Can I recover my stolen laptop?
May 30, 2007 9:18 PM Subscribe
My laptop was stolen - but I think it might still be nearby! What can I do?
Around 1 PM yesterday, someone broke through my bathroom window screen (the window was up) and came into my house. The motion sensor alarm went off immediately and the burglar bugged out, but not before grabbing my iBook which was sitting out on the dining room table.
I am running a wireless network which is password protected. The only computers I have granted access to are my desktop, my laptop and my neighbor's computer. The only Mac is my laptop.
When I looked at the DHCP client list on my router page this evening, I noticed 3 computers on the network. I reset the router, thinking that it might be an old list, and when it had reset itself there was only one computer there besides my desktop - my neighbor's. However, about 30 minutes later I looked again, and there was a 3rd computer again. I ran the MAC address through a lookup (found here), and it said the MAC address is from an Apple computer.
Does this mean my laptop could still be within wireless range? Can it be found? Unfortunately, I do not have the serial number or MAC address written down, but I do believe I registered it with Apple. Would they have the MAC address of my laptop?
I have already reset my critical passwords, but it would be really fantastic to get my laptop back.
Around 1 PM yesterday, someone broke through my bathroom window screen (the window was up) and came into my house. The motion sensor alarm went off immediately and the burglar bugged out, but not before grabbing my iBook which was sitting out on the dining room table.
I am running a wireless network which is password protected. The only computers I have granted access to are my desktop, my laptop and my neighbor's computer. The only Mac is my laptop.
When I looked at the DHCP client list on my router page this evening, I noticed 3 computers on the network. I reset the router, thinking that it might be an old list, and when it had reset itself there was only one computer there besides my desktop - my neighbor's. However, about 30 minutes later I looked again, and there was a 3rd computer again. I ran the MAC address through a lookup (found here), and it said the MAC address is from an Apple computer.
Does this mean my laptop could still be within wireless range? Can it be found? Unfortunately, I do not have the serial number or MAC address written down, but I do believe I registered it with Apple. Would they have the MAC address of my laptop?
I have already reset my critical passwords, but it would be really fantastic to get my laptop back.
Response by poster: My desktop is a PC. No help there.
posted by starvingartist at 9:29 PM on May 30, 2007
posted by starvingartist at 9:29 PM on May 30, 2007
Sounds like there are two possibilities here:
1. One of your neighbors is a laptop thief
2. You're using WEP, or WPA with a pissweak password, and one of your neighbors has cracked it and is leeching your Internet connection.
If it's (1), and your laptop was set up to share files, you should be able to access them; if you can, you want to be calling the cops and having somebody come over with a radio direction finder.
posted by flabdablet at 9:37 PM on May 30, 2007
1. One of your neighbors is a laptop thief
2. You're using WEP, or WPA with a pissweak password, and one of your neighbors has cracked it and is leeching your Internet connection.
If it's (1), and your laptop was set up to share files, you should be able to access them; if you can, you want to be calling the cops and having somebody come over with a radio direction finder.
posted by flabdablet at 9:37 PM on May 30, 2007
3. The neighbour you granted access to has got a second computer without telling you.
posted by flabdablet at 9:39 PM on May 30, 2007
posted by flabdablet at 9:39 PM on May 30, 2007
Get ethereal or another packet-analysis tool and start logging your network. If your OS X laptop has a proper "name" for whatever your default profile is, it should show in some of the packets.
This is perfectly legal - you own the network. You own the packets on it.
Not so perfectly legal - start analyzing the packets for meaningful data - an address, a zip code, banking information, logins and passwords, etc. Something you can use to identify the location or identity of your thief.
Chances are actually good that it was a shitty neighbor who stole your laptop. Being a shitty neighbor would allow the thief to "case" your apartment with ease and observe your habits and patterns.
Actually recovering the laptop will require either some badass door-knocking and confrontation, or proof he/she has it at his/her home. Your own eyewitness account of your property in his/her place should be enough for most US police districts to knock on his/her door and ask to inspect the location for your property.
However, getting an actual warrant will be more difficult.
You could trace the signals with a direction-finding (triangulating) antennae and spectrum analyzer, but those things are expensive as hell. It'd be cheaper to buy a new laptop.
If it was me - and in no way do I advocate this - and if I could confirm for sure that it was my laptop, and if the thief was stupid enough to log into their bank accounts on said stolen laptop from your own wireless point - I would probably strongly consider going to a third-party wireless location (taking pains to avoid observation, obscuring my MAC address and other identifiers with, say, a Knoppix bootable CD) and wiping or closing his/her account. Order something useless and bulky like Funyuns or packing peanuts until the money is all gone, and have it delivered to their address.
No, it wouldn't solve anything, but it would be a hell of a satisfying stupidity tax.
posted by loquacious at 9:40 PM on May 30, 2007
This is perfectly legal - you own the network. You own the packets on it.
Not so perfectly legal - start analyzing the packets for meaningful data - an address, a zip code, banking information, logins and passwords, etc. Something you can use to identify the location or identity of your thief.
