Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A friend of mine just had her Macbook stolen. Her Dropbox account is still working on the Macbook, so she can see each time the Macbook comes online, and she can get its IP address.

She has given this information to the police, who say it may take up to a month to get the real location from the IP address. I was wondering if we could help find the laptop, as then the person with it could be arrested now for handling stolen goods (otherwise they might reinstall it before the police catch them).

Here are the facts about the stolen Macbook:

  • It is running OS X, but I'm not sure exactly which version (I will find out though).
  • There was only a single user account, with no password, and with admin privileges.
  • The original owner's Dropbox is still synchronizing, which gives us the IP address each time it comes online.
  • The original owner isn't a techie, so she's very unlikely to have turned on any of the remote control features like SSH, VNC etc (I've e-mailed her to ask).
  • She does not use iCloud or the .Mac service.

I was considering pushing an enticing file into Dropbox to get the user to click on it. I'm guessing I'll only get one shot at this, so wanted some ideas on the best thing to do.

My ideas so far:

  • Install some sort of key logger to send all the info back to the owner. Is there any way to do this without the user being made aware?
  • Make the file a shell script to slurp up as much useful info as possible, e.g. browser history, look for iPhone backups, etc. I'm not sure of the best way to send this info back though. It sounds like I might be able to use the mail command (to a free e-mail account of course)?
  • Maybe turn on remote management. Is there a way to do this without user accepting security popups?

Does anybody have any tips here? I've written plenty of shell scripts, but was wondering if other OS X options might be better, e.g. Applescript? Has anybody got any better ideas than pushing a Dropbox file to it?

I know this question is basically about writing a form of malware, but I'd love to be able to emulate my hero from the What Happens When You Steal a Hacker’s Computer DEF CON lecture.

We'll make sure to check with the police before we do anything to ensure we don't break any laws.

share|improve this question
1  
Not that this helps recover the laptop, but there is an app that could help: hiddenapp.com; preyproject.com ; orbicule.com/undercover/index.html –  KM. Nov 9 '11 at 20:23
    
Is SSH set up on her computer? If so, Dropbox can give you the IP of the computer so you can transfer files, remote wipe, install keylogger service, etc. –  MBraedley Nov 9 '11 at 20:32
    
I very much doubt she has SSH running. I asked her specifically about that when I e-mailed her, and I've updated the question above to say that now. –  Dan J Nov 9 '11 at 21:05
2  
If she uses iCloud, is Find my Mac maybe activated? Or Back to my Mac? Go to iCloud.com, log her in, and click Find my iPhone, then select the Mac in the list. –  Daniel Beck Nov 9 '11 at 22:25
1  
Not quite true: if the Mac was password protected then we would never have been able to get the IP address from Dropbox. So, this question does helpfully tell people to give the attacker a way to use the machine, and use a service like Dropbox to get the IP when it does come online! –  Dan J Nov 10 '11 at 17:15
show 7 more comments

migrated from stackoverflow.com Nov 9 '11 at 19:13

This question came from our site for professional and enthusiast programmers.

6 Answers

up vote 11 down vote accepted

I remember watching that Dr. Zoz video. Good stuff.

It sounds like you're competent with shell scripting and just need an attack vector. The key to doing something similar to what Zoz did is getting SSH access. Unlike his situation, where the thief was using a dialup modem, it's almost certain, since newer Macs don't do dialup, that the thief is using a broadband connection, and is behind some kind of NAT router.

Even if SSH were enabled on the machine, port forwarding would have to be set up on the router for you to access the machine's SSH listening port from the outside. The upside of a broadband connection is that the IP address will almost definitely change less often than with dialup.

If I were in your position, holding the thief's IP, I'd first try to log in to the web interface of their router and see what I can do from there. It's amazing how many people leave their default router/modem passwords in place, and there are lists online where you can find default passwords for most major manufacturers.

Once inside, check the DHCP client listing on the router and see if you can find the MacBook. A lot of routers will show MAC (hardware) Adress, assigned internal IP address (192.168.1.x most often) and most importantly, the machine name.

Figure out which IP is assigned to the MacBook and then set up a port forward to it in the router's settings. Use some external port other than 22, (port 2222 for example) and forward that to port 22 of the MacBook's IP.

Many routers have SSH access turned on, so accessing the thief's IP @ port 22 might get you to the router shell rather than the machine shell. Now you should have a port on the thief's external IP (that you got from Dropbox) which will get you directly to the port SSH should be bound to on the MacBook. Except SSH isn't turned on yet.

This part requires some action from the thief. I like the email idea but it requires that your friend be using Apple Mail. A better approach might be uploading a tempting .app file to Dropbox that will turn SSH (Remote Login) on.

