks and torches approach. I recall people saying, “publish and let him sue if he doesn’t like it,” which is pretty much the same thing as saying “it might be wrong, but thanks to the difficulties of suing for libel, we can get away with it.”

I guess this is where we peel away all of our nobility and reveal the savages underneath. Some of us strongly believe in the justice system and the importance of treating the accused extremely fairly in theory, but in practice "we know the bastard did it, so there."


Must it be the civilized versus the savages? Are you sure that's a fair description?

How about this: it's my laptop, and I reserve the right to use it to take pictures any time I see fit?

I'm okay with running the picture of the guy, and publishing the data, as long as there's a clear disclaimer that this is just information pulled from your own laptop, not presented as evidence in some kind of criminal proceeding. We do this all the time with videos on the news that show crimes in progress. Heck, we did it with the rioters. Local papers ran big pictures of them on the front page. Simply making public video and data that you have every right to have and use isn't the same as calling the guy a crook and demanding he be hanged.

Now yes, the mob will probably take over from there, but that's because the net is full of mobs, not because you've somehow made a mistake in publishing the data. I am very concerned about folks taking justice into their own hands, but I don't think that my concern somehow changes the right of this guy to publish his own data.

There's no "we know the bastard did it, so there" that has to be involved. I load my laptop up with whatever legal programs I like, and I choose to publish the data from those programs any time I feel like it.


How about this: it's my laptop, and I reserve the right to use it to take pictures any time I see fit?

That statement is like saying “This is my gun, I reserve the right to shoot bullets from it any way I like.” Obviously every action we take with our person and our property has consequences and we are responsible for those consequences we can reasonably foresee.

Clearly there is a continuum of choices from sharing the pictures with law enforcement but not publishing them, to publishing them but being careful to disclaim that this person has not been convicted of committing a crime, to publishing them and asserting this is the thief. You pick where you feel comfortable on that line, I pick where I feel comfortable.

Looking at the commentary here and the last two similar things to hit HN, you must accept that regardless of where you or I might place ourselves, there are definitely people to the far right of the line. You can see people talking about this person as “the thief” without bothering with the inconvenience of a trail. You can see people discussing the publicity as a pubnishment. One comment talks about “naming and shaming” as a deterrant.

You may not consider yourself part of a lynch mob, but seriously, can you deny that such an element is present?


You may not consider yourself part of a lynch mob, but seriously, can you deny that such an element is present?

No, and I'm very concerned about it. But the only choices are the ones I have to make. I can't start worrying about everybody else. In fact, once I let the threat of a mob start swaying my decisions, I've already lost. The mob has won. (ugh. hated doing that, but it was too rhetorically easy.)

You get my drift. I think, for me, that I need to think long and hard about what the consequences might be. But quite honestly, here's some guy I don't know using my computer. Anybody know this guy? Perhaps he's being held hostage for all I know. The more information I get out there, the sooner we can have this thing resolved. I don't have to jump all the way to some conclusion simply because I need to solicit information about the location of my laptop. After all, I'm the innocent guy here.

I didn't read the other articles, but it sounds like you are reacting against the mob mentality found here and elsewhere. Yes, this concerns me a great, great deal. The internet was supposed to bring equality and democracy. It's done that, but it's also brought flash mobs robbing stores, riots, and vigilante justice. Not good. We should all speak out against that -- especially when it's a cause that sounds "right" to us.


Think about it. Why do we put far more money into law enforcement than the cost of the crime? Because it's not just about that one laptop. If we don't get the point across to the criminal, he'll do far more damage to all of us. Most burglary is the result of a small number of people. Because few police departments treat that crime seriously, a single burglar gets away with hundreds of crimes before getting caught.

As for his privacy, he surrendered that voluntarily when he stole the laptop; the government didn't impose that sentence on him.


I don't think he surrendered his privacy voluntarily. exposing his picture and info has nothing to do with law enforcement - that's just self-administered justice. a well functioning state of law / rule of law (I dunno how you call it in english) works by sentencing criminals to prison according to the scale of their crime. not by punishing them overtly and excessively as a warning to other criminals (that's just barbaric).


