Track Computers Whereabouts 5

[jammer1221]

Hey all,

Recently we've had a break-in and 9 laptops were stolen. We are currently in the process of overdriving our security that is in place, and we had a few ideas to localize it to each computer.

So my question is, is it possible to track where a computer is whenever it connects to the internet?

I've heard of things available on the web called GeoLocation or something like that. It can tell where a computer is but only as detailed as the city. I don't know alot about IP addresses but is it possible to track exactly where someone is via their IP address, or even just their name.

I'm sure this will have to be some sort of program, but I'm asking for your guys help because you all spend alot of time on the web, and possible know things about IP addresses and things like that.

Thank you very much,

Matt

 

[Foamcow]

Yes you can trace a machines location from it's IP.

The problem is, you won't know what the IP of the machine is will you. If someone uses it to connect to the internet then you won't know what ISP they are using so won't be able to track the machine.



<honk>*:O)</honk>
Foamcow Heavy Industries - Web site design in Cheltenham and Gloucester
Ham and Jam - British & Commonwealth forces mod for Half Life 2

 

[jammer1221]

If it were possible to find that stuff out, how would I go about doing that?

Would I use one of those trace an IP online services?

Thanks,
Matt

 

[kaht]

Read Pete's 2nd line he posted - there is no way to find out what the user's IP is. One of the IP tracer online services would be of no help because you don't know what the IP is. When they connect those laptops to a new network in some other remote location it will acquire a new IP address for that location.

-kaht

Looking for a puppy?

[small]Silky Terriers are small, relatively odorless dogs that shed no fur and make great indoor pets.[/small]

 

[jammer1221]

Correct, I am sorry. You guys are talking about the laptops that were stolen, and I am talking about how to detect where a laptop is in the future.

We were just talking about two different things.

The laptops that were stolen, other than search pawn shops, have no way of getting back via some sort of internet thing.

But what you guys are saying, is that if we put some sort of program on each computer that would "secretly" update a website with its IP address every time it connects to the internet, it would be possible to track where it is?

 

[coachdan]

I don't think you would have much luck with this. Most likely whoever stole it would wipe the drive and start fresh, unless you think they stole it for what it contains.

coachdan32

http://www.malehsbaseball.com

 

[jammer1221]

coachdan,
thats exactly what I'm thinking the problem will be. Because the laptops also have the proof of liscense on the bottom with the serial number, so it would be really easy for them to just re-install the OS.

 

[Wullie]

I don't think you would have much luck with this. Most likely whoever stole it would wipe the drive and start fresh, unless you think they stole it for what it contains.

I read in the past about a method that survives a format, but for the life of me I can't remember where I read it.

Wullie

Fresh Look - Quality Coldfusion 7/Windows Hosting
YetiHost - Coming Soon

The pessimist complains about the wind. The optimist expects it to change. The leader adjusts the sails. - John Maxwell

 

[Wullie]

Ok, just found this. 2 programs listed on the following page "claim" to survive a format of the HDD.

http://www.alamopc.org/pcalamode/reviews/archive2/rev009901.htm

Hope this helps

Wullie

Fresh Look - Quality Coldfusion 7/Windows Hosting
YetiHost - Coming Soon

The pessimist complains about the wind. The optimist expects it to change. The leader adjusts the sails. - John Maxwell

 

[Foamcow]

You still can't track them by their IP since it's most likely that the IP address is allocated to the connection and not to the machine itself.

Therefore you can take the same machine, over the same phone/cable line, connect to a different ISP and have a different IP address.

The only thing you could do is install some kind of GPS doobrie into the laptop. But I would guess that the cost of deploying that is going to make it unviable when compared to the cost of a new laptop/insurance premium.

There is also probably some way to "mark" or "tag" the machines - even something non-physical that will survive a disk format, but you still won't be able to find them.

You may as well security mark them with a UV pen, or scratch something into the case. I think you can also get microdot kind of things that have a unique ID printed on them.

<honk>*:O)</honk>
Foamcow Heavy Industries - Web site design in Cheltenham and Gloucester
Ham and Jam - British & Commonwealth forces mod for Half Life 2

 

[Wullie]

You still can't track them by their IP since it's most likely that the IP address is allocated to the connection and not to the machine itself.

Sure you could. If you have the machine telling you what IP it is running on, you could go to the authorities with the details and in turn (assuming it was a high value theft) they could get a court order to find out from the ISP who had that IP at the particular time.

