DailyTech - Lenovo Security Feature Kills Notebooks via Text Message

Submit News

Gadgets Lenovo Security Feature Kills Notebooks via Text Message
Shane McGlaun (Blog) - November 25, 2008 8:37 AM

E-mail

del.icio.us

35 comment(s) - last by sigilscience.. on Nov 30 at 5:14 PM

(Source: Gecko & Fly)

Lenovo security feature leaves notebooks inoperable after receiving a special text message

It's no fun having something that belongs to you stolen. When it's your notebook computer, things can be even worse if you have confidential personal or business information stored on the notebook. Criminals can gain access to things like tax returns and have all the information they need to steal your identity.

Many people encrypt the data on their computer to prevent this sort of problem from happening, but Lenovo has a different method of protecting the computer it will be offering to customers next year. The feature is called the Lenovo Constant Secure Remote Disable feature and works with notebooks that are WWAN equipped. With the feature notebook owners can send a simple text message to the notebook that will render the machine inoperable to unauthorized users.

The technology behind the feature came from work between Lenovo and Phoenix Technologies. Starting in Q1 2009 the feature will be available on select notebooks. In the event that a notebook is lost or stolen owners send a text message with a command "lockdown PC now" or "PC shut off."

If the shut off command is sent, the machine will turn off and when the thief tries to turn the machine back on it will lockdown automatically. A text confirmation is sent back to the user when the shutdown or lock is executed.

If the notebook is recovered users can unlock it with a pre-set pass code entered when the notebook starts up.

Lenovo's Bob Galush said, "Remote Disable dramatically reduces the anxiety and waiting people often experience when they've been the victim of a lost or stolen notebook PC. Through our work with Phoenix, we are able to reduce customers' security risks and potential exposure of their confidential data when their ThinkPad notebook is lost or stolen. Combined with features like built-in biometric fingerprint readers, full hard drive encryption and embedded security chips, Lenovo ThinkPad notebooks offer the latest industry-leading PC security technologies."

Lenovo says that the Remote Disable service will be included in the price of notebooks at no additional charge and will be available on mobile broadband equipped ThinkPad notebooks. The system will operate in areas where cellular phone GSM signals are supported and SMS text messages can be sent.

There is no word from Lenovo on whether the data on the notebooks hard drive would be accessible if the hard drive was removed from the machine. For the best safety, something like a full disk encryption hard drive would be ideal with Lenovo's remote kill feature.

Frequent air travelers will also find the new Lenovo feature appealing considering over 600,000 notebooks are lost in airports each year and many of them are never claimed. A study conducted this summer revealed that out of the notebooks lost in airports each year, 65% of them were never reclaimed.

Comments

Threshold

Username
Password
remember me

This article is over a month old, voting and posting comments is disabled

I like what I'm hearing...

By Adonlude on 11/25/2008 11:52:10 AM , Rating: 5

Now all they need to do is put in the GPS chip so you can get on another computer and track its location. It should be totally possible to track valueable tech belongings these days via GPS, I dont know why they haven't implemented it.

Ya, I guess I do. There would probably be a rash of news stories along the lines of "Man jailed after tracking laptop thief via GPS then beating him within an inch of his life. In other news, Man jailed after planting GPS trackable laptop in wife's car then tracking her to a lovers house then beating him within an inch of his life."

RE: I like what I'm hearing...

By The0ne on 11/25/2008 12:26:27 PM , Rating: 4

I would assume some people would want their porn back so they will go to any length to get it done :)

Seeing as how cheap laptops have become GPS seems a bit extreme. But for special sectors I can see this being viable.

Parent

RE: I like what I'm hearing...

By SiliconAddict on 11/27/2008 2:12:23 AM , Rating: 2

Cheap. Yah right. I just dropped 4 grand on a quad core Precision Mobile Workstation. $30 for a GPS radio and another $20 to place a good antenna in the cover doesn't seem extreme. Hell my G1 can currently call home to mama to http://www.instamapper.com I see no reason why a $300 phone can do what a $1500 laptop can't.

Parent

RE: I like what I'm hearing...

By mmcdonalataocdotgov on 11/25/2008 12:34:37 PM , Rating: 2

There are already cheaper GPS tracking devices available so why try to plant a laptop when you can just plant a USB key?

There are also GPS bags for sale on many web sites, so the thieves steal the laptop, put it in a GPS-proof bag, and bob's your uncle.

