Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible.

The laptop is a Win7 x64 laptop, a newer Dell business model. There is no lojack software or anything of that nature pre-loaded on the laptop.

In this situation, what would some best first steps be, and do you know of any tricks that can be used to track or monitor a laptop after it has been stolen?

share|improve this question
    
Thanks for these tips. I was just able to get my I.P. numbers to give to the police. From about two attempts to access my facebook since the laptop went missing on friday night. Much appreciating all you hardcore hobbyist sharing the fruit of your labor of love and keeping us inteligized. Keep it up ad you can count on me to serve you with my skills, my sword and my axe. –  user4331 Aug 16 '11 at 17:50
    
@WBrown welcome to Information Security - please see the FAQ, most of the users here are not hobbyists, but security professionals :) –  AviD Aug 16 '11 at 20:58

4 Answers 4

I think this video here will give you some ideas: What happens when you steal a hackers computer (Defcon 18). This is however a MAC PC, but it will give you some ideas.

share|improve this answer
    
worth noting that the thief was using dial up so there were not any port forwarding issues. (if I remember that talk correctly) –  WalterJ89 Feb 17 '11 at 14:03
    
@WalsterJ89, port forwarding can be compromised ;) If you somehow gow the IP of the guy stealing the laptop the road to pwning him might not be so far away. –  Chris Andrè Dale Feb 17 '11 at 16:12

I doubt there is much you can do with this, but your best bet is going to be watching logs of any services running on the laptop. If there is a mail account, you can watch the mail server logs to see the IP address, likewise for any other services.

share|improve this answer

One of those things that is easy if prepared in advance but very tricky after the fact. If the laptop has default VPN setup on it, or a default connection it would make to your network once plugged in, you may be able to get info, but more realistically you need to act as if it is a writeoff...and if it was unencrypted, plan for the fact that all the data on it may be used and abused.

Start to think about the response you need to make - are you in a jurisdiction where you need to tell clients whose data was on it? Have any accounts that the laptop may have logged into in the past had their passwords changed.

Sorry most of that was offtopic :-)

share|improve this answer

Well I'll point out some idea's for next time. It's a good idea to always have some sort or recovery plan in place. Some of these even make life a lot easier when you are working remotely too.

  1. Running a Service like DynDNS is a good start to make a laptop easily accessible no matter where it is. It's easier than remembering or looking up the IP address.

  2. Having a SSHd service running is great for taking control of the PC where ever it is or even deleting/recovering data remotely. For windows I like to use Cygwin but there are simpler set ups than that. (VNC is nice too)

  3. Running a Virtual Private Network service like Neorouter or Hamachi or LogMein avoids port forwarding issues. (this is probably the most important one)

  4. Of course none of this does any good if the bad guy can't get past the log in screen. So make sure you have guest account active or a hardened non-privileged account. (even a secondary OS works). Then run a trapdoor script in that account. Nothing in won if the stolen laptop is just reformatted.

  5. Running a nasty trapdoor script at login is a nice touch. I have one that deletes or hides browser history, saved passwords, and anything sensitive (so on and so forth). Of course this last step is where the real fun begins.

Some things you can probably try and get that laptop back.

  1. Check logs for email accounts

  2. Check Facebook. I'll bet whoever stole the laptop tried it to see if you were still logged in. If you were then the IP address will be logged in Facebooks' security settings.

  3. MSN Messenger, if auto login is enabled and the thief is abusing the account you can get the IP address by starting a file transfer or trying to start a video/audio conversation.

  4. Any VPN software you may have running is the best bet.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.