A simple way to track stolen Macs

Submitted by JacobBraun on Fri, 09/25/2009 - 01:46

So my laptop was stolen on September 23rd (A 2.26GHz 13" MacBook Pro, 4GBs RAM, 500GB 7200rpm HD...my baby) and it had my entire life on it. It was in the process of making a full backup and while I was at work someone broke into my apartment and stole it. It's probably gone forever along with most of my precious photos, documents and other data, and I'm kicking myself for not coming up with some way to track it. So I made a way. Hindsight is 20/20. *sigh*

I used to use a script I had modified based on this hint from MacOSXHints.com, but it only took photos on wake from sleep and didn't record the IP address...I would have to check my server provider to get the logs to check for access. So I found this other hint from MacOSXHints.com that would log the IP address and take a picture every six minutes, but it seemed a bit too complicated for what I wanted.

So I combined the ideas of the two and rolled my own. This is my very first bash script I've really worked on and I'm quite proud of it. It takes a picture from the iSight camera, records the IP address and time it was taken, and also takes a screenshot, uploading all of it to a folder in my web server where I can track it, and using bolGallery makes a nice little photo gallery of what's been uploaded.

You will need the excellent isightcapture command line utility for taking the iSight pictures. Open the .dmg, and copy the file to /usr/local/bin

It has three parts: a script called stolen.sh that I put in /etc/.stolen/, a LaunchAgent property list file, and a text file called whatever you want (ReturnFilenameHere in the script) with the words "true" in it.

So here we go. To do this on your own laptop make a folder called .stolen under /etc by using this command under Terminal

sudo mkdir /etc/.stolen/

Then using your favorite text editor (I prefer Textmate) make a new file and paste in the following script, filling out the variables at the beginning of the script:

#!/bin/bash

## Written by Jacob Braun, http://five.jacobbraun.com

## These should be pretty self explanatory

username=YourFTPUsername

password=YourFTPPassword

server=YourFTPServer

returnfile=ReturnFilenameHere

website="http://YourWebsiteURL/with/folders/"$returnfile

## No leading or trailing slashes on remotepath

remotepath=your/ftp/site/path/with/no/leading/or/trailing/slashes

## A simple test for internet access. If no internet access found, or the file is unavailable, pause for 20 seconds then check again.

site=`(curl -s $website)`

if [ "$site" != "true" ]; then

        sleep 20;

fi;

## Check internet access again. If detected, run the capture script.

site=`(curl -s $website)`

if [ "$site" == "true" ]; then

        ##Don't modify anything below here

        externalip=`(curl -s http://checkip.dyndns.org | awk '{print $6}' | awk ' BEGIN { FS = "<" } { print $1 } ')`

        date=`(date +%s)`

        ## Set filename of iSight capture and screenshot to the unix timestamp with the external IP address in it with respective extensions

        isight=$date"-ip"$externalip".jpg"

        screenshot=$date"-ip"$externalip".png"

        ## Take an iSight picture

        /usr/local/bin/isightcapture /tmp/$isight

        ## Take a screen grab

        /usr/sbin/screencapture -x -m /tmp/$screenshot

        ## Use curl to upload them to the server

        curl -s -T /tmp/$isight -u $username:$password -o --url ftp://$server/$remotepath/

        curl -s -T /tmp/$screenshot -u $username:$password -o --url ftp://$server/$remotepath/

else 

        exit 0

fi;

exit 0

Save the script as stolen.sh and change mod to executable and readable to 755:

sudo chmod 755 /etc/.stolen/stolen.sh

sudo chmod +x /etc/.stolen/stolen.sh

Next we have the LaunchAgent Property List. Create a new text file called com.jacobbraun.five.stolen.plist, paste in the following code, and place this file in /Library/LaunchDaemons/

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<plist version="1.0">

<dict>

        <key>Label</key>

        <string>com.jacobbraun.five.stolen</string>

        <key>OnDemand</key>

        <true/>

        <key>StartInterval</key>

        <integer>360</integer>

        <key>ProgramArguments</key>

        <array>

                <string>/private/etc/.stolen/stolen.sh</string>

        </array>

</dict>

</plist>

To run this immediately without rebooting type in the Terminal:

sudo launchctl load /Library/LaunchDaemons/com.jacobbraun.five.stolen.plist

You should be good to go. Now every six minutes your laptop will check for internet connectivity, and if it finds it upload an iSight capture and screenshot to your server along with the IP address it came from. You can remove the screencapture line to improve bandwidth usage (1280x800 pngs are around 500KB or more) or change the type it's outputting to a JPEG.

Note that this can easily be modified to upload just a textfile with this information (if you don't have an iSight...i.e. mini or Mac Pro) and this script should work on 10.5 and 10.6. I don't know about 10.4. If it works with 10.4 please let me know.

If you have any suggestions on how to improve this please leave a comment. I am going to add a way to include the wifi access point's name in the filename string, and have some other improvements in mind.

Edit: I'm getting progressively more evil. I wrote this script while waiting for my friends at a restaurant. It checks to see if it's stolen by checking a textfile on my website. If the textfile has "true" in it, it performs the following:

Kicks you to the login window using fast user switching. I have the guest account enabled and highly restricted using parental controls, so they can still login and open Safari.
This part is really annoying. It the text to speech say command to say "This computer has been stolen from Jacob Braun. Please call *phonenumber* for cash reward, no questions asked. It pauses for two seconds then repeats, each time setting the volume to maximum (so they can't hit mute).
After 10 times it checks again to see if it is stolen. If it still is, repeat above. If not, shut up.

#!/bin/bash

## Written by Jacob Braun, http://five.jacobbraun.com

stolenurl="http://yoururl/isstolen"

isstolen=`(curl -s $stolenurl)`

uid=`/usr/bin/id -u`

while [ "$isstolen" == "true" ]; do

        if [ "$uid" == "501" ]; then

                /System/Library/CoreServices/Menu\ Extras/User.menu/Contents/Resources/CGSession -suspend

        fi;

        COUNTER=0

        while [ $COUNTER -lt 10 ]; do

                osascript -e 'set volume 7'

                say -v Victoria "This computer has been stolen from Jacob Braun. Please call *phonenumber* for cash reward, no questions asked."

                sleep 2

                let COUNTER=COUNTER+1

        done

        isstolen=`(curl -s $stolenurl)`

done

exit 0

I also planning on having my name and phone number, along with "Stolen From" engraved on the bottom of my next MacBook Pro (or my old one if I ever get it back).

Trackback URL for this post:

http://five.jacobbraun.com/trackback/107

Buy butalbital.

from Buy butalbital. on Wed, 03/10/2010 - 20:46

Buy butalbital.

Valium without prescription.

from Conversion dosage of lorazepam to valium. on Wed, 03/10/2010 - 20:44

Purchase valium. Valium 5mg how long in system. Valium.

Levothyroxine 150 mcg.

from Levothyroxine excessive hunger. on Wed, 03/10/2010 - 19:01

Levothyroxine sodium 0.08mg for dogs.

database-empire.com satisfy

from database-empire.com on Mon, 11/30/2009 - 19:53

[...] Each right entitles the holder to buy one-half common share at an exercise price of $15. Constant,ancient "There's often an inaccurate perception of one's own diet," she said. "Earlier surveys show that 50 percent of Americans surveyed think thei...