The total hack time on this stuff would appear to be perhaps 10 minutes. I mean, there are already two layers of passwords available on the equipment (system and OS) so why not implement those?

Then the idea of removing the hard drive is pretty straight forward. Then slap in your own, build your OS, and off you go. I bet alll you need to do is change the machine name or broadband account to disable. Actually, the broadband hardware since it probably works based on the decimal or hex ESN.

Anyway, just a way to make the idiots feel more secure when they lose a laptop. IMHO.

Parent

RE: I like what I'm hearing...

By DEJ on 11/25/2008 1:31:27 PM , Rating: 2

Sorry, but it isn't that easy. The passwords are stored on the TPM and you won't get past that without replacing the motherboard. Also, the tracking software is in the BIOS via Computrace. It comes that way from the factory and you can't remove it. You can put a new hard drive in and put whatever OS you want on it, but it will reinstall the tracking agent as soon as the OS comes up.

Parent

RE: I like what I'm hearing...

By Cheesew1z69 on 11/25/2008 4:24:38 PM , Rating: 2

Computrace has to be activated first, and if it's not, it's worthless.

Parent

RE: I like what I'm hearing...

By Zoomer on 11/28/2008 3:53:00 PM , Rating: 2

Step 1: Remove battery, do not power on laptop.
Step 2: Remove mobile network card
Step 3: ???
Step 4: Profit!

Parent

RE: I like what I'm hearing...

By blowfish on 11/25/2008 12:58:35 PM , Rating: 2

Most laptops "lost" at airports are never claimed by their owners. I suspect many people see losing a laptop as a way to a free upgrade.

Parent

RE: I like what I'm hearing...

By Yawgm0th on 11/25/2008 1:55:40 PM , Rating: 2

quote:
I dont know why they haven't implemented it.

Simple: Negative return on investment. It's the same reason why cellular providers generally won't help you locate a lost or stolen phone via GPS. It's a extremely cheap and easy feature to implement for either mobile phones or laptops that all competitors can implement. This means very, very low profit margins.

It would still be worth implementing, since a small profit margin is still profit. However, a consumer who loses his or her device no longer needs to purchase a new one. Unless it is stolen and the GPS module is permanently disabled, they will be likely to find it at some point (the whole point of the feature). If they find it, they don't have to buy a new one, and the manufacturer potentially loses a bigger, more expensive sale to their own feature. Thus, negative ROI.

Parent

RE: I like what I'm hearing...

By Screwballl on 11/25/2008 3:31:35 PM , Rating: 2

I use Verizon and a LG Chocolate with built in GPS. I saw the agreement paperwork that states it is my option that if the phone is stolen, I can sign over rights for Verizon to track the phone and turn it over to authorities.
There is the option, and many cell phones nowadays have that option. So few people actually read the information and know they have that option, and most cell providers will not tell you it is an option because they want you to spend another $30-300 for a new phone.

Parent

RE: I like what I'm hearing...

By Yawgm0th on 11/25/2008 11:01:09 PM , Rating: 1

That must be relatively new. I haven't had Verizon service since 2006 IIRC, but it was not an option when I did. Or at least they told me it wasn't. It wasn't an option at AT&T a few months ago when my roommate was employed there, but I don't know about now.

If it is an option, it's probably due to excessive customer service complaints. A computer manufacturer won't get customer service complaints for lacking that feature on a laptop.

Parent

RE: I like what I'm hearing...

By Aloonatic on 11/26/2008 3:06:07 AM , Rating: 2

On the subject of GPS tracking devices, how well do they work when they are not out in the open?

Am I right in thinking that the device would have to be powered and probably connected to a cell phone network for it to work effectively when inside buildings (or your car's boot/trunk), requiring power?

If you want to track your wife's movements then you can quite easily track her via a mobile phone.

There seems to be a big push over here for 3G mobile/cell phone network laptops in the UK at the moment. They require a USB dongle to work however.

How likely is it that there will be a day when laptops have mobile/cell phone modems and sim cards built in to them, suitable for all your wireless internet surfing and tracking needs?

Parent

RE: I like what I'm hearing...

By subhajit on 11/26/2008 3:32:10 AM , Rating: 1

Better still,
The laptop comes with in-built explosive
If you loose the laptop, arm the bomb with a text message
Next time the thief boots the laptop, a five second countdown followed by a blast.

Parent

RE: I like what I'm hearing...

