0

http://orbicule.com/undercover/mac/

I stumbled upon this page today and am intrigued by the service, it offers a lot of features that I have been interested in since my last computer was stolen in a burglary. Based on the information provided there, or through personal experience, is there any assurance that this software running on a macbook will

a) not be exploited by the company that provides the service

b) not make it easier for a third party to compromise my computer.

Thanks.

0

When it comes to security, assurance generally comes in the form of insurance. There are no guarantees of perfect safety in any security system whether computers are involved or not.

After a cursory glance at the product you are curious about, it appears that they offer services such as taking screenshots of what is happening on your computer so you can tell what the thief is doing. This means that the company has to have access to at least the portions of your computer that connect to the Internet and take screenshots. It is likely that they are also doing more under the hood, which means accessing additional parts of your computer. Whether or not they will only do this when you ask them is a matter of trust. Does this company have a good reputation? Do any of the reviewers seem technically and/or security inclined? Is the content of your computer something that could compromise just your pride, or your safety? At the end of the day, it is you, the computer user, who decides if this company is trustworthy enough. Any anti-theft software that communicates with the parent company (or anyone via the Internet) should make you stop and ask yourself the same questions.

As for the second part of your question, no. This product is for anti-theft, not general computer security. If you are concerned about third parties compromising your system you should look into security software, blocking third party cookies in all browsers, regularly updating all passwords you use, etc.

You mentioned that your last computer was burgled. While it is far from a guarantee, always register your Apple devices with Apple. Usually the police cannot find the stolen goods and the owners are out of luck. However, in the off chance that the police do find the goods and no longer need them for evidence purposes, Apple is good about connecting the serial number with the original owner. I have known a handful of people who have been reunited with their iMacs, iPhones, etc. one and half to two years after the theft.

Also look into a laptop lock, which is similar to a bike lock. Most desktops also have a slot which can be used to lock them to a desk. If a thief is serious and prepared, they can cut through the lock. However, the vast majority of security is making something such a pain to access that the hacker/thief doesn't think it's worthwhile to pursue.

0

Look at Privacy policy and Q&A:

Can someone else use Undercover to observe what I'm doing on my Mac?

No. Undercover is 100% secure. Only you can access your account and view your Mac's location.

How long and where is my information stored?

... Personal traffic between the Undercover Mac application, the Undercover servers and your browser is encrypted using highly secure end-to-end 128-bit encryption. Our U.S.-based hosting provider received ISO 27001 certification and has successfully completed multiple SAS70 Type II audits. Undercover uses the same hosting platform that is being used for sensitive medical information. You can rest assured your theft recovery information is safe.

a) This is illegal. This company presumably fears the law and reputation damage. They passed a bunch of certifications. I haven't heard of people taking them to court.

b) They said this is 100% secure.

That's all the info that you have to make a decision.

Truism: Installing this software will inevitably increase probability of a or b happening. Perhaps significantly, perhaps negligibly. Installing anything is a security risk, nothing is 100% secure.

Your job is to compare (chance of laptop theft) * (chance of successful recovery via the software) vs (chance of compromise via the software) and decide based on what wins.

0

The vendor getting a bunch of certification means they are trying very hard to improve perception. But if you don't trust the vendor, all other discussion is moot.

Even if you do trust the vendor, consider the following:

  1. This sort of software will get privileged access to various parts of your system. Even if the vendor has the best intentions, their own software can be compromised, indirectly letting an attacker access your system. Even if the vendor is honest, a third party can abuse an exploit in the vendors software to get to you. Since it adds a new attack vector, it can be considered to be increase the risk.

  2. It could very well increase the likelihood of a privacy breach. Consider, as an example, that many antivirus companies trade user data. Some, like Avast are open about it. But as recent news indicates, companies cannot be trusted to disclose everything that they do with user data. So assume that you just won't know if there is a privacy breach.

  3. Your trust in them is (should be) based on their current policy. They can change policy/strategy if it suits their business interests. There's also no guarantee (independent audit with complete access to the vendor's systems, etc.) that they actually follow their own policy. You don't even know if the whole company actually believes/practices the policy.

The bottomline is that yes, it increases both the security risk and privacy risk. But the important thing to understand is it is a tradeoff. When you access most webservices you trade personal data for it, when you hire a security guard, you give the guard privileged access which can be abused.

Lastly, consider what you really need this software for - to protect your hardware in case of theft. There's no guarantee that this will actually help you recover a stolen laptop. Thus, you can choose to do only one of the following - increase the odds of recovering your device in the event of theft, or increase the odds of your privacy being violated and your system compromised. So you need to compare the relative value of 1) the hardware and 2) the user data on it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.