All that happened is that the World knows that he is a criminal. His right to privacy doesn't mean the right to conceal his misdeeds from the rest of us, nor the right for us to keep silent about it.


No, just because you become a criminal doesn't mean you lose your right to privacy. Whether the act itself was unlawful or not doesn't really matter (to a certain extent).


To compound matters, a person not convicted of a crime by a court of law is a suspect who may or may not know the laptop they are using is stolen goods. I think its wrong to treat suspects as though they are convicted criminals. Presumed innocent before guilty and all that.


In the US it seems normal to even expose people's full names on any police stuff and/or after prosecution (I never paid too much attention what was what). Privacy and personal rights are very different in some countries. In germany we highly value personal rights and privacy.


Yeah that's a good point. Although unlikely, the guy could have bought the laptop off of Craigslist or something.


"When it's a large group of Millwall supporters, in a pub all day, talking about doing the police's job for them, it creates the impression that they're spoiling for a fight, opportunistically – using the chaos to bust into a racial confrontation that they normally wouldn't be permitted, in a metaphorical echo of the looters they're determined to stop."

http://www.guardian.co.uk/commentisfree/2011/aug/10/uk-riots...


I disagree. Shame is a good deterrent to theft. Naming and shaming the thief could prevent future crimes.

Furthermore, I don't see how putting someone's information on the internet is comparable to physically depriving someone of their property. The latter has obvious effects, and the former may not even cause much harm. It would have never happened had the thief not stolen the laptop, so I'd say the ultimate blame rests on them anyway.


If a person breaks into/trashes/takes things from my personal space they are certainly giving up their right to anonymity in my eyes.

Why should I respect his privacy when he has absolutely abused mine?


he violated your privacy and so did you, when you installed a tracking software. the difference is that you're putting the information on the internet and he is not.


I violated his privacy by logging all actions that are performed on my computer, and reading the actions performed on my computer when it was used without my permission? Hm...


This being London and with their libel laws the author could indeed be setting himself up for trouble.


Is this one of those viral marketing campaigns again? Yesterday, there was a popular thread on Reddit about some guy who retrieved his stolen Macbook by using the exact same software that's being mentioned here. And not to mention the several other threads here on HN a few months ago that are suspiciously similar.

Or maybe it's just really useful.


no it's not. and please don't start with this over again.

we (the Prey team) don't have the time or the interest to pay people, thieves or whomever to build and publish these elaborate stories.

I spent almost all afternoon yesterday on Reddit -- where some guy published a similar story -- trying to make it clear that we had nothing to do with it (besides having developed the software).

I'd be happy to answer any questions regarding Prey, but please don't make me go repeating today the same thing all over again.


Thanks for your software, i think u guys are latin-americans? ...


yup that's right, at least me and most of the guys that work for Fork (the company I founded after Prey took off). however there's lots of contributors from Europe, the US and Asia.


Hey, just wanted to say thank you.


you're welcome Greg! really glad to know you got your laptop back. :)


It's free and open-source. I doubt they have the budget for a viral marketing campaign.


They might have the budget: http://preyproject.com/plans


I have prey too - it's awesome.


Any suggestions on alternatives? I'm not considering installing it but would like to know my options.



I just installed Prey. Ignoring the OP's use of the word "Hacker", you don't have to pay them anything to get good value from the software.

I set it up so if this file ever disappears http://iamnotaprogrammer.com/prey.html it starts sending me alert messages like the one below:

Good news my friend, it seems we found it.

Here's the report from your computer:

######################################################## # geo ########################################################

:: lat=(deleted)

:: lng=(deleted)

:: accuracy=33.0

######################################################## # network ########################################################

:: public ip=(deleted)

:: internal ip=192.168.8.121

:: gateway ip=192.168.8.1

:: mac address=34:15:9e:07:af:86

######################################################## # session ########################################################

:: logged user=sudonim

:: uptime=14:21 up 3:12, 6 users, load averages: 2.12 1.91 2.06

Happy hunting!

