Help -- i can see my stolen computer on my network!!!

fat elvis ad

Hello all...



this is not my first post, although it is my first in years. I have a problem I am hoping someone can help me with.



On sunday evening, my office was broken into and the thieves stole 2 iMacs as well as various other things. I have a police report started and an insurance claim going, but I can now see and connect to one of my old computers. I have even copied a file from it. It appears on my network in my shared list (i am running Leopard). Another computer here cannot see it, which makes me think that I am able to somehow connect remotely to this computer (they dont appear to be on my local network as far as I know).



I have tried apple tech support, cox tech support and even my detective and no one seems to know what to do. I want to, if possible, find the IP address of my old computer that it is running and give this to cox to see if they can locate the computers physical location. Is there anything i can do?



Please help

crazychester

I don't know enough to give you an answer (somebody here almost certainly does). However, I recall a similar case from some years back. IIRC, the owner of the stolen computer was able to access and remove sensitive files from it via Timbuktu (I think) when the thief stupidly logged onto the net via the owner's ISP. The owner managed to track it to an actual street address, the thief was busted and they got their Mac back. I remember it because it was such a brilliant sting. I'll see if I can find a reference to it.



In the meantime, until somebody more knowledgeable gets back to you, the only thing I'd suggest is not to alert them to your presence. Catching the bastards would be soooooooo sweet.

kishan

if you can share screens via back to my mac, maybe you can turn on the iSight and take their pictures...? Kickass!

fat elvis ad

Quote:

Originally Posted by Kishan


if you can share screens via back to my mac, maybe you can turn on the iSight and take their pictures...? Kickass!

how do i do that???

kishan

Quote:

Originally Posted by fat elvis ad


how do i do that???

I made the reply kind of half-joking. Back to my Mac is a feature available to .Mac users of Leopard. As far as how you can track down the computers, I wish that I could offer something of substance, but I just don't have the expertise.

fat elvis ad

Quote:

Originally Posted by Kishan


I made the reply kind of half-joking. Back to my Mac is a feature available to .Mac users of Leopard. As far as how you can track down the computers, I wish that I could offer something of substance, but I just don't have the expertise.

hah. funny.



although i do have .mac on my laptop -- i wonder if thats why i can see it shared?

kingofsomewherehot

ok.... in the finder, select that computer from the sidebar, then select the "share screen" button IF IT IS AVAILABLE. That'll open a window with the entire desktop of your "remote" mac (the stolen one?) and you have complete control over it... you can open PhotoBooth and snap some shots, then eMail them to your home computer , you can delete your keychains, passwords, clear caches on the remote computer... go into the System Library and effectively "kill" the OS.

crazychester

Ooooooh a mug shot would be nice.

talksense101

Impossible to guess without having full insight of your network and computer setup. A word of caution, I would be more worried about the thief getting access to your network resources instead of getting mug shots. If you are able to connect to his/her machine, what prevents him/her from doing the same?

kingofsomewherehot

Quote:

Originally Posted by talksense101


... If you are able to connect to his/her machine, what prevents him/her from doing the same?

Screen sharing could be enabled for the stolen laptop, but turned off for the other computer (assuming Back-to-my-Mac Screen Sharing is the reason you can see it as a share.) So yes, I'd go to