12

I purchased a new laptop recently, and I'm working on hardening it. Specifically, I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen. The system runs Ubuntu 11.04 (Natty).

I've installed Prey on the machine, of course. I've also created a guest account that requires no password to log in, to give a would-be thief an opportunity to log into the machine so I can track him with Prey. (I've got some other pretty rad countermeasures on there too.) The last thing I want to get on there is a solid keylogger.

Does anyone have any keylogger experience? I've Googled around and know that there are options, but I was hoping to benefit from the community's expertise on the issue. Some options seem to have disappeared from the Canonical repositories recently (I was looking at lkl in particular), and I'm not clear what the current leaders are.

Do you have any recommendations as to which is the current "premier" Ubuntu Keylogger?

For what it's worth, this whole venture was inspired by the fantastic "Pwned by the Owner" talk from Defcon 18. It definitely warrants a watch if you've never seen it before.

  • 3
    Downside to this is you may be logging your passwords in plaintext. – Antonius Bloch May 29 '11 at 4:39
  • 2
    I'd like to make a couple recommendations: set a bios password and boot set only to HD, full disk encryption. Give passwords and keys in a sealed envelope to your wife/trusted pal. – Antonius Bloch May 29 '11 at 4:44
  • @Antonius Bloch I'm likely going to install the keylogger to a truecrypted volume or something. That way, it will be securely disarmed until I explicitly arm it (remotely) in the event that the laptop is stolen. That should nullify the very legitimate concern you raised about logging my own passwords. Thanks! – Chris Allen Lane May 31 '11 at 0:19
4

I would go with LKL myself, but that is very subjective - others will prefer something else, I'm sure.

It doesn't matter whether or not it is in a repository, in fact I would want to build something like that myself from source.

There is of course a risk with having a keylogger installed - it could be used against you!

  • 2
    If you build it yourself, you also take on responsibility for building it right, keeping it up-to-date with security patches, etc. Not to be taken lightly.... – nealmcb May 28 '11 at 18:38
  • @nealmcb - definitely! – Rory Alsop May 28 '11 at 20:18
  • LKL logs physical keyboard strokes, anyone know anything that might log things like remote ssh sessions? – Antonius Bloch May 29 '11 at 4:41
  • 1
    Auth.log for the logins – Rory Alsop May 29 '11 at 13:53
  • Good points here. For the time being, I'll probably at least start with trying to build LKL from source. I'm going to install it into a truecrypted volume, to keep it from being used against me! – Chris Allen Lane May 31 '11 at 0:23
5

I'm interested in increasing my chances of recovering the machine in the event that it's ever stolen.

I like Rory's answer. However, I think there are three risks involved here: the risk of losing your hardware, and the risk of losing your data, and the risk of your private data being exposed. Solutions which attempt to recover the machine are only solving one risk.

The risk of data loss can be mitigated by a good data backup system.

The risk of data exposure may be mitigate by good data protection: proper access controls, solid encryption, and good keys or passwords. The risk of data exposure may also be mitigate by destruction: remote wiping, conditional wiping, timed expiration. The final risk is the loss of your hardware.

When you have risk there are three options: mitigate the risk, assume the risk, and transfer the risk. You have already thought of some way to mitigate the risk of theft. However, you haven't covered a few of the most effective, which tend to be operation rather than technical.

Never leave your laptop unattended. If a thief has no opportunity, they can not steal your laptop.

When you are not using your laptop store it securely. At least use a locking cable attached to something unmovable. Or keep it in a locked drawer or cabinet. If you are not in a familiar place you can lock it in the trunk of your car.

Mark your laptop with your name in a way that is difficult to remove. You can have it etched into the case, or failing that large letters in permanent marker. It makes it harder for a thief to sell Chris's laptop, and if you put contact information as well it will help get it returned if you lose it.

Another way to deal with risk is assuming the risk, but I don't recommend doing that.

The final way to deal with risk is to transfer it. This is usually done by buying insurance. You can buy laptop theft insurance to cover the value of your laptop. If this is a personal laptop and you have homeowners insurance you may already be covered under personal property, or you may be able to add coverage to an existing policy for a small fee. I don't know insurance very well but I think renters insurance may act similarly to homeowners insurance. In any case you can check with your insurance agent.

  • 2
    There is a 4th valid response to a risk: remove the risk (e.g. dont have a laptop...). – AviD Jul 17 '11 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.