You can do this through a shell script, but doing it through Applescript, saving the Applescript out as a .app and giving it a nice icon will all go a long way towards fooling your mark and not giving yourself away.

Here's the Applescript code to turn Remote Login on:

do shell script "sudo systemsetup setremotelogin on" user name "Friend's Username" password "Friend's Password" with administrator privileges

This bit of code will return a string with the machine's serial number that you can email to yourself if you want to do that:

do shell script "sudo system_profiler |grep \"r (system)\"" user name "Friend's Username" password "Friend's Password" with administrator privileges

I would write the applescript so that it turns on Remote Login, does whatever else you need. Try not to script the GUI or any applications besides the shell as this will raise suspicion. At the end display a message to the effect of "This application cannot run on this Macintosh." with a "Quit" button to reduce suspicion. Once the script is working in AppleScript Editor, save it out as a run-only .app file.

Try disguising the .app as a popular game, Plants vs. Zombies or Angry Birds or something. You can export the icon from the real game's .app and put it into the .app you export from Applescript. If your friend got a good look at the thief, you can socially profile him/her and disguise the .app as something else they might be interested in.

Provided that you can set up the port forward (your mark doesn't enforce proper security practices), and you can get him/her to run the application, you'll have full SSH access to the machine and can continue looking for clues without immediately giving away your presence. This also requires that the mark doesn't get tired of Dropbox's Growl notifications and quit it, so I'd advise your friend to stop saving files to her Dropbox for a while.

Note: If the thief disconnects from their ISP and reconnects, they'll get a new external IP. Add a file to Dropbox and wait for it to sync. This should get you the updated IP.

Note 2: If the user doesn't connect to the router with the MacBook for a certain amount of time (usually 24 hours) the DHCP lease for the internal IP address that was assigned to the MacBook will expire. Most likely it will get the same IP address next time it connects, unless another device is introduced into the network. In this event you'll have to manually log back into the router and modify the port forward.

This isn't the only means of attack, but this is what I'd do the second I realized the IP was still being updated via Dropbox. Good luck!

EDIT: The "administrator privileges" at the end of each "do shell script" line is very important. The user will be prompted for your friend's admin password and the script will fail, if you do not include username and password inline.

share|improve this answer
    
Do these work with empty password? I think I remember some things not working properly if you don't have a password. –  Daniel Beck Nov 10 '11 at 21:28
    
Thanks for pointing this out. I didn't even realize OS X lets you create an account without a password :S. I assumed he meant that Auto Login was enabled. You can make the script set a password for her account before running the necessary commands, using do shell script "dscl . -passwd /Users/Username '' newpassword". The '' represents the current password (empty string). Keep in mind that if Auto Login is not enabled, this will lock the thief out of the machine. –  Vickash Nov 10 '11 at 22:32
    
Thanks for an excellent answer! I'd forgotten that I would probably need to hack their router config to get remote SSH access to the Macbook. Legally I think it would be fine to reconfigure the Macbook with permission of the owner, but hacking a router would certainly be illegal (in the UK at least). If the police catch the thief, then they could end up seizing the router as part of their investigation... –  Dan J Nov 15 '11 at 2:26
    
This is really bad advice. Not least, what if the thief resets your email password (say, using your secret questions), and then opens the virus email up on another machine, like one at a cyber cafe ? What if you hack into their router, then find they're sitting at starbucks, now you've broken into a third party and are entirely responsible for the fallout from that. Imho suggestions of vigilantism are never good advice, which is exactly why in my answer to this question i advise letting the police do their job. –  Sirex Nov 25 '11 at 7:53
    
You can get rid of the "hack into their modem" step by having a VPS or any external computer with a known IP. I usually use openvpn for connecting to machines that are behind NATs over ssh by connecting them to a VPN and then getting at them through there. There are other ways to do it, like for example run a script that periodically downloads and executes shell scripts from said external server and mails the results to you. Essentially, you now have the target machine initiating the connection. This considerably reduces the number of things that have to go right for this to work down from: de –  entropy Jan 10 '12 at 8:32
show 1 more comment

Send an e-mail from an aunt wishing her happy birthday and that the aunt would like to send her a gift card from Abercrombie & Fitch+ for her birthday but needs the correct address. Then it's up to the thief to fall for this low budget Nigerian scam trick.

+Or some other famous brand

share|improve this answer
    
I don't think the thief has access to her e-mail, but it's a good point - I should check... –  Dan J Nov 9 '11 at 21:02
    
She didn't use the mail program in OSX? –  ZippyV Nov 9 '11 at 21:41
1  
If you go for the mail trick make sure to send more than 1 e-mail from multiple people to make it less suspicous. –  ZippyV Nov 9 '11 at 21:42
    
FYI, she doesn't use the Mail program in OS X, just webmail. If it was me though, I'd prefer to change my mail password immediately to try to disable the thief accessing my mail... –  Dan J Nov 15 '11 at 2:16
add comment

Honestly, contact Apple. They may have information on how to track down their computer. I'm sure you aren't the first person who's had their Mac stolen.

