I love my corporate laptop. It's nothing fancy: Lenovo Thinkbook 460s with ram upgraded to max for VM use. That said, I've pounded this thing into the ground and gotten attached to it. I have to return it when I leave this job and I had the flash question of "what if I wanted to secretly swap it with another, newer, computer and keep the one I'm attached to?"

From a moral standpoint I'm giving the company the exact same laptop, in better shape. I'd dd the hard drive after image transfer, so no issues from an information leakage standpoint. Remember, the goal is that this is done in the most ethical way, ignoring that I'm keeping the O.G. hardware.

So, here's the challenge, how to do this? Many issues to deal with. Mac address being the first. If the nic is hardwired on the board (which it will be), life will get really tricky. That doesn't include bitlocker or etc and the corporate image rejecting many possible checks when put on a replacement clone comp. (cmos, tpm, etc.).

Any sys admins or hackers that can give some interesting insight to this thought problem?

Also, in all honesty, I'd never do this. I'm fascinated by the puzzle.

  • Tell them you broke it by accident, so you bought them a new one?
    – forest
    Apr 4 '18 at 2:42
  • 1
    Heck, smash your car window, take a photo, and say the laptop was snatched. Your glass deductible is likely less than the laptop. Apr 4 '18 at 3:47
  • 1
    I really depends on the level of their security. They may not even check for MAC or other unique serial numbers. In my company they generally check the model number for any retired laptop and that's it.
    – Overmind
    Apr 4 '18 at 7:28
  • 1
    Why don't you just offer to buy it? If it's a few years old they probably won't reissue it anyway.
    – iainpb
    Apr 4 '18 at 8:24
  • 2
    If the laptop you returned is a different (newer) model than the one you got, it would be very easy to notice. So you’d need to get the exact same model. But then, you could just buy the same model as your beloved company laptop and be happy with that. At the most, if you are really attached to individual dents in the case of your company laptop, swap out individual case parts but return the electronic components to their rightful owner.
    – user149408
    Jul 23 '20 at 10:54

The data on the laptop is likely more valuable than the laptop itself. Many orgs will sell you old laptops once they reach end of life but they will require the laptop back from you to wipe it clean and purge data from it as well as licenced software etc. Asking to buy it and being honest is not only the most ethical thing to do, but the smartest thing to do. (Not least because why would you want to keep an old worn out laptop over a brand new one?)

Before we even get to security controls, you will face a number of problems trying to swap out the machine for a new one. Getting the exact same spec laptop will be hard, first of all these spec machines are usually sold exclusively to enterprises, secondly the same models tend to have differences from year to year, the IT guys will probably intimately familiar with these differences.

I do not recommend saying your laptop was stolen, mature orgs will launch an investigation, data officers and legal teams could become involved, this will would mean there is a good chance that the police would be involved, so you would end up breaking a lot of laws, not least wasting police time.

In the same vain I do not recommend saying the laptop was broken, as the IT department will require the broken laptop back, to ensure that it can be safely disposed of.

Many security controls will dictate the requirement of an asset inventory of authorised devices, including the CIS critical controls, ISO27001 etc. This will mean there is a chance that each asset will be tracked and auditable against its MAC address (which will allow switches to only allow authorised devices on the network), device owner, hostname, serial number, and asset numbers. Additionally the laptop may be part of the orgs domain.

So if the goal is to get this “done in the most ethical way”, I think you will fail straight away. Proably a better way of saying it is to get it done in the least unethical way, as you would likely need to do the following:

  • Break the law
  • Circumvent the companies security controls
  • Breach your contract of employment
  • Break the orgs security policy
  • Break the orgs acceptable use policy
  • Break the orgs data handling policies

If the orgs has basic security controls in place (minus drive encryption) then you would also need to:

  • Source an identical laptop
  • Remove tamper proof asset tags and place them on the new laptop
  • Configure the new laptop to spoof the old laptops MAC address (Which would revert to the hardware address once reinstalled)
  • Change the serial number of the new laptop to that of the old laptop (This would need to be done in the BIOS and would probably require you to flash the BIOS)
  • Have the laptop reimaged with the orgs image and joined to the domain with the same hostname, which would require access to local admin right on the laptop, domain admin rights and/or the orgs imaging server

TLDR: If the org has some basic security controls in place then swapping one machine out for the other would not only break the law but would require considerable effort.

  • I was very clear above that I'm not looking to break the law or to keep the laptop. I'm asking because I like the thought project of "how do I fully impersonate another laptop." As a pentester this seems like a very useful skill set to have. So thank you for the parts of this response that are directed at that. You are right that lots of proprietary data are stored in the BIOS/CMOS. I wonder how complicated editing that code would be. Dangerous for sure.
    – bashCypher
    Apr 4 '18 at 15:02
  • Getting a particular kind of enterprise laptop isn’t that hard once that particular model has reached the age at which companies start phasing it out. Some companies specialize in selling refurbished second-hand enterprise IT products (which has been the source of every single laptop I have owned in the past ~20 years). Then again, if you can get the same model on the second-hand market, why bother with the company laptop at all?
    – user149408
    Jul 23 '20 at 11:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.