That's pretty much the way that the software I provided the link to work, it tells them details about the phone/IP and that information can be used to track the place the machine was used.

Hope this helps

Wullie

Fresh Look - Quality Coldfusion 7/Windows Hosting
YetiHost - Coming Soon

The pessimist complains about the wind. The optimist expects it to change. The leader adjusts the sails. - John Maxwell

 

[Foamcow]

If you knew the IP then sure, you could get the location.
But how would you know what IP address the machine was using in the first place?

<honk>*:O)</honk>
Foamcow Heavy Industries - Web site design in Cheltenham and Gloucester
Ham and Jam - British & Commonwealth forces mod for Half Life 2

 

[Foamcow]

Actually I suppose if you could permanently install something that pinged you with the machine's IP... that would work.
Why can't that be a bit of hardware? Hmm.

It's something I thought about with stolen iPods, they all have a unique serial number against which a iTunes account is held. And all, at some point, are going to talk to Apple via iTunes etc.

<honk>*:O)</honk>
Foamcow Heavy Industries - Web site design in Cheltenham and Gloucester
Ham and Jam - British & Commonwealth forces mod for Half Life 2

 

[jammer1221]

What I was thinking was a program that ran at system start up, hidden in the background, that submit its unique identifier to a website, the website would then log (via database) the IP where the identifier came from, the unique identifier sent, and the date, or something like that. We would then be able to compare the stolen computers unique identifiers with the IP's logged into the database, and like said before have a court order for the ISP to give us a name or address or something like that.

Still there would be a problem if the harddrive was formatted.

That thing about the iPod is a really good idea.

Wullie, thanks for that link. It was really helpful. We are actually checking out the first program mentioned in that link already.

P.S. I should have stated this earlier in the post, but I asked the samething in the Windows XP Pro forum. Heres the link...

http://www.tek-tips.com/viewthread.cfm?qid=1255770&page=1

We started talking about BIOS, which would be how we get around the formatting problem. Well, just something for you guys to look at.

Thank you all for the replies, and I look forward to hearing more.

Matt

 

[feherke]

Hi

Still there would be a problem if the harddrive was formatted.

And no firewall to block it. And also not boot from other device.

I would say, you have almost no chance.

Feherke.

http://rootshell.be/~feherke/

 

[Foamcow]

Agreed. The best bet is to make sure they don't get stolen in the first place!
Easier said in hindsight I know but I would hope that your break in has prompted a serious analysis of physical security rather than just schemes to recover stolen kit.

You could always make up some prominent stickers that warned the machine was tracked via GPS... often the warning is enough to put someone off ;-)

<honk>*:O)</honk>
Foamcow Heavy Industries - Web site design in Cheltenham and Gloucester
Ham and Jam - British & Commonwealth forces mod for Half Life 2

 

[shaned]

try this link

http://blogs.ittoolbox.com/security/investigator/archives/stolen-machines-phone-home-10506

Shane

 

[j4606]

Lojack offers a recovery system for stolen laptops. I don't know the details of it, but i heard it on the radio on my drive to work and remembered this thread. Might be worth looking into. I never used it, and do not know if the product works but here is a link i found.

http://www.lojack.com/products-services/index.cfm

At the bottom there is listing for lojack computertrace.

 

[jshurst]

I wrote a simple windows service that checks the ip address of my computer 4 times a day, then if it changes it sends a file to my web host so that I can always know my ip address of my server (it's the same principle that free DNS servers use for non-static ip addresses). It's really pretty simple, but keep in mind that you need the external ip address and not the internal one (if you write such a service yourself). Basically my service just page scrapes the information from an internet page (do a goolge search on "what is my ip address" and you'll find tons of pages).

The only problem is the formatting issue, and possibly firewall issues. I haven't looked at the articles above, so not sure how programs can get around a low-level format without some sort of add-on hardware (maybe they are using add-on hardware)?

If you want then I can send you the service I wrote (source code and everything - however I've been wanting to make some modifications to it - like a custom configuration file).

J

 

[jammer1221]

jshurst,

That would be great if you could send me your windows service. In a post above it links to a blog that talks about making a windows service. I thought it sounded pretty interesting and I decided that I would look in to it later in the week. It would be very helpful to take a look at yours, as I have no idea how they work.

The services posted above require that you have some sort program installed on your computers BIOS, and only a few computer models have it. So thats how they work around the formatting issue.

Thank you very much. My email address is in my profile and I look forward to hearing from you about the service you built.

Thanks a ton,

Matt