By AnnihilatorX on 11/26/2008 5:49:56 AM , Rating: 3

Better yet

By sending a text message
The laptop is forced to play non-stop gay p0rn at full volume

Parent

RE: I like what I'm hearing...

By Raidin on 11/26/2008 1:57:56 PM , Rating: 2

The "defective" part of the exploding laptop batteries is just a cover story...

Parent

Simple override

By joeymantera on 11/25/2008 12:53:19 PM , Rating: 2

Like the psp, xbox, and virtually any console or electronic there are many ways to skin a cat. Lets see, simply reinstall the OS. If Lenovo gets smart and hard encodes the program in the bios it can be disable or maybe you could flash the bios. If its hard encoded on the board maybe the chip can be removed or rewritten aka flashing the chip. If its cellular they have cell signal blockers maybe buying time to hack the computer. Pretty much this would give high end hackers something to do when they are bored. One way or the other it will be hacked or modded. I'm glad this will be coming soon, I hope this catches dumb thieves!

God save the Queen!!

RE: Simple override

By Alareth on 11/25/2008 1:15:11 PM , Rating: 3

quote:
Lets see, simply reinstall the OS.

I think that you and a few other commenters are missing the point, this idea isn't really to prevent the thief from ever using the laptop, it's a measure to prevent access to any confidential data stored on the laptop.

Reformatting and reinstalling the OS if it's possible (It seems to me that this would be a hardware implemented BIOS lock), would delete all the data you wanted to protect anyway.

Parent

RE: Simple override

By nycromes on 11/25/2008 1:50:46 PM , Rating: 3

Not to mention, part of an idea like this is that the thief will have to work harder to profit from stealing this device... why do that when you can grab the next laptop from the guy 3 seats over and you won't have to worry about the laptop being remotely locked down.

I am all for this type of tech. Sure someone can bypass the security if they work hard enough, the harder they have to work, the less incentive there is to steal my laptop vs the next one that isn't protected. Just a thought... thieves might not care, so who knows.

Parent

RE: Simple override

By sigilscience on 11/30/2008 5:14:21 PM , Rating: 2

your average thief isn't going to know whether the laptop has this or not. this is all about data security as the OP said, not trying to deter a theft.

Parent

RE: Simple override

By AnnihilatorX on 11/26/2008 5:54:50 AM , Rating: 2

quote:
it's a measure to prevent access to any confidential data stored on the laptop.

If the HDD is not encrypted, anyone can take out the HDD with a screw driver and fit it into a HDD enclosure to recover data.

Parent

RE: Simple override

By mindless1 on 11/25/2008 1:52:27 PM , Rating: 2

Practically speaking, you miss the point. it's not whether any system is 100% unhackable, it's whether the majority of laptops will be protected from the majority of thieves. It definitely won't be only a matter of reinstalling windows, likely it'll flip a bit in nvram that the bios checks before allowing access to anything, which puts circumvention beyond the means of almost everyone who has so few skills that they can't make a living at something other than stealing laptops. Certainly the government will figure it out, having people paid to do such things if the manufacturer isn't cooperative, but otherwise no hacker needs to spend that kind of time to get at data when other fraud schemes are already too effective today.

Parent

RE: Simple override

By Cerin218 on 11/25/2008 4:14:29 PM , Rating: 4

So many here love to spew uneducated nonsense. Here is what Lenovo does for security for their products;

"To further enhance security, select ThinkPad® and ThinkCentre® systems also include an embedded chip called the Trusted Platform Module (TPM). ThinkVantage Client Security Solution works in conjunction with this chip to manage encryption keys and processes.

The TPM itself is isolated from the operating system using patented tamper-resistant technology. To initialize the TPM, users or administrators simply download the Client Security Solution and run a single setup wizard to install the software and create a set of master encryption keys.

The Client Security Solution and TPM store and enable user authentication through integrated hardware rather than in the software or memory, both of which are more vulnerable to unauthorized users."

This means that the information on the hard drive is encrypted with a hardware solution to protect it. Period. You can try and remove the TPM chip. Have you ever tried to remove a chip from a laptop mother board and put another one in its place? Most people don't have the equipment for it.