Chances are actually good that it was a shitty neighbor who stole your laptop. Being a shitty neighbor would allow the thief to "case" your apartment with ease and observe your habits and patterns.
Actually recovering the laptop will require either some badass door-knocking and confrontation, or proof he/she has it at his/her home. Your own eyewitness account of your property in his/her place should be enough for most US police districts to knock on his/her door and ask to inspect the location for your property.
However, getting an actual warrant will be more difficult.
You could trace the signals with a direction-finding (triangulating) antennae and spectrum analyzer, but those things are expensive as hell. It'd be cheaper to buy a new laptop.
If it was me - and in no way do I advocate this - and if I could confirm for sure that it was my laptop, and if the thief was stupid enough to log into their bank accounts on said stolen laptop from your own wireless point - I would probably strongly consider going to a third-party wireless location (taking pains to avoid observation, obscuring my MAC address and other identifiers with, say, a Knoppix bootable CD) and wiping or closing his/her account. Order something useless and bulky like Funyuns or packing peanuts until the money is all gone, and have it delivered to their address.
No, it wouldn't solve anything, but it would be a hell of a satisfying stupidity tax.
posted by loquacious at 9:40 PM on May 30, 2007
The laptop's probably long gone... BUT
If it's a list of *active* clients and not a list of current DHCP leases or a 'white list' of mac addresses that are allowed to connect to the router, then it's a good possibility that your laptop is still nearby.
By my understanding, DHCP addresses are 'leased out' for a period of time, usually just a few days - but they can be leased out forever. If this is the case, your computer may still have a lease on a particular ip address for the next few days even if it's out of the country.
You might have set up a 'white list' of MAC that are the only addresses that are allowed to connect to the router, in which case you might be looking there. If that's the case, your computer will be in that list until you remove it or hard-reset the router.
But if neither of those are the case and you are looking at a list of active clients then it sounds like your laptop is close by. (To see if it is really a list of active clients, try getting the neighbor to power down their computer and then reboot the router and see if one of the addresses disappears).
I dont know if there is a reverse version of a program like netstumbler (which shows signal strength of wireless access points), that could be used to find the physical location of your laptop if it is actively connected... but it certainly sounds possible to locate a device that is broadcasting a signal - if you got the right person interested.
posted by itheearl at 9:41 PM on May 30, 2007
If it's a list of *active* clients and not a list of current DHCP leases or a 'white list' of mac addresses that are allowed to connect to the router, then it's a good possibility that your laptop is still nearby.
By my understanding, DHCP addresses are 'leased out' for a period of time, usually just a few days - but they can be leased out forever. If this is the case, your computer may still have a lease on a particular ip address for the next few days even if it's out of the country.
You might have set up a 'white list' of MAC that are the only addresses that are allowed to connect to the router, in which case you might be looking there. If that's the case, your computer will be in that list until you remove it or hard-reset the router.
But if neither of those are the case and you are looking at a list of active clients then it sounds like your laptop is close by. (To see if it is really a list of active clients, try getting the neighbor to power down their computer and then reboot the router and see if one of the addresses disappears).
I dont know if there is a reverse version of a program like netstumbler (which shows signal strength of wireless access points), that could be used to find the physical location of your laptop if it is actively connected... but it certainly sounds possible to locate a device that is broadcasting a signal - if you got the right person interested.
posted by itheearl at 9:41 PM on May 30, 2007
seriously though, i reread your post and it sounds like what you are seeing is a list of DHCP leases, in which case the laptop is probably gone.
posted by itheearl at 9:44 PM on May 30, 2007
posted by itheearl at 9:44 PM on May 30, 2007
i second having your neighbor power down if they have a mac as well.
if you are still seeing this mac address appear to be active, poke around to figure out which IP address from your DHCP range it's leased. from your machine try to ping the suspect IP (start > run > cmd(enter) > ping ipAddressHere
if you get a response back at least you will know *someone* with a mac is connected to your AP
posted by ronmexico at 9:49 PM on May 30, 2007
if you are still seeing this mac address appear to be active, poke around to figure out which IP address from your DHCP range it's leased. from your machine try to ping the suspect IP (start > run > cmd(enter) > ping ipAddressHere
if you get a response back at least you will know *someone* with a mac is connected to your AP
posted by ronmexico at 9:49 PM on May 30, 2007
I would not hold out hope to see your laptop again. People don't steal laptops to play Tetris, they steal laptops to sell them to get money for drugs. Mostly.
