Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My laptop (modded 2007 Macbook Pro) was stolen 2 days ago when I didn't pay attention to my backpack in a tourist spot in Europe and while I'm quite certain they won't have much use for it (the apple is orange :) I'd still like to make sure I'm thinking of everything. What are the next steps, what can I ignore? This is the situation:

  • OS X 10.8, no HDD encryption, no anti-theft measures (Prey etc)
  • Accounts: Admin + separate, limited User account with complex passwords, Account names are not pre-filled
  • CVs etc with lots of private data, also outside of User folder on 2nd HDD
  • Bank Account, FTP, Mail passwords encrypted in KeePass, nowhere as plain text, none connected to birthdays or other (guessable) personal data
  • No passwords saved in browsers
  • Lots of e-mails with sensitive and other data, contact book etc in User folder (how easy is it to access those?) as well as my .ssh directory
  • Just realized: locally stored websites with config files that contain passwords to my server & DB in plain text (!)

Am I thinking in the right direction? Should I change all my passwords? Any guess of the likelihood that a (crappy looking) tourist laptop will warrant any attention or does this not matter at all, because I should just assume worst case anyways?

Thanks a lot in advance!

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Chances are they will just whips it and sell it. I would as a countermeasure at least change passwords to your critical data ( bank accounts, servers, passwordmanager). The rest is up to you. However note that the effort would be quite low to change all your passwords compared to the potential damage.

If you have the serial of your Mac computer you could opt to share this with Apple. Not sure if they have an anti theft program, but they could see the device pop up again.

I would advise you to consider full disk encryption next time. Because it would have mitigated all of these risks. Keep pass by default uses aes 256. If your password is complex enough meaning it has numbers upper and lowercase letters as well as signs and has a length of over 12 characters, then you should be fine.

Do consider that there might be cookies on your computer which still have valid session tokens. Keep a close eye on all your accounts and register any suspicious activity. (Often these are still valid after password changes)

Note that even if you would be defrauded then normally the bank or the car company would refund you as to avoid reputational damages to their brand.

share|improve this answer
1  
Cheers Lucas! About serial numbers: I'm not sure I still have it (bought 2007, never registered with apple) - any way I might still retrieve it somewhere from my TimeMachine Backup f.e.? –  Christian Macht Dec 16 '13 at 22:33

Yes - definitely change your passwords. It is a low effort way to fix a lot of potential problems!

It used to be that laptops would be wiped if they had a password on, but the tools to glean data off them are so commonplace/simple now, most attackers will try and see what is on there - as they can make a fair bit of money from account details held on laptops.

Don't assume no passwords are saved - more is saved than you think, as browsers and operating systems try to be helpful.

share|improve this answer
    
Cheers. Changed Mail pw right away.. it's a lot of passwords obviously, but I'm quite sure as well that there's no way around it. –  Christian Macht Dec 16 '13 at 22:22
    
It does look like you have done generally the right things, but stuff gets cached, filesystems leave evidence etc, so yeah - going through the password list is useful. Clear off the obvious ones first, like your cloud backups, mail etc as they'll be the first targets –  Rory Alsop Dec 16 '13 at 22:24
    
I'm assuming correctly, that they won't be able to get at the stuff in KeePass? –  Christian Macht Dec 16 '13 at 22:26
    
They shouldn't be able to. –  Rory Alsop Dec 16 '13 at 22:54
    
hasn't anyone thought of cookies & cache ? –  MAD4RA Dec 17 '13 at 3:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.