I love stories like the one where a Mac user helped the cops apprehend her laptop thief. But, what if your laptop got pinched? Would you be prepared? Is the hard drive encrypted? Is the data backed up somewhere? Will your accumulated collection of feet pictures cause you some degree of embarrassment?
Well, the feet notwithstanding (ugh), the makers of the Lenovo Thinkpad have added an interesting feature. I thought I wrote about this at the time but, for the life of me I could find it. Ah well.
The feature (taking my methylphenidate) is a chance to brick your stolen laptop and completely piss of the jackass who purloined your loin cooker. Just send it an SMS message and bingo, she’s locked up.
From Dark Reading:
“If a hard drive is turned on and the OS is loaded, the encryption technology makes all the data on the drive available in clear text to the operating system,” Cannady says. “If someone steals my PC off my desk or off the table in Starbucks and I’m logged on and the lid is down in ‘suspend’ mode, there’s a chance [the thief] could get that data — even though I have military-grade encryption technology turned on.”
Cannady says the new Lenovo feature lets you send a kill command directly to the laptop, using a mobile phone. “When the kill command is received, the PC will shut down and refuse to turn on again,” he says.
Which would mean something if you knew your system was missing in the first place. If you were unaware well, you’d be pretty much boned. Worse still if the thief happened to have a faraday cage lying around.
Still, a neat feature.
UPDATE: Received this tweet from Amrit at BigFix.
“BigFix can do that, send a “fixlet” to snap a pic using the built-in iSight camera and then email it. One of our custs sent “fixlets” to 5 stolen laptops w/a pop-up that noted the IP & said they wouldn’t call cops if they were returned. The thief called the # in the pop-up and returned the laptops within the hour”
Ah, the fun it would be to get that call.
“When the kill command is received, the PC will shut down and refuse to turn on again,†– yeah, what if someone *ELSE* figures out the kill command and sends a bunch of them to all of your organization’s laptops? The ultimate DoS.
Authentication and integrity are important controls, and you have to consider what the failure conditions are before you add systems like this.
@Paul
I was pondering that myself. Now, is this a predictable code? Could it be turned into a massive denial tool?
Excellent question. Thanks for the comment.
cheers,
Dave