1

Some softwares such as Computertrace claim that it can survive on a laptop even if the thief successfully reinstalls the operating system, reformats the hard drive, or (in some laptop models) swaps out the hard drive. How could this happen? Won't all the data associated by the software with the computer be erased?

  • Can you list an example or two of actual program names? – DarthCaniac Dec 12 '14 at 15:56
  • I cannot substantiate this claim which is why it's a comment, but I would assume the tracing comes from a variety of methods outside of the standard OS (thus harddrive). For instance, you could simply put a gps chip on the motherboard and ping it as necessary. Software-wise, you could potentially add some firmware to the motherboard and components that would survive a standard reformatting. This software could be something as simple as a quick ping to an auth server somewhere... – Matthew Peters Dec 12 '14 at 16:11
3

Some software vendors partner with BIOS makers (e.g. Absolute) so that even if an operating system is re-installed, on network connection, the BIOS may be able to send back relevant information. Many of these products are gimmicky, for example LoJack can be blocked at a firewall/network level that will disallow it from phoning home.

These types of software are primarily aimed at someone needing low level security versus highly secured laptops/network/data whose attackers are determined threat actors. Meaning, they're aimed at someone likely to be exposed to say common theft (drug user, someone taking it to a pawnshop), versus someone on a state level who would likely remove the disk for data. (Remember data is worth a lot more than a laptop).

EDITED

I needed to expand on this a little on the downfalls of using applications like these. When applications like these DO detect the location of a laptop, the reality is, what can they do, and what are they determining for you? They will retrieve a network based location nothing more. They will not give you information on how to get the device back, so most offer a "wipe data now" feature, which works (again) for low level attackers. The reality is, they will return output to you stating: "Your machine is located on network 10.10.10.1" which means little given that any ISP will not give you information on say one of their users using DHCP on that network. For that you would need a court order.

Nowadays, you can modify Team Viewer to act as a similar "phone home" application if you modify your registry. In modifying your registry, you can remove the visuals showing Team Viewer from the toolbar, from the process manager, and so forth. Malware authors have taken to do this at times.

  • 1
    Yeah, the key here is that these methods are not foolproof and often times just gimmicks... Bottom line is that if a knowledgeable attacker has physical access to a device, they can most often do whatever they want. – Matthew Peters Dec 12 '14 at 16:15
0

Some laptops are equipped with Intel Anti-Theft technology (part of vPro, see a guide here).

The features are built directly into the processor and the BIOS and can take separated control of the on-board NIC, Wifi card and 3G modem independent of the OS. Technically, once setup (inside the OS), the features don't even need a disk to run.

The concept is similar to Baseboard management controllers commonly found on servers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.