Is It Stolen??

Discussion in 'Networking & Security' started by appatula, Apr 30, 2005.

  1. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    I recently bought a used Sony Notebook for a really great price that could not be passed up, is there any way to find out if its stolen? Someone told me that there are programs that can trace your IP information once online and then proceed to find the "thief" if a laptop is reported stolen but I dont want to be the one being called the thief if this is the case, Is there a way to find these tracking programs or any sign of funny buissnes? I just basically want to make shure someone didnt get ripped off down the line and the comp is on the "up and up" any help is appreciated.
     
  2. Kil4Thril

    Kil4Thril 2[H]4U

    Messages:
    2,974
    Joined:
    Sep 21, 2003
    Wipe it and reinstall.
     
  3. HTPC Rookie

    HTPC Rookie Gawd

    Messages:
    588
    Joined:
    Dec 24, 2004
    A lot of OEM notebooks and some desktop systems have a tiny partition on the drive that's inaccessable by doing a normal FDISK. I'm pretty sure that's where they put the info that will be sent out to check serial numbers against police reports.

    Have to use a disk utility to get to that one. Drawing a mental blank on what I used last time.
     
  4. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    Thanks guys but is there a way to see if any tracking software is installed such as Absolute Tracking or Trakion ect. because I dont want the law enforcment knocking on my door. HTPC Rookie is right about the partition I was reading about somthing like that on Absolute's website. What else can I do other than wiping? can I just find out of anything like that is installed to begin with?
    -Appatula
     
  5. draconius

    draconius 2[H]4U

    Messages:
    2,081
    Joined:
    Apr 8, 2002
    buy a new hard drive
    paint the laptop white
    paste an apple logo on it
    ...
    profit
     
  6. Komataguri

    Komataguri 2[H]4U

    Messages:
    3,355
    Joined:
    Jan 29, 2004
    a very powerful magnet could also work [j/k] :D
     
  7. Zardoz

    Zardoz 2[H]4U

    Messages:
    3,251
    Joined:
    Aug 27, 2000

    That's a new one, you have some proof? both hard drive and computer manufactures do not have the time let alone want to spend the extra money to do what you are saying. about the most they do is to create a hidden partition to put the factory image of that system on. this is done in the image process and is very automated.

    Dell, has service tag numbers on all there systems, if a system becomes stolen they will flag the system for you. that way if it ever gets called for support or sent in, they will know...
     
  8. lithium726

    lithium726 [H]ardForum Junkie

    Messages:
    8,195
    Joined:
    Jun 16, 2004
    if you are talking about tracing hte MAC address, you need a new NIC (wether it be wireless or rj45)

    the MAC address cant be changed, so if the owner wrote this down and is using it to trace the machine whenever it becomes active on the net, your only choice is to use a different nic in the card (PCMCIA for rj45, new mini-PCI card for the wireless)
     
  9. -(Xyphox)-

    -(Xyphox)- [H]ardness Supreme

    Messages:
    6,518
    Joined:
    Sep 9, 2004
    i would get a new HD/Nic and do a fresh install
    if it is stolen not like its your fault you dident steal it :p
     
  10. HTPC Rookie

    HTPC Rookie Gawd

    Messages:
    588
    Joined:
    Dec 24, 2004
    No 100% positive proof...just a suspicion, because of some odd stuff that goes on when we buy a bunch of IBM systems for work. We bring them up using V2i software and immediatly replace the image on the drive with a master we set up for whatever system type we bought at that time. So the OEM software suite is toasted long before we hook it to the network.

    Then, when they're up and running, and able to get to the 'net, somehow when we check IBM's website, the systems have already registered themselves with IBM. But if we enter a systems serial number before we plug it in at all, IBm wants us to register it.

    So right now all we can figure is that little partition we don't overwrite / get rid of is doing something sneaky.

    Hopefully someone can tell us the real method they register themselves with.
     
  11. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    Yeah exactly I just bought the thing, The other thing to note it looked like it was a kids personal notebook for school from the files that were left on it (that are now erased, not my biz) now this mac address thing how would they trace the mac address? wouldent they have to find it or scan for it? some of the tracking programs I was reading about just send out IP addresses when reported stolen nothing about Mac addys from your NIC and yes it does have integrated wirless LAN. I just dont feel like going through all this rigamoroue and i dont have a win XP disk to do a reinstall let alone the serial on the back of the notebook might not work what can i do???
     
  12. HTPC Rookie

    HTPC Rookie Gawd

    Messages:
    588
    Joined:
    Dec 24, 2004
    You just touched on something we considered, IBM sees the system's on-board NICs MAC. But what would cause the NIC to broadcast the MAC? Or does the MAC go with every packet anyways?

    I don't think it would be too difficult for OEMs to customize that little partition to individual machines...no more difficult than pre-loading XP with individual SNs per machine.
     
  13. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    so would it be possible to trace?
     