As all good system administrators know, security is never made up of just one layer, but several. The BIOS password stops people from getting into the BIOS. So you can't simply flash it and restore it back to factory. The laptop will never boot to a floppy in the first place to update the BIOS as the BIOS is what makes the floppy drive work. No BIOS access, no floppy controller. Or USB. Or Hard Drive. So a repair install won't be possible, even if you were to put a new hard drive in. If you wanted to get the data, the TPM encrypted it. So unless you are able to replace the BIOS chip in the motherboard, which we're back to most peole won't do, the laptop is now a giant paper weight. Your cell blocker theory sucks as there again, you need access first. The cell phone signal just protects the data you don't want someone to see. High end hackers don't do this crap for fun. It's done for profit. I am not going to spend 15hrs decrypting a hard drive just to find your porn, or get a password or two. I can do that by sending a trojan you'll be stupid enough to open.

Nothing electronic is unhackable but the idea is that if it is hard enough people may think twice before they randomly steal a laptop. Why rob a house with a pit bull in it when you can go the a house without one.

Parent

No coverage area

By japlha on 11/25/2008 12:28:12 PM , Rating: 1

What happens if the laptop is brought to an area where there is no cellular coverage? Might be enough to get the computer started to do a repair install of the OS.

RE: No coverage area

By snownpaint on 11/25/2008 1:35:42 PM , Rating: 2

Like the copper caged overseas container I use to hide stolen cars in, till I can find the spot on the car they hid the Low-jack. Great for blocking all incoming and out going radio frequencies. Combined with my cell phone frequency sweeper/jammer it will make sure nothing gets in or out, till I'm done with it. J/K

AS my Grandmother once said "No matter how much security you have, if a thief really wants it, they will figure a way to get it.."

Parent

RE: No coverage area

By HostileEffect on 11/25/2008 2:13:19 PM , Rating: 2

When a thief gets in, he might get more than he expected.

Parent

RE: No coverage area

By Darkk on 11/26/2008 1:04:20 AM , Rating: 2

Faraday cage is coolest thing to have......depending on what you tend to use it for.

I'd keep an watchful eye on the black van parked near your house...

Parent

As the old adage goes...

By helios220 on 11/25/2008 1:01:01 PM , Rating: 3

A window ajar attracts laptop ninjas afar.

When will we learn to heed the advice of our forefathers?

RE: As the old adage goes...

By snownpaint on 11/26/2008 10:14:35 AM , Rating: 2

Whats that? Kill all ninjas..

Parent

RE: As the old adage goes...

By Raidin on 11/26/2008 2:03:14 PM , Rating: 2

You can't kill all ninjas, because as soon as you say "kill all ninjas", one is dispatched to kill you.

Oh crap...

Parent

How long until the feature is abused?

By Maruta731 on 11/25/2008 7:01:25 PM , Rating: 2

Wonder how difficult it would be to do a remote-kill on someone else's laptop, just for fun.

RE: How long until the feature is abused?

By Xavitar on 11/26/2008 7:51:08 PM , Rating: 2

I would imagine that it would require knowledge of a password of some sort at a bare minimum, and possibly have multiple layers of identity verification and one-time setup verification such as the image signatures used by some online banks these days.

Really, though, if anything this just seems like a new target for bored 'hackers'. Whatever password or security mechanism is in place to stop people from randomly disabling other people's laptops via SMS is probably less secure than the physical laptop that this mechanism is supposed to be protecting. It sounds like Lenovo already has some fairly robust hardware security on the laptops. This additional SMS disable feature just seems like overkill, since anybody capable of circumventing the existing security is probably also wise enough to block cellular access to the device... Which is a simple endeavor, as some people have already been quick to point out.

The one case where this seems like it would be useful is in the case of extremely sensitive data that must be destroyed via psuedo-random, sector-level, drive trashing re-write algorithms... But anybody running around with data of that level of confidentiality or criminality on a LAPTOP is just stupid.

On the other hand, perhaps if we give Obama a new Lenovo he can be the first President to use a computer and e-mail.

Parent

define free?

By tastyratz on 11/25/2008 12:20:41 PM , Rating: 2

Will the capability be included in new laptops as well as the service monthly? or will there be a monthly charge for cellular coverage as well with this? Free can have many definitions.

This is an excellent idea however and I am sure it will go over very well with high risk corporations and government operations.

I wonder if...

By V3ctorPT on 11/25/2008 1:31:30 PM , Rating: 2

"PC roll over"... could work?

Don't buy a Lenovo

By Barium on 11/29/2008 4:24:58 AM , Rating: 2

I don't know why anyone would buy a Lenovo, given that the company is partly owned (and therefore controlled) by the Chinese government. You can trust your Lenovo as much as you trust the Chinese gov't.