Ask HN: My friend's computer was stolen, and I might have the IP address.

[tmbeihl]

My buddy and I are driving across Canada. As we are college students, we have been sleeping in campgrounds or our car to save money. Last night, we accidently spilled gas in our car and decided to spend the night in a hotel. About two hours ago, somebody broke the window of our car and stole his laptop and my camera. I know his mail servers admin and I have two IP addresses that have connected to his mail account since we went to bed last night. I also have access to the hotels wifi router. Any idea what I should do? I have reason to believe that the computer is still on the premises. The police were called over an hour ago and still haven't come yet.

[uptown]

The police will likely be pretty limited in what they're able to do. I suspect they'll have you file a police report, and then leave. Here's what I'd do ... and the success of this tactic will probably depend on how large the hotel is, and how helpful whomever you're dealing with wants to be.

1. See if you can get an idea from the hotel about how many of the rooms are occupied, and if it's a small number see if it's possible to get that list.

2. Give each person in housekeeping $10, and ask them to tell you if they see any of your stuff in the rooms they're cleaning.

3. Focus on rooms with the do-not-disturb signs hung up if it's a limited number. You know that somebody is staying on those rooms, and that they prefer privacy. While this doesn't mean they took your stuff, it helps locate the rooms with patrons.

4. Write down the license plates of the cars in the lot (if it's not an overwhelming number). If there's one way for vehicles to leave the property, you could wait by the exit and ask drivers as they leave if they know anything. If the driver stops, you'll get a read on their response. You can also write down license plates based on how drivers handle this (whether they stop, how they react, etc.) and cross-reference this against the ones you recorded from the parking lot.

5. Check the trash. Sometimes people steal things, get scared, then dump whatever they've stolen.

Good luck to you. The odds aren't in your favor.

[algorias]

Emphasis on: The odds aren't in your favor.

[daeken]

If ssh is running on it, redirect all web traffic to a page prompting them for their room number, to "get on the hotel wifi".

Edit: Assuming you can find it on the network, that is. Good luck; hope you can get it back.

[grandalf]

that's brilliant!

[deutronium]

Try accessing a site such as http://www.whatismyip.com/ via the wifi router, to see if the external IP of the hotel router matches the one you've found connecting to your mail server. In an attempt to confirm whether its likely the laptop is in the hotel.

You could also try a tool that maps an IP to location e.g. http://www.geoiptool.com/ - these aren't particularly accurate too be honest

Edit: If you know the Laptop is running a server e.g. SSH you could try scanning the network for the local IP of the laptop with nmap.

e.g. nmap -A 192.168.1.*

(With the '-A' option, machines will also attempt to be fingerprinted, to determine their OS etc, to start with it may be better running without '-A' as it takes a fair bit longer)

[pmikal]

I recently recovered a laptop because I had installed Prey on it (http://preyproject.com/). It's free, sends you the IP, a webcam snap, desktop grab and attempts a geo-location.

I also always install Microsoft's Live Mesh on my machines, which is helpful for remote login if one has gone missing. Free. (https://www.mesh.com/)

[uptown]

Great suggestion with Prey. For the future, another idea might be to use Dropbox to deliver a payload that gets executed upon bootup. This would give you the ability to deploy and execute software that might help you locate your stolen equipment. Of course you run the risk of some malicious software being auto-executed if the folders you sync from become compromised, so that's something to weigh when considering this option.

[dave_lo]

Will be installing Prey ASAP. Great recommendation.

[johngalt]

The police won't do anything. We had a laptop theft where someone just walked into our building and started picking up laptops. He basically said "hey I'm from IT and we are upgrading, I'm picking up old laptops and then you'll get a new one in a couple hours." He walked out with 14 laptops.

We had him on camera, multiple witnesses. Our security found the ebay account where they were being sold and even tricked the guy into providing his address. We provided this to the police. All they would have had to do is go arrest him, but they wouldn't lift a finger.