  14. lithium726

    lithium726 [H]ardForum Junkie

    Messages:
    8,195
    Joined:
    Jun 16, 2004
    its a protocol named ARP. adress resolution protocal. when a system connects to the net, it is asigned an IP. that IP needs to be linked to the MAC - this is where ARP comes in. the router keeps a table of what IP goes to where so it knows where to send stuff. IP's are changable. MAC's arent. im not talking about that little home router you got either, im talking about any router you ping too (ie, any router that is infront of a server, or any router out there on the WWW) will know your mac address.

    yes. htey can trace it.
     
  15. HTPC Rookie

    HTPC Rookie Gawd

    Messages:
    588
    Joined:
    Dec 24, 2004
    I think just to be on the safe side I'd put a PCMCIA NIC in it and disable the on-board (if it doesn't disable itself, my Dell's doesn't, so I do it in BIOS setup).

    Even though you didn't steal it, if it is stolen, receiving stolen property is still against the law. Usually (quote "usually") the cops will just ask you who you got it from, they're more interested in who stole it than who has it now. But they would take it from you. :(
     
  16. lithium726

    lithium726 [H]ardForum Junkie

    Messages:
    8,195
    Joined:
    Jun 16, 2004
    as long as you dont plug it in, its not gonna broadcast anything :)
     
  17. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    The wirless Lan card is by the ram underneath and it just slides into the same type of connector the ram does could i buy a new Lan card or should i buy a NIC?? also what else would you think I would need to do?
     
  18. HTPC Rookie

    HTPC Rookie Gawd

    Messages:
    588
    Joined:
    Dec 24, 2004
    aye, this is true! :D
     
  19. lithium726

    lithium726 [H]ardForum Junkie

    Messages:
    8,195
    Joined:
    Jun 16, 2004
    yeah, the wireless lan card is user removeable. just get a new one off ebay

    the wireless lan card is a nic ;)
    nic= network interface card. the RJ45 is just hte normal Cat5 plug.
     
  20. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    cool things look a bit better would that be about all i would need to do?
     
  21. Komataguri

    Komataguri 2[H]4U

    Messages:
    3,355
    Joined:
    Jan 29, 2004
    I think if your so god damn scared of it being stolen, that you wouldn't have bought it.


    So, either YOU did something suspicious yourself, or your being paranoid.



    EIther way, this thread, as it seems to me, is asking " How do I keep my stolen laptop from broadcasting its info so people won't be able to find it? "
     
  22. lithium726

    lithium726 [H]ardForum Junkie

    Messages:
    8,195
    Joined:
    Jun 16, 2004
    well, i think as long as you dont call it in for a servicing, youll be ok... if the machine is flagged and you call it in, theyll deny you and probably report it. the service tag is ebedded in teh bios
     
  23. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    Ok kool thanks you guys and Komataguri that wasn’t a very helpful post, Im not scared Im just trying to learn, but yes I am a little paranoid for a very reasonable matter I think. One thing I have to get across though I dont appreciate you subliminally suggesting that I am the thief, anyway that’s what I got out of it, I found it quite disrespectful. But to all who helped thanks!! You are what makes [H] forums so great!
    -Appatula
     
  24. LoStMaTt

    LoStMaTt 2[H]4U

    Messages:
    3,182
    Joined:
    Feb 26, 2003
    Call the police and see if it has been registered as stolen.
     
  25. mike2323

    mike2323 [H]Lite

    Messages:
    121
    Joined:
    Sep 2, 2004
    Buy notebook
    Draw cool designs all over it
    Paste keyboard pieces
    Send COD
    ..........
    Profit!


    P-P-P-P-Powerbook!
     
  26. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
  27. ikari303

    ikari303 Limp Gawd

    Messages:
    230
    Joined:
    Jul 2, 2003
    Um, since when are MAC addresses routed beyond a Layer 2 switch? It'll never get outside of your home network unless a program grabs it and transmits it for you for whatever reason.
     
  28. HTPC Rookie

    HTPC Rookie Gawd

    Messages:
    588
    Joined:
    Dec 24, 2004
    I always thought the outside world only sees the MAC of your router, even with the cheap jobs. That's why a lot of routers let you do MAC cloning, so if you hooked up with your ISP with the MAC in your computer, then stuck a router in, you could clone the PCs MAC and send it out. Thought it was up to the router to worry about IP routing on the inside.
     
  29. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    soo should I buy this NIC? I found one on Monarchcomputer for 35 bux just want to make shure it is going to improve my situation
     
  30. SJConsultant

    SJConsultant 2[H]4U

    Messages:
    3,602
    Joined:
    Jan 14, 2004
    I've got news for ya, I have Absolute Software's tracing program on a couple machines. So far it has survived fdisk, zero fill, and a few other deletion methods. The only way AFAIK to remove this software from the HDD is to do a *factory* low level format which the average joe cannot do.