Edit: I looked into Apple's Support Page and it is actually less helpful then I thought it would be. What you could try is using iCloud to remotely lock out your Macbook.

Daniel Beck actually tested it out and commented that:

"While not a "secret Mac backdoor", and [though it's] not really helpful in actually getting the computer back, it works quite nicely to lock people out of your Mac. Your comment prompted me to try it and it's actually quite impressive. The screen goes white, it shuts down the computer and requires a six digit code you specified earlier via iCloud to resume the normal boot process."

share|improve this answer
4  
I think this won't help - they'll probably suggest you buy a new one. –  Simon Sheehan Nov 9 '11 at 22:30
3  
Yep -- they'll just activate their secret Mac backdoor and will have full access to the system. –  Daniel Beck Nov 9 '11 at 22:34
    
@DanielBeck is that true or are you trolling? If it is true, a reference would be nice for such a significant claim. If you're trolling, please remove your comment, as it's not helpful to provide misinformation. –  nhinkle Nov 10 '11 at 2:35
2  
@nhinkle Sarcasm is not trolling. This is not trolling, as it's neither off topic nor intended to provoke emotional responses. Using an ironic exaggeration of the claim in this answer I point out that there is no way for Apple to help here. They might have IP addresses, but those are already known. I will not remove my comment, as it has a real, on topic purpose: disagreeing with this answer. We can always discuss this on Meta though if you want to. –  Daniel Beck Nov 10 '11 at 8:04
2  
@ChrisM While not a "secret Mac backdoor", and not all really helpful in actually getting the computer back, it works quite nicely to lock people out of your Mac. Your comment prompted me to try it and it's actually quite impressive. The screen goes white, it shuts down the computer and requires a six digit code you specified earlier via iCloud to resume the normal boot process. +1 if you include this in your answer. –  Daniel Beck Nov 10 '11 at 18:51
show 4 more comments

This doesn't directly help this situation, but for the future and for all others who have Macbooks downloading Prey can give you an advantage in tracking the thief. Prey will provide a report including the location and a picture of your thief and this, combined with help from the police, can get you your laptop back. Be aware that many police departments will not help unless you file a stolen item report with the police when you lose the computer; so do this as soon as possible.

share|improve this answer
    
Competitors include hiddenapp.com and orbicule.com/undercover/mac (I'm a customer of the latter, and in limited testing, i.e. "demo mode" locating and camera pictures, no contacting the police, it worked quite well). –  Daniel Beck Nov 10 '11 at 20:32
    
Do you know how infuriating answers that being with "this won't help in this situation..." are when you have you're laptop stolen :) –  Jonathan. Jan 15 '12 at 23:52
add comment

Given the IP address, you can probably work out which ISP it is connecting through or more.

Go to: http://remote.12dt.com/lookup.php

Enter the IP address.

e.g. Suppose the ip address is: 203.97.37.85 (this actually is the web server address of an ISP in NZ).

And it may show a company or ISP domain name. If it looks like it's a company name then you're really narrowing in fast. But if it is the name of a network provider (in this case above - TelstraClear NZ).

In addition to the above I'd do a whois lookup. Use one of the online whois lookup tools.

http://networking.ringofsaturn.com/Tools/whois.php

And you'll get back lots of info. But you can see that it's an address within the TelstraClear network.

#
# Query terms are ambiguous.  The query is assumed to be:
#     "n 203.97.37.85"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=203.97.37.85?showDetails=true&showARIN=false&ext=netref2
#

NetRange:       203.0.0.0 - 203.255.255.255
CIDR:           203.0.0.0/8
OriginAS:
NetName:        APNIC-203
NetHandle:      NET-203-0-0-0-1
Parent:
NetType:        Allocated to APNIC
Comment:        This IP address range is not registered in the ARIN database.
Comment:        For details, refer to the APNIC Whois Database via
Comment:        WHOIS.APNIC.NET or http://wq.apnic.net/apnic-bin/whois.pl
Comment:        ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment:        for the Asia Pacific region. APNIC does not operate networks
Comment:        using this IP address range and is not able to investigate
Comment:        spam or abuse reports relating to these addresses. For more
Comment:        help, refer to http://www.apnic.net/apnic-info/whois_search2/abuse-and-spamming
RegDate:        1994-04-05
Updated:        2010-08-02
Ref:            http://whois.arin.net/rest/net/NET-203-0-0-0-1

OrgName:        Asia Pacific Network Information Centre
OrgId:          APNIC
Address:        PO Box 2131
City:           Milton
StateProv:      QLD
PostalCode:     4064
Country:        AU
RegDate:
Updated:        2011-09-24
Ref:            http://whois.arin.net/rest/org/APNIC

ReferralServer: whois://whois.apnic.net

OrgAbuseHandle: AWC12-ARIN
OrgAbuseName:   APNIC Whois Contact
OrgAbusePhone:  +61 7 3858 3188
OrgAbuseEmail:  [email protected]
OrgAbuseRef:    http://whois.arin.net/rest/poc/AWC12-ARIN

OrgTechHandle: AWC12-ARIN
OrgTechName:   APNIC Whois Contact
OrgTechPhone:  +61 7 3858 3188
OrgTechEmail:  [email protected]
OrgTechRef:    http://whois.arin.net/rest/poc/AWC12-ARIN

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: https://www.arin.net/whois_tou.html
#

% [whois.apnic.net node-1]
% Whois data copyright terms    http://www.apnic.net/db/dbcopyright.html

inetnum:      203.97.0.0 - 203.97.127.255
netname:      TELSTRACLEAR-NZ
descr:        TelstraClear Ltd
country:      NZ
admin-c:      TAC3-AP
tech-c:       TTC7-AP
notify:       [email protected]
mnt-by:       APNIC-HM
mnt-lower:    MAINT-NZ-TELSTRACLEAR
status:       ALLOCATED PORTABLE
changed:      [email protected] 19960101
changed:      [email protected] 20010624
changed:      [email protected] 20041214
changed:      [email protected] 20050216
source:       APNIC

role:         TelstraClear Administrative Contact
address:      TelstraClear Limited
address:      Network Planning
address:      Private Bag 92143
address:      Auckland
country:      NZ
e-mail:       [email protected]
phone:        +64 9 912 5205
trouble:      For network abuse contact:
trouble:      [email protected]
trouble:      +64 9 912 5161
trouble:      For 24/7 after-hours NOC contact:
trouble:      +64 9 912 4482
notify:       [email protected]
tech-c:       TTC7-AP
admin-c:      TAC3-AP
nic-hdl:      TAC3-AP
mnt-by:       MAINT-NZ-TELSTRACLEAR
changed:      [email protected] 20041125
source:       APNIC

role:         TelstraClear Technical Contact
address:      TelstraClear Limited
address:      Customer Help
address:      Private Bag 92143
address:      Auckland
country:      NZ
e-mail:       [email protected]
phone:        +64 9 912 5161
trouble:      For network abuse contact:
trouble:      [email protected]
trouble:      +64 9 912 5161
trouble:      For 24/7 after-hours NOC contact:
trouble:      +64 9 912 4482
notify:       [email protected]
tech-c:       TTC7-AP
admin-c:      TAC3-AP
nic-hdl:      TTC7-AP
mnt-by:       MAINT-NZ-TELSTRACLEAR
changed:      [email protected] 20041125
source:       APNIC

It'd be a matter for the police at that point. I doubt the ISP is going to tell you who's logging in at that point.

If you do get the laptop back, or if you end up getting a new one then install preyproject onto it. It'll make things much simpler later. You can even take a picture of the offender :)

share|improve this answer
    
Thanks! I should probably have said in the original question that I already did the WHOIS lookup and a tracert, but it doesn't give me a specific enough location. The tracert doesn't even get all the way to the target IP, presumably due to an ISP in the middle blocking the pings. –  Dan J Nov 11 '11 at 17:09
add comment

There's tons of things you could do, and I highly recommend you do none of them. Let the police do their job and make the arrest.

It's not the clever answer, but its the right one, imho.

-- not least, if you mess with it remotely and they think you're onto them they'll likely smash the laptop up into bits.

share|improve this answer
    
no idea why this got downvoted, really. –  Sirex Nov 25 '11 at 7:41
3  
I didn't downvote, but I think this is better suited as a comment since it provides no real information. If you had additional data, perhaps regarding the success rate of local police recovering stolen PCs, then it'd be a good answer. Right now, it's just an opinion. –  Paperjam Jan 9 '12 at 18:50
    
My answer to "what should i do" is nothing, or at least nothing illegal. Claim on the insurance and restore from backup, (and use disk encryption in the future), that's why you have them. I'd be surprised if the success rate of the police hunting down stolen goods is a higher than the likelihood an aggrieved innocent third party would press legitimate charges against the actions in the accepted answer. In this case the OP even has some information to speed the police process. –  Sirex Jan 10 '12 at 8:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.