We had an iMac stolen. The thief has upgraded the OS and deleted users, but is still using the computer. It is faithfully reporting in to the JSS every 15 minutes. How can I copy the users home directory to a location on my servers to try ti identify the bad guy?
I obviously have his IP address, but the last time we had a situation like this, Comcast told LE that it would take 3-4 weeks to identify the crook by IP. (BS)
Anyway, I was thinking that if we could copy his home folder, we could possibly identify him I have an ftp server I could copy files to. I could make a policy to copy the files and hopefully pull some incriminating info.
Hey @May, I did as you described. You really have two options. You can either drag a dummy text file out of /tmp/ into composter just to create the new package project, then drag in the prey installer pkg file from /tmp/ into the window in the sources window.
OR as I really prefer to is just drag whatever .pkg file I need to do this kind of thing in to /tmp/, rename it with a different extension like .blah, then drag that into composer. It will create a new package project and add the /tmp/package.pkg.blah to the sources section, and then inside the sources section I just rename the file and take the .blah off the end of it. That way it doesn't trigger the convert to source thing.
Then after you do that just add a post-install action as we discussed above to install the package with your API key environmental variable set and you are good to go :)
Hi @chriscollins
That's a handy trick, thank you for the quick response!
package is waiting to install when they come online again...
Did you ave to wait for the device to show up in your Prey web page before you can choose what info you wish to collect ? or does that get set another way ?
Thanks again!
Andy
Its been a little bit since I used it but you can have Prey's server email you when a new device registers. After that though I think you have to go into the interface and turn on the actual information gathering/tracking by clicking the "Set Device To Missing" or something similar. Its basically the big RED button. haha.
@chriscollins
Package is installed and device is now showing up in the interface (where the screenshots and photos can be enabled/disabled)
What a great piece of software,
Thanks again for the configuration info!!
I'm dying for an update. What was the end result? @Kevin
This is quite a interesting story, I am wondering what the update is as well, being if you are allowed to say anything at all currently. @Kevin
I just tested prey on a couple machines and set it to not take pictures, just screenshots. It works until a reboot. Once the device is rebooted it then only takes pictures and no screen shots, the exact opposite of how it was set. Anyone else have that issue?
Well if you have Casper access to his machine and he's checking in...in theory you could remote into his machine and watch what he's doing. Not sure about legality of what you can and can't do. Personally, I would screw with him and just have the mac keep playing "Somebody's watching me" over and over.
There was a famous case here in PA (my old high school) where kids were given mac laptops and admins apparently where turning on the cameras to spy on them. One kid was reprimanded for doing something at home that was not up to "school code". The principle actually showed the student the picture taken by the laptop. Of course, lots of media jumped in and it became a huge thing. According to the school, the laptop was reported stolen and they were trying to find it.
Work with your local police authority and document everything you get. Good luck. I'm enjoying following this story.
Update.
It took a while, but my loss prevention team finally got something going. They are being quiet about details, but told me to wipe our data from the unit and remove our JAMF agent (as well as the Prey software). The current "owners" bought it "legitimately" from a local pawn shop, and it looks like that are going to keep it. Ugh.
LE is going after the pawn shop and the person they bought it from.
If it were up to me, we make LE go get the iMac back. You buy a hot computer, you lose it. On the other hand, it is a 7 year old iMac…
So today, I get to clean it up and let it go.
@Kevin Hopefullly the pawn shop will have some good security footage of who sold the iMac to them.
Reminds me of a great story I saw recently about a guy who had his iPhone stolen. Apparently a large percentage of stolen iPhones go to china. One person noticed a year after his phone was stolen that pictures would show up on his iCloud feed on a chinese man. He took to twitter and was able to local the person and they became good friends. He even visited China and was treated like a local celebrity. So sometimes these stories have a happy ending.
Good luck with the Pawn shop!