-------

Then it attaches a picture taken with my camera and a screenshot. All in all, pretty handy to have running.


6 users! wow.


A single terminal session counts as a user, probably has a few open, plus the system login etc.


What I don't understand: I you're so concerned that someone steals your laptop, why do you then install tracking software instead of encrypting your harddrive?

If someone steals my laptop I wouldn't care about the cost of lost hardware. Instead I'd care more about my private data that now is in the hands of someone else.


I guess it depends on the person. I have more private data on Facebook than I have on my computer. The cost would be a big problem to me though, I can't afford to buy a new laptop every year.


Quick look at the source code (https://github.com/tomas/prey) seems to show that if you wipe the HD you're SOL. I'm still waiting for Apple to release Find My Mac (similar to Find My IPhone), which will withstand a hard drive reformat.


Not sure if it survives a HD reformat, but: http://9to5mac.com/2011/08/03/apples-icloud-find-my-mac-serv...


Thanks! Finally a reason to upgrade to Lion.


I've been wondering about these services. Not having more information about the inner-workings of a monitoring/recovery service, I'm concerned about the company's ability to spy on me the same way I could spy on anyone who uses my stolen laptop. What prevents this from happening?


Prey is open source so, if you knew how to, you could add some monitoring capabilities to Prey to make sure it isn't doing anything it shouldn't.


I suppose if you are worried about it you can use Wireshark or some other similar network traffic inspection tool to watch your traffic for suspicious communications you didn't authorize.


Selling corporate firewall hardware doesn't make you a hacker


Well, who knows - maybe he has a life outside his job?


One problem I find with these tracking applications, at least for the average users, you actually have to remember that: (1) you have one installed and (2) your credentials.

It's kind of a problem, if you have all your other data stored using something like 1Password.

I know for sure I have a tracker installed on my laptop, but since it's running in "stealth" mode, I have no clue what it is or where to find it. I guess I am not hacky enough.


Wait, all he had to do was report the guy's name, address, and photo to the police, and they got the computer back for him? It sounds like the London Metro Police are a lot better than the ones in, say, San Francisco.


What I worry about with many of these recovery stories is that you're probably not humiliating the criminal, just some unlucky person who bought the computer on Craigslist.


I was once looking to buy a Mac off of Craigslist. So I sent the guy an email to ask about it. Oh, you lost the keyboard and mouse? You don't have the original OS install disc? No receipt? The black power cord in the pictures looks like one of those PC specials? Yeah, what are the odds that you misplaced absolutely everything regarding the system except for the main unit itself? Stolen.


Looks like the story just got pulled. I wonder if it was from all the criticism over the use of the word hacker, or if it was for privacy reasons.


Oh, it's back now but the name of the school on the screen shot is wiped out, as well as the guys eyes are crossed off.


A lot of bits wasted here about semantics but not a single one raising the multiple racist allusions on the linked blog post.


I noticed he forgot to black out the guy's IP address 90.201.72.42 in the screenshot.


Also, there's enough info to find the guys Facebook profile: https://www.facebook.com/profile.php?id=1019527331


This is exactly why I don't use password protection on my MacBook Pro.


The guy browsed the internet for muslim revelation videos. I could have give him 1 tip to be in God/Allah's good Grace: Don't steal other people's stuff.


404 page has been pulled out 1 min ago.


"took a report and dusted for prints, performed typical forensics"

I'm impressed that the police dust for prints in England. I've never heard of someone getting that kind of thoroughness for a domestic burglary where I live.


When my house was burgled, the cops sent out 3 cars, did a thorough inspection, took inventory of what had been stolen, and dusted for prints in places we indicated were likely to have been touched (the windowframe where they came in, some doorknobs, and the box fan they had moved). This was in Rochester's 19th Ward (New York), possibly the most dangerous and high-crime part of town.

As far as I know, they never caught anybody, but at least they tried. I'm pretty sure it was my drug-dealing neighbors two houses down... especially since the guy three houses down claims the security cameras on his porch showed them taking stuff from our house to theirs. Oh well.


