3 ms·

$ crontab -e /3 * * * curl -m 5 http://myserver.com/ping.txt > /dev/null 2>&1 Maybe I'll get their IP address at least.

by paul 19y ago

$ crontab -e */3 * * * * curl -m 5 http://myserver.com/ping.txt > /dev/null 2>&1 Maybe I'll get their IP address at least.

qaexl 19y ago
Hey, good idea ... I'm going to do that.
nickb 19y ago
That's ok if you don't have a password on your account or you don't require a password to wake up from sleep. That's too dangerous so I recommend the following: Set your Mac to use Filevault and go to Security section and select "Require password after waking up from sleep" so if someone opens up your laptop, they'll be greeted with a login screen. Now you want them to reboot... What I did to make a 'honey pot' is this: I created a guest account (named it 'Krista') and that account doesn't require a password so if someone steals my laptop and reboots it, they'll be able to use this account. The account itself is locked down with very little permissions. I allow the use of a browser and the browser launches immediately after login (add it to Login items). The home page of the browser is set to my server's redirect page that uses meta refresh to immediately take the user to Yahoo. But I do get their IP. I also have curl set to ping a page every 20 min or so. You could pay some cash for Orbicule (they use your iSight to grab pics of a person sitting in front of the screen) etc but this method is more than good enough. A step-up would be to proxy all of the requests from the browser through the proxy you control... but I haven't found a nice proxy to install on a shared server. Unfortunately, I don't know of any method that would survive a reinstall of OS X but most thieves don't know how to do that anyway.
- imsteve 19y ago
  The cron daemon should be launched at a runlevel preceding anything windowing related, this is the default in all linux distros. So you shouldn't have to log to anything for it to be running. Also, if you have sshd running, which decent OS will have, then you can automatically take over the computer remotely. I'm sure this is easily applicable to OSX.
  - nickb 19y ago
    The point is that you want to give a reason to a thief to connect your laptop to the net. If a thief cannot log in and cannot even use a browser, what are the chances that he'll connect it to the net? Zero?! You want to give the thief something so they connect your machine to the internet for longer periods of time... and they can't compromise your user account and your files.
    - imsteve 19y ago
      > give a reason to a thief to connect your laptop to the net. How exactly does your strategy do this?
      - jgrahamc 19y ago
        One nice way to do this on a Mac is to leave the Guest account available. Even though the user cannot get into your account because of your uber-strong password and FileVault encryption, they can go into the Guest account and surf the web (and activate your LoJack).
staunch 19y ago
If you saw those requests from a bad guy you'd be wishing you could change it to: curl https://myserver.com/runme.sh 2>/dev/null|/bin/bash
tx 19y ago
There are about 3 or 4 companies who built products they sell for Windows that do exactly that: install a background service that keeps pinging their servers. Some courts had said that Microsoft was killing the competition by bundling "free" stuff into Windows. To me it looks the other way - their weak OS only gives people chance to make money by compensating for its deficits.
mohamed_rafique 19y ago
122.164.125.114
mohamed_rafique 19y ago
122.164.125.114

$ crontab -e */3 * * * * curl -m 5 http://myserver.com/ping.txt > /dev/null 2>&1 Maybe I'll get their IP address at least.

by paul 19y ago

$ crontab -e */3 * * * * curl -m 5 http://myserver.com/ping.txt > /dev/null 2>&1 Maybe I'll get their IP address at least.

qaexl 19y ago

Hey, good idea ... I'm going to do that.

nickb 19y ago

That's ok if you don't have a password on your account or you don't require a password to wake up from sleep. That's too dangerous so I recommend the following: Set your Mac to use Filevault and go to Security section and select "Require password after waking up from sleep" so if someone opens up your laptop, they'll be greeted with a login screen. Now you want them to reboot... What I did to make a 'honey pot' is this: I created a guest account (named it 'Krista') and that account doesn't require a password so if someone steals my laptop and reboots it, they'll be able to use this account. The account itself is locked down with very little permissions. I allow the use of a browser and the browser launches immediately after login (add it to Login items). The home page of the browser is set to my server's redirect page that uses meta refresh to immediately take the user to Yahoo. But I do get their IP. I also have curl set to ping a page every 20 min or so. You could pay some cash for Orbicule (they use your iSight to grab pics of a person sitting in front of the screen) etc but this method is more than good enough. A step-up would be to proxy all of the requests from the browser through the proxy you control... but I haven't found a nice proxy to install on a shared server. Unfortunately, I don't know of any method that would survive a reinstall of OS X but most thieves don't know how to do that anyway.

imsteve 19y ago
The cron daemon should be launched at a runlevel preceding anything windowing related, this is the default in all linux distros. So you shouldn't have to log to anything for it to be running. Also, if you have sshd running, which decent OS will have, then you can automatically take over the computer remotely. I'm sure this is easily applicable to OSX.
- nickb 19y ago
  The point is that you want to give a reason to a thief to connect your laptop to the net. If a thief cannot log in and cannot even use a browser, what are the chances that he'll connect it to the net? Zero?! You want to give the thief something so they connect your machine to the internet for longer periods of time... and they can't compromise your user account and your files.
  - imsteve 19y ago
    > give a reason to a thief to connect your laptop to the net. How exactly does your strategy do this?
    - jgrahamc 19y ago
      One nice way to do this on a Mac is to leave the Guest account available. Even though the user cannot get into your account because of your uber-strong password and FileVault encryption, they can go into the Guest account and surf the web (and activate your LoJack).

staunch 19y ago

If you saw those requests from a bad guy you'd be wishing you could change it to: curl https://myserver.com/runme.sh 2>/dev/null|/bin/bash

tx 19y ago

There are about 3 or 4 companies who built products they sell for Windows that do exactly that: install a background service that keeps pinging their servers. Some courts had said that Microsoft was killing the competition by bundling "free" stuff into Windows. To me it looks the other way - their weak OS only gives people chance to make money by compensating for its deficits.

mohamed_rafique 19y ago

122.164.125.114

mohamed_rafique 19y ago

122.164.125.114