#preyproject

Emprendimiento chileno permite controlar hasta 50 dispositivos #PreyProject

Con la idea de ser un aporte al trabajo remoto de los usuarios, el emprendimiento chileno, Prey Project ha lanzado una modalidad que permite controlar hasta 50 dispositivos gracias a una versión reducida de su sistema de gestión de equipos móviles.

Y es que uno de los temores que más sufren las empresas en medio de esta crisis es el manejo y administración de sus dispositivos, es así que al no…

My computer was recently stolen from a hotel in Ohio.  The family and I were driving back and forth to Indiana from NYC and sometime during our moving out of the Fairfield Inn we'd stopped in, our computer disappeared.  We complained to the hotel management, who interviewed all their housekeepers and came up empty.  We stopped short of reporting it to the cops, under the assumptions that we didn't want to add more time to our already lengthy trip and that there was no way we'd ever get it back. I bit the bullet and spent a hefty amount on a new Macbook.

BUT

Before it was stolen, I'd installed PREY on the computer.  And two days ago, PREY sent me an email saying that someone connected to the internet with my computer.  PREY surreptitiously turned on the computer camera and sent me a picture of the new user, a screenshot of the desktop, and a ton of their data.  The upper right hand corner of the screenshot gave the wifi name, which was RonanMaloney88 (name changed), and the username was also RonanMaloney88.  I searched the internet for a Ronan Maloney in Ohio and got only one result that came with a home address and an age: 26.  A 26-year-old would have been born in 1988, hence the 88 in his username.  I called the cops in that Ohio town.  They tracked the dude down at a new address and sent a car to his house, where they found him and his girlfriend.  His girlfriend had worked at Fairfield Inn as a housekeeper and immediately confessed to stealing the computer.

BLAM.

My computer is currently sitting in evidence at the Belmont Sheriff's office.

A bunch of people offered to help me out and lent some technical expertise to the cause.  THANK YOU Noah Forman and Alex Khurgin.

Most of all, thanks to Deputy Weekley and also to Preyproject.com, for which this tumblr post is essentially an advertisement.  INSTALL PREY ON YOUR LAPTOP.

Cómo funciona?

I've been hearing things about Prey Project, which is an open-source recovery tool for mobile computers (and handsets). I've been skeptical because in order for Prey to really work, it requires you to ignore best practices for securing your system. My conclusion is that if you want to use Prey, your computer needs to be about as secure as your average Bait Car.

Doesn't sound very reassuring does it?

This is a copy of my recent Reader Report: Security on MacInTouch. I was responding to a line from the Prey Project FAQ that reads:

Will Prey still phone home if there's no user logged in?

The answer is yes, since Prey runs in the background as the root (system) user.

My testing revealed this isn't accurate. I have not yet tried to validate if Prey will attempt to hit an insecure wireless network, but I will explain my test case:

Test system

MacBookAir4,2 running Mac OS X Lion 10.7.1

Local accounts like most people use, password required.

Whole-disk encryption "FileVault 2" active and enabled[1]

Remote server

created a lost.html as per Prey's instructions

configured smtp credentials for a gmail account

watched the prey agent check-in with the remote server to pull lost.html a few times[2]

Test Begins

Sleep the MacBook Air

Wait five minutes (per my configured check-in) to confirm sleeping as expected

Remove lost.html from the remote server per Prey's instruction

Wait another five minutes (still no GETs of lost.html)

Wake up the MacBook to a lock screen asking for my password

Wait five minutes (still no GETs)

Fail a couple of logins and then clicking to Switch User (still no GETs)

Login as my locked user

once logged in, my Keychain unlocks, and my WiFi connection is authenticated, lost.html gets pulled and it works as expected

Conclusion

Prey may work for people who rely on insecure wireless networks and don't protect their system with a password or any form of encryption of their data. I didn't test that (and if nobody else volunteers I'll do that too!).

I wouldn't recommend relying on Prey if you are security-conscious and leverage whole-disk encryption via FileVault 2 or other mechanisms, or use authenticated wireless connections. Doing so would require you to ignore best practices. I certainly wouldn't recommend a small business or enterprise use Prey.

I would rather a thief get a MacBook they have to re-image and that I'll never see again than let them have access to my data. Mac OS X Lion's "Samaritan" message lets you display a message on the login screen that is probably going to be more effective in getting your Mac back!

When iCloud is released the "Find my Mac" service may be a better option, it isn't known how that service will work. It's possible that the tight integration with iCloud will provide some level of accountability for devices you have associated with your ID and report them as stolen? Who knows!?

[1] If you follow Prey Project's advice and have an account that requires no login to "lure" people into using your Mac, you are negating whole-disk encryption. Don't follow their advice if you expect whole-disk encryption to encrypt your files, should your Mac be stolen.