Same in Paris when my brother's apartment was burgled a few months ago... 2 members of the French Scientific Police took pictures / fingerprints. I didn't think they'd go that far, having read countless stories on how this is usually handled in the US.


Can confirm of similarly good service in Vienna, Austria;

Thorough investigation, dusted for prints, and even took sample of nondescript, possibly bodily fluid (turned out to be non-organic).

Very professional; Though wouldn't get burglarised again.


How the world has changed, Hackers use macs?


Wow, you are out of touch.


Yes.


Why didn't a real hacker have a keylogger installed on his machine instead of just the webcam thing? You could have gotten the guys' password to his facebook


In my experience, hackers don't normally keylog themselves. That's the kind of thing they'd rather avoid — it could be especially disastrous if your computer were stolen like this.


Encrypt the logs with your public key. Do not keep the private key anywhere near the machines, containing the encrypted logs. Move logs to a remote secure storage (co-located or home-hosted) as soon as Internet connection's available. Assure reasonable amount of electronic and physical security of the storage servers.

Problem solved!


Obviously I mean a remotely activated keylogger - the computer goes online and checks a website to see if it should start the keylogging


I am sorry, but mere mortals have not heard of and don't use prey project. Hackers use prey project. Professional ones.


This article seems to imply this "hacker" used some actual skill set to retrieve their stolen goods. Installing tracking software on a mac and then bragging about it when stolen and then found doesn't fit with what I'd call being a hacker.

Nice story though. And I'm happy another rioting / looting is going to court to answer for there actions.


The down votes seem to imply that I'm wrong. Please could someone enlighten me as to why I'm out of line here. Yeah, sure this guy calls himself a "Security Evangelist" but this has absolutely nothing to do with his skill set being used as a "hacker". Any Joe on the street could and likely has done what he has .. the title is sensationalism and frankly I've become tired of this nonsense in the media over these riots.


I suppose it's people being tired by the whole "hacker" hoopla, especially when people use the term to compare their e-peen, but also when the media confuses hackers with crackers.

To me, the hacker/cracker thing is just a lost battle and thus a big waste of time.

That being said, I'd only use "hacker" in the original sense, i.e. the hacker philosophy about exploring, learning and teaching. To me, a person with no clue about cars that learns to fix it themselves is by definition a hacker.

You all too often see people pulling the e-peen thing on the net, which I find sad, as it's also just another waste of time. The "correct" use of the term hacker is just a pretense imho.

In the same vein of whining and bitching: has there been another influx from reddit lately or is the cooling effect (or what it's called) only gradually noticeable? I've noticed that I'm more disappointed with the content and comments on HN lately, even more so on reddit obviously.


Couldn't agree with you more.

If you're a mechanic, you don't brag about calling the AA to home-start your wheels. You would be pretty shocked to see a mechanic post a story about his home-start on a hobby enthusiasts news site and see the community there voting the story up.


Indeed, although I'd be sighing as in this case, not be shocked.

I wonder if it's just an illusion or if there really also is an influx in me-too submissions. Not that I'm judging any submission in particular, but there is clearly a difference in usefulness and novelty when you compare them.


You're getting downvoted because he's not implying that installing Prey makes him a hacker. He updated his post as follows (possibly after you posted your comments?):

>Updated: to quell the comments, I did not choose the title to imply downloading tracking software is hacking, I am a hacker by profession and have been most my life.


Maybe this guy IS a hacker, or maybe he's NOT, I don't care, but the word hacker is worthless using in this story, didn't see any hack involved...


"Hacking" is now referred to, someone posting on anothers facebook, since they were still logged in. /facepalm


So now everyone who installs a "tracking software" on his laptop is a hacker. Really, the internet has changed.


Did Sam Odio's blog get hacked? Because I refuse to believe that the Sam whose comments I've been reading on HN would steal from someone. Sam how is what you're doing different from what Anonymous et al are doing? However irritating Jonathan's experiment is, it doesn't give you the right to impose you idea of morality on them.


You're in the wrong comment thread.




Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: