4 ms·
Gift HN: tund - SSH to your stolen laptop
- w1ntermute 16y agoReminds me of a talk from this year's Defcon: http://www.youtube.com/watch?v=U4oB28ksiIo http://www.youtube.com/watch?v=U4oB28ksiIo
- aphyr 16y agoThat's exactly my motivation. I've been using these tunnels for a while, but I've never seen it packaged up neatly for anyone to use.
- w1ntermute 16y agoI think the ideal setup would be to have your laptop boot into a decoy "usable" install boot by default (autologin to admin, adjustable network settings), and have your actual install encrypted and completely locked down (i.e, have GRUB boot the decoy install without showing the menu, so you'd have to press Esc to show your other install). That way, the tunnel wouldn't be running all the time, but if someone were to steal your computer, it would be available right away. For travelers, it'd also be useful at customs, since you could just show them your decoy install without raising any suspicion. And of course, having regular offsite backups is a necessity regardless of what approach you take. This should only be a method of getting your hardware back, not your data.
- paulgerhardt 16y agoThis is actually surprisingly hard to do with Macbooks. TrueCrypt currently only supports whole disk encryption for OSX and PGP Whole Disk Encryption's partition encryption is still somewhat experimental. Even if one does get this working, one needs to chain load PGP's BootGuard decrypter after one selects the alternate partition using the default EFI Boot screen when holding the option key - which the relevant bits for EFI configuration are for the most part undocumented and chainloading is not "supported" by the official PGP tools. The next best option seems to replace EFI Boot with rEFIt and clone the behavior... I can go on, but maybe you're beginning to see why this quickly turns into a bit of a rabbit hole.
- w1ntermute 16y agoWell, I was thinking of doing this with Linux, since that's what I use. I'd have Windows be the decoy install and use LUKS for dm-crypt to encrypt the Linux install at the system level. And setting up the default boot with no countdown in GRUB is trivial. All the pieces are there, and while there's no definitive guide on how to do it, I don't reckon it would be very difficult. Since I don't use Macs, I have no idea whether this approach would be feasible for them as well. The main thing holding me back is that now that I've moved to an SSD, my laptop only 64 GB of space, so I'd rather not waste 10 GB on a decoy Windows install. Perhaps once I get a bigger SSD.
- evilduck 16y agoMy Cr-48 works like this now that I installed Ubuntu on it. Outside of developer mode, it only boots ChromeOS, in developer mode, I've set it up to still boot ChromeOS by default and I've got to run a pretty cryptic command to set the boot priority to Ubuntu. To the layman, the machine wouldn't appear to be anything but ChromeOS. Being cloud based, it's a great decoy OS (but provides no theft recovery options).
- borism 16y agoI have installed Adeona (http://adeona.cs.washington.edu http://adeona.cs.washington.edu) too previously, but I don't exactly understand how will my laptop connect to the internet when stolen?
- aphyr 16y agoThis tool won't handle the connection management for you. You could scan for unsecured wifi networks periodically and connect to them. I'm just presuming a thief will log into my laptop's passwordless account, and network-manager will handle the rest.
- borism 16y agoWell, disabling passwordless accounts is one of the first things I do with my computer. I wonder if there are scripts that will connect to unsecured networks, whether it's a good idea and how good electronics thieves are at countermeasuring such tools (which is pretty trivial).
- aphyr 16y agoI should clarify: the passwordless account is a honeypot. It's isolated from my personal account and everything important. The only point is to encourage the attacker to use the computer instead of reformatting it, so I have a chance of recovering the hardware.
- samuel1604 16y agohey this is just a ruby wrapper to ssh -R or am I missing something ?
- aphyr 16y agoYup, coupled with a little init script and instructions for use. Oh, and this particular method can't be used to log into your forwarding host, due to the construction of the public key. Only wrote the script so I could add network topology reporting as well, so it can submit local MACs. Oh, and maybe automatic wifi scans. Figure you could plug those into google's geolocation services for street-level accuracy.
- logophobia 16y agoHow exactly? Because that would be the interesting part of the script. Is the forwarding host chrooted/jailed?
- aphyr 16y agoI do a few things. 1. The forwarding user has no group access, and not even write permission for its own home directory. 2. Shell is /bin/false, password is disabled. 3. The SSH public key format actually takes options (man ssh-keygen, -O) which allow it to only be used for port forwarding. Usually I go through the whole chroot rigamarole, and you certainly could here, but I got lazy and I think these directions will suffice for most people. This makes me reasonably happy about having a passwordless login to one of my servers.
- rw2- 16y agoYeah. It's yet another newbie script hyped@HN. :-(
- xenophanes 16y agoIt's good for newbies to make code public and start trying to participate in the community. That's how they become experts!
- ihodes 16y agoI'd think that the abuse of a backdoor into your computer is more likely than your laptop being stolen. Would anyone else be uncomfortable installing this on your machine, or am I a little paranoid? Regardless, I think it's a neat idea. I'm no security expert, by any stretch. Thanks for the utility!
- aphyr 16y agoAll this does is make an already available service (SSH) available at a predictable location. You still need to use a password, RSA/DSA keys, or other methods to log in.
- ihodes 16y agoRight, but you're connected to a "known" host you need to keep secure as well. So you have two machines to worry about, right? I also am not one to keep more sshds running than I need to—but I guess the chances of this being exploited are slim. Are they as slim as having your laptop stolen, though? (Genuinely curious—this seems like something you'd want to consider before using something like this.) But absolutely, it isn't like you've left an open door into your computer.
- aphyr 16y agoIs it more likely? That depends on how often you leave your laptop unattended. :) I, and pretty much every hacker I know, have some machine they can SSH to on the internet, somewhere. The only added risk is exposing your laptop to an attack against the SSH daemon, which involves either weak passwords, weak/unsecured keys, or an SSH server vulnerability. The first two are easily mitigated. The third is incredibly infrequent, and when it does happen, you've got bigger problems to worry about. Almost all SSH attacks target port 22, not a random high port, so you're unlikely to even see connections to that tunnel in the first place. Finally, you don't even need to trust the remote machine, since SSH will authenticate the laptop's host key through the tunnel. MITM attacks are possible against SSHv1, but pretty much everyone is on v2 these days.
- chrisbroadfoot 16y agoThese seem to do the same (or thereabouts) thing: http://www.harding.motd.ca/autossh/ http://www.harding.motd.ca/autossh/ http://freshmeat.net/projects/rstunnel/ http://freshmeat.net/projects/rstunnel/
- leif 16y agoNot the same thing. This is meant as an initscript to set up a port forward, autossh/rstunnel just watch an ssh connection you initiate and restart it as needed. You could use autossh/rstunnel to implement this though.
- dotBen 16y agoThis is a great hack/proof-of-concept but for anyone remotely concerned about the integrity of their data in the event of a theft, I can't recommend something like PGP Whole Disk Encryption (http://www.symantec.com/business/whole-disk-encryption http://www.symantec.com/business/whole-disk-encryption) enough. There are other options, including free ones on Linux, but for Mac I think this is the best implementation. With my laptop insured and my data unrecoverable the package gives me total piece of mind.
- jacquesm 16y agoGreat little trick, unfortunately most laptops are formatted right after being stolen to be re-sold. Unless your laptop was stolen with the express purpose of blackmailing you or because it is known to have juicy data on it the chances of it coming alive long enough for you to connect back to it are slim to none. Even so every little bit helps, if this aids in the recovery of a few laptops and apprehension of the perps then so much the better. If your laptop does get stolen keep a close eye on auction sites, ebay, craigs list and the like, chances are it will turn up there within hours of being stolen.
- aphyr 16y agoI have a particularly ingenious defense to prevent reformatting: I have a 3,1 Macbook Pro with a Superdrive. Not only is it incapable of reading any optical media, but getting your disc back from the furry recesses of its lair is almost impossible.
- timdoug 16y agoHa! I understand entirely. I have the same hardware, and I'm replacing the (now broken) optical drive with an MCE OptiBay and an SSD currently in the mail.
- weaksauce 16y agoI did the same. Watch out for 1.7 fw upgrade for the sata bus. My mbp couldn't handle the amount of data sent and as a result would crash every time I would install os x. Downgrading the firmware to only allow for 1.5Mbps worked well and it is what I am currently running. Email me if you need a link to the downgrade.
- moe 16y agoDon't forget to disable the USB ports with superglue! ;-)
- rorrr 16y agoIs there anything like this for Windows? I already installed Prey and LogMeIn, but there's no way to silently execute commands remotely.
- Vivtek 16y agoI think you'd need to write your own shell-like daemon for Windows. I've considered doing that for my home network just so I could use some of the family's machines when they're away, etc. But since Windows doesn't come with a real shell built in, rolling your own would be your only real recourse.
- nitrogen 16y agoWhen I was in high school, people used a tool for Windows called Fictional Daemon to get a remote telnet server that could access a command prompt, start, stop, and list running tasks, etc.
- thwarted 16y agoMy laptop runs openvpn as a daemon using key authentication connected to my home network. Thisis mainly so I can access my home network remotely, but it works the other way also, letting me in to my laptop when its not in front of me. Openvpn as a daemon can also be configured to reconnect when it detects that network configuration has changed, so it is completely, transparently portable between whatever network my laptop is on, as long as that network has internet access. If I loose the laptop, I can just revoke the key it uses to connect.
- leif 16y agoThis ruby code hurts my brain, mostly because it tries to be too cute (if you want to do configuration in a ruby script, aren't you supposed to use yaml or something?). Why not just a shell script? #!/bin/sh LOCAL_HOST=localhost LOCAL_PORT=22 HOST=remote.com USER=tunnel SSH_PORT=22 FWD_PORT=2222 OPTS=-gN INTERVAL=300 IDENTITY=/etc/tund/key while true do ssh ${OPTS} \ -p "${SSH_PORT}" \ -i "${IDENTITY}" \ -R "${FWD_PORT}:${LOCAL_HOST}:${LOCAL_PORT}" \ "${USER}@${HOST}" sleep ${INTERVAL} done
- rlpb 16y agoI wouldn't trust this for security reasons. You're relying on the "allow everything except for what I thought of to lock down that an attacker might do" principle, instead of the "deny everything except what I explicitly allow" security principle. For example: in addition to allowing you to tunnel into your stolen laptop, you're also giving the thief permission (and the key) to use your server as a proxy. ssh can be locked down further than in your instructions, but I wouldn't rely on it.
- bcl 16y agoAnd how is this supposed to get launched when you've encrypted your laptop's harddrive? ;)