Conversely, I worked for a bank for a year. And one night the ATM alarm was accidentally tripped, and the police where there in minutes with guns out.

The ATM only had about $10K in it, and the fourteen laptops represented a loss of $30k.

Q: So why was there response so much more aggressive for the ATM?

A: The banks pay big $$ to the local police departments to get that kind of response.

[dnsworks]

"The police won't do anything. We had a laptop theft where someone just walked into our building and started picking up laptops. He basically said "hey I'm from IT and we are upgrading, I'm picking up old laptops and then you'll get a new one in a couple hours." He walked out with 14 laptops."

The guy who stole these 14 laptops should get arrested, go to prison, then come out and become a best selling author on the topic of Social Engineering (which means he'll sell 1,000 copies, but still, a good use of his craft).

That being said, did it really represent a gross loss of $30k? A $2k laptop is worth $1,200 the moment you open the box. Were they old laptops? Mostly depreciated? $10k in an ATM is always worth $10k.

[johngalt]

RE: Social Engineering -> these were software developers that gave up their laptops btw, not just random business users. So he must have had a good pitch.

The laptops were all less than a year old. But you could easily argue the loss value was less than their purchase value. However we still had to spend $30K to replace them all.

The data on the laptops also wasn't worthless. Thankfully the guy was just an ebay/thief and not interested in selling our sourcecode.

[dnsworks]

If he hadn't, well you would have learned the hard way to have a strong laptop encryption policy, wouldn't you have?

[gregschlom]

Well, that won't help in your case, but I wanted to share this story: last friday, my laptop was stolen in Paris. I was doomed. 15 minutes later, my mobile phone rang : some guys spotted the thief while he was trying to rob other people. The guys stopped him and got all the stolen stuff. They opened my laptop bag and found a little paper with my name and phone number that I had put there TEN years ago, when I purchased the bag.

So I can say that it's definetely worth putting your name and number on a paper card in your laptop bag.

[grandalf]

You should avoid getting into direct conflict with the thief.

I suggest putting up signs offering a $200 cash no questions asked reward if the laptop is returned to the hotel front desk. Perhaps hotel management can knock on doors for you announcing the reward.

If you want to then take the laptop to the police and have it dusted for fingerprints that is your decision.

Most petty thieves just want cash and if the laptop isn't already sold it will probably be sold in the next day or two for $200 or less in cash.

[ck2]

Real life cops aren't like TV.

They might take a report but won't spend an ounce of energy looking otherwise, even if you have the IP.

Then again it's Canada so maybe they are less lazy/corrupt than US cops.

[mcknz]

Sure there are lazy cops, but it's more of a risk/reward analysis. There's such a small chance of recovering the laptop, and since no violence involved, it's not worth the effort when the loss is relatively small, and there are crimes of greater consequence to respond to and resolve.

[ck2]

Right, because so many greater crimes are given any effort instead.

Let's be more realistic and compare them to the slackers found at every kind job. But now imagine those slackers with supremely dangerous amounts of authority that are constantly abused and no-one can challenge, co-workers that will cover their ass no matter how big the lie, really good pay, really good benefits, incredible overtime pay, insane early retirement pay (while they work other jobs) and it's nearly impossible to be fired once hired.

[mcknz]

Now who's describing the cops on TV? :)

I agree there are some real pricks out there -- only trying to say that lack of effort on a stolen laptop is not a good test case for laziness....

[jheriko]

I have to agree somewhat, but its not slackers, its politics or something... there are plenty of places in the UK at least where a policeman could walk down the street and find 3 or 4 serious criminals in the act of committing a crime - they are never there. (from what I hear US is exactly the same)

Probably too busy making it look like we have security against the terrorists, who don't really exist...

[Rusky]

And I'm sure you know so many cops personally.

[nathanb]

I'm assuming that the computer is running Windows and that you don't have something useful like an sshd, telnetd, or VNC client running on it. The IP address is only useful if you can connect to the computer in some way.

The one thing you know is that the mail reader is still running. Working on the assumption that it can't hurt, maybe craft a mail to the account to either fool the thief into installing software like Prey discussed on other comments here or to fool the thief into telling you where he or she is.

For the first one, just send out a mail saying something like "Click this link to install HOT VIRTUAL PORN". Make it look like the average spam mail (though not spammy enough to get filtered). Obviously you would need to repackage the Prey installer as some sort of porn software installer, which may be easy or hard depending on how silent the original installer is.

For the second one, post a Craigslist or equivalent ad offering to buy a laptop computer like your friend's. Then send a mail to your friend's account as yourself saying "hey, I saw this ad and I know you're looking to unload that old laptop of yours, so thought you would be interested".

If people fall for Nigerian 419 scammers, maybe your thief will fall for this. Assuming he's reading your e-mail.

[HeyLaughingBoy]

Have you talked to the hotel manager? The parking lot is probably their property and they are responsible for what happens in it.

Alternatively, do you have full coverage on your car? If so, just call your insurance company and tell them what happened; they'll probably work something out with the hotel.

Other ideas: (I think) some credit cards cover theft if you use them for travel expenses and stuff is stolen while travelling.

The last thing you should be doing is tracking the down the items and trying to recover them yourself by force.

[mattmichielsen]

This reminds me of when my friend's fairly high-end laptop was stolen from a party at his house. This was back in my wardriving days, so we went out several times looking for the MAC address of the wifi card. We didn't end up finding it though, and his parents' homeowners insurance replaced it.

If you have the MAC address and think it is still in the local area, you can definitely use a tool like kismet to look for it.

[ewoodh2o]

This really sucks. I had something similar happen last December, except the laptop was stolen out of a locked hotel room. Not a shady place either...skyrise elevator-access place downtown in a big US city.

Hotel was of little help, and police don't do much except write down the S/N and alert the local pawn shops not to buy the machine.

Best bet is homeowner's or renter's insurance. Most policies will cover something like this. If you're in school, your (his) parents' coverage usually extends to cover your belongings. I have the basic $15/mo type coverage from State Farm - the kind that reduces your car insurance payment by more than $15/mo under their multi-policy discount - and they replaced my 3 year old MBP no-questions-asked.

[mcknz]

I agree with avoiding contact with the thief -- it's tempting to try some advanced tech solution, but lots can go wrong, including accusing innocent people.

Have you talked to the hotel staff? I'm sure theft is something they are used to dealing with. If no response from them, maybe you could call the hotel corporate HQ. It's a long shot, but maybe the hotel can reimburse through insurance. Also if you have a credit card sometimes they will provide limited travel insurance.

[gte910h]

Stealing something that someone has stolen from you is theft in many jurisdictions in the US. Make sure you involve the police, as I suspect the same is true in Canada.

[Zak]

[citation needed]

A number of things you could do to facilitate recovering the property, such as entering someone else's hotel room without permission are illegal, though a defense of necessity might be available. I've never heard of it being a crime to take back the property itself.

[blumer]

If you think you may have the IP address, is there any chance that whatever OS you have running on it will let you discretely log in remotely? Then you can drop some sort of homing beacon on for now so that if the criminal moves (likely, given it's a hotel, of course), you're not SOL.

[kordless]

Or make it make a sound like you are getting email every 30 seconds or so. Then go from door to door listening for it.

[MIGUELITO]

Alo

[dnsworks]

"You left your Laptop and your Camera in in a car? Really? Unattended? And it got stolen? Sucks to be you, I hope you had insurance!"

That's about what I would expect a police officer to say. At least, that's what they say here in San Francisco. Then you file a report, and make an insurance claim. Do you have a friend at the ISP they use who could sort through some logs for you so that you could go and retrieve it yourself? That's probably your best bet for getting your property back, and that's quite the long shot.

[Jim_Neath]

Why did you leave the equipment in the car?

[blumer]

While something to consider later, this is completely unhelpful and beside the point right now.

[kordless]

Clearly they were high on gas fumes.