Also, you should use a router (or configure yours) so that only known MAC addresses are allowed. This is typically available for Wi-Fi. Then at least you'd know if it was actually your computer. But if it were your computer, on your network, I'd expect you'd be able to see the computer name, shares, and so forth. Somebody dumb enough to let it contact its own Wi-Fi after stealing it would be dumb enough to leave all those things intact.
posted by dhartung at 11:03 PM on May 30, 2007
Also, you should use a router (or configure yours) so that only known MAC addresses are allowed. This is typically available for Wi-Fi. Then at least you'd know if it was actually your computer. But if it were your computer, on your network, I'd expect you'd be able to see the computer name, shares, and so forth. Somebody dumb enough to let it contact its own Wi-Fi after stealing it would be dumb enough to leave all those things intact.
posted by dhartung at 11:03 PM on May 30, 2007
erm? from his mac, ifconfig -a should give the MAC addr. but yeah, it sounds like itheearl is right on. DHCP leases last for a long time.
posted by devilsbrigade at 12:01 AM on May 31, 2007
posted by devilsbrigade at 12:01 AM on May 31, 2007
You could get someone to watch the list of connections while you knock on each neighbour's door and ask if anyone's seen anything suspicious, casually mentioning that you're tracking the wifi. If the connection disappears within seconds of them shutting the door then you can be reasonably certain who to send the police to.
posted by malevolent at 12:26 AM on May 31, 2007
posted by malevolent at 12:26 AM on May 31, 2007
I'm with dhartung - I think it's gone.
Inspiring anecdote:
I knew a girl in college who had her laptop stolen from her room while she was in the shower by some people who'd been hanging around the dorm for a few days - for a variety of reasons I won't go into here, she knew they'd done it. She called the cops, who told her to call the local computer shops with the serial number of the laptop, which she amazingly had, and tell them that if they saw two people come in to call the cops. This was a town of less than 70,000 people and there were only a few shops that would buy laptops used.
Sure enough, two hours later, the thieves walk into a computer shop and try to get it "appraised." The cool shop owner goes in the back to "check out some of the technical data," calls the cops, and dawdles for a few until the cops show up. She had her laptop back that night.
Moral: find out who buys computers (pawn shops, second-hand computer stores, etc.), and just ask if a computer of your description has come up. Who knows - you might get lucky.
posted by mdonley at 1:09 AM on May 31, 2007
Inspiring anecdote:
I knew a girl in college who had her laptop stolen from her room while she was in the shower by some people who'd been hanging around the dorm for a few days - for a variety of reasons I won't go into here, she knew they'd done it. She called the cops, who told her to call the local computer shops with the serial number of the laptop, which she amazingly had, and tell them that if they saw two people come in to call the cops. This was a town of less than 70,000 people and there were only a few shops that would buy laptops used.
Sure enough, two hours later, the thieves walk into a computer shop and try to get it "appraised." The cool shop owner goes in the back to "check out some of the technical data," calls the cops, and dawdles for a few until the cops show up. She had her laptop back that night.
Moral: find out who buys computers (pawn shops, second-hand computer stores, etc.), and just ask if a computer of your description has come up. Who knows - you might get lucky.
posted by mdonley at 1:09 AM on May 31, 2007
Its probably not your computer (sounds too much of a coincidence) but you might as well port scan it and see if it has ssh or apache or anything up. Or just type its IP into the web browser or from terminal do "ssh ipaddress" I believe ssh on OSX will tell you the computer name at login and obviously if you had apache running with web stuff you'd be able to recognize it.
At the very least ping it to see if its actually online or if you have a ghostly DHCP setting.
posted by damn dirty ape at 7:38 AM on May 31, 2007
At the very least ping it to see if its actually online or if you have a ghostly DHCP setting.
posted by damn dirty ape at 7:38 AM on May 31, 2007
Also, you will find sniffing wireless traffic with ethereal more or less impossible. Most wireless drivers cant do this and depending on the router it might treat the wireless interface like a switch connection.
posted by damn dirty ape at 7:43 AM on May 31, 2007
posted by damn dirty ape at 7:43 AM on May 31, 2007
Too late for this now, but it may help in the future:
Undercover not only reveals the internet location of your Mac, it also transmits screenshots, enabling you to closely monitor your stolen Mac.
posted by dnthomps at 10:27 AM on May 31, 2007
Undercover not only reveals the internet location of your Mac, it also transmits screenshots, enabling you to closely monitor your stolen Mac.
posted by dnthomps at 10:27 AM on May 31, 2007
I had my laptop stolen out of my locked car in a parking garage in LA and I got it back 5 months later!!! The cops found it and my book bag and my HEADSHOTS which had my number on it in this scum bags house... he had used it until the battery ran out and it just sat there unused until he got busted!
I had already bought a desktop but for a couple months I was an even bigger geek with my laptop and my desktop both set up side by side... Then I sold my laptop...
anyway, good luck in getting it back!
posted by crewshell at 4:49 PM on May 31, 2007
I had already bought a desktop but for a couple months I was an even bigger geek with my laptop and my desktop both set up side by side... Then I sold my laptop...
anyway, good luck in getting it back!
posted by crewshell at 4:49 PM on May 31, 2007
« Older Feel the tast of the change in my pocket. | What's the title of this B-monster movie, possibly... Newer »
This thread is closed to new comments.
posted by sweet mister at 9:26 PM on May 30, 2007