    I also recently purchase an IBM T43P Thinkpad which has Absolute's tracking software embedded in the firmware of the laptop which continues to work despite removing and replacing the hard drive with a new one.

    Speaking from experience with Absolute's software, their system periodically logs hardware and software baselines and changes. Not to mention if the customer wanted, they can initiate a HDD wipe remotely the next time the system calls in for instructions.

    None of the software based firewalls have detected it's callouts, nor has any antispyware, antitrojan, antivirus application detected it's presence.
     
  31. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    this is a Sony VAIO VGN-S260
     
  32. SJConsultant

    SJConsultant 2[H]4U

    Messages:
    3,602
    Joined:
    Jan 14, 2004
    Yes I read that by your first post, I was simply making a few points:

    1. There are a few OEMs who bundle tracking software with their products
    2. IBM is setting a standard by incorporating tracking capabilities via hardware
    3. Tracking software such as Absolute's can evade most detection methods.
    4. Tracking software will survive conventional removal methods such as fdisk, zero fill, etc
    5. Only by removing and destroying the hard drive will you be sure it's not there unless its hardware based (see point # 2)
     
  33. Nybbles

    Nybbles [H]ard|Gawd

    Messages:
    1,237
    Joined:
    Jun 17, 2002
    Nope, layer 2 addresses will never make it to a destination site on the internet. Here's how it works:

    - Packet leaves your computer with your laptops MAC address, and hits your router.
    - Router recieves packet, pulls the layer 1 data (raw 1's and 0's) off the wire, reads the MAC (layer 2) and realizes that the packet was destined for it. So it takes it, reads the layer 3 address to find out where it's supposed to go.
    - The router then re-assembles the packet; it takes the existing piece of the packet (layers 4-7), adds a layer 3 address (which is is destination IP, and the source ip is it's doing some sort of NAT), then before it's sent out, the routers Layer 2 address (MAC) is placed in the packet.
    - Then this packet is placed onto layer 1, which is the transport medium itself as a string of 1's and 0's.

    As you can see, the MAC address never gets past your router.

    Now MAC address cloning is used when your ISP ignores traffic from any MAC addresses besides the one they have on record for you. In this case, the above process still applies, except when it places the MAC on the packet, it simply forges it. Nothing special.
     
  34. hokatichenci

    hokatichenci Gawd

    Messages:
    722
    Joined:
    Oct 28, 2004
    MAC addresses can easily be faked in just about any operating system. I do this reguarlly (legally) under Linux to have my NIC and Wireless on my laptop receive the same DHCP IP over my home network. If the original poster wants to know if its stolen, they need to contact sony and local enforcement as referenced earlier, or perhaps review the remaining data on the hard drive to see if the information matches the person it was purchased from. But usually if a price is too good to be true, it usually is.
     
  35. Lt. Dan

    Lt. Dan Limp Gawd

    Messages:
    287
    Joined:
    Dec 25, 2000
    This thread went from "how can I tell if it was stolen" to how can I hide the fact that iit is stolen. Come on dood. What comes around goes around... What dod you pay for the thing 50 bucks? Our school just lost 28 notebooks in a charging cart, second time in a month. Receiving stolen property is still a crime and they can still bust you.....
     
  36. appatula

    appatula Limp Gawd

    Messages:
    173
    Joined:
    Sep 11, 2004
    Allright well a few people are misinterpreting this whole thread and before people start making a huge deal about it lets just drop it. I dont like the fact people think that I could be trying to hide the fact that it could be stolen, I dont know and deffdently wouldent buy it knowing that it was stolen, I also live by the same saying "what goes around comes around" but misinterpreting my questions then twisting them just to make me sound like a bad guy isnt were I wanted this to lead. Again thanks for the learning experince, Im just going to use the thing and even if it does end up being stolen I would be more than happy to give it back to the original owners as again I would put myself in there position. Thanks again
    -Appatula
     
  37. Gorankar

    Gorankar [H]ardForum Junkie

    Messages:
    10,128
    Joined:
    Jul 19, 2000
    If you are worried about it being stolen you should not have bought it.. Now that you are attempting to hide the fact that it "may" be stolen, makes you a thief.. No two ways about it.. Call tech support or local police and find out if it stolen, they may know.. If it is not stolen, great, you did the right thing by making sure.. If it is.. Do the right thing, and turn it over..

    Accepting stolen merchandise is a crime.. If you think I'm being direspectful, your right.. Your actions so far have earned none..

    This thread should prolly be closed.. We are way outa spec on the forums rules imho..
     
  38. Yoblad

    Yoblad [H]ard|Gawd

    Messages:
    1,060
    Joined:
    Jul 24, 2000
    Yes, I'm sure that since law enforcement has solved all murders and all other crimes they can now get some kid's laptop back. They aren't going to move an inch for a laptop. Now..if it was a truck load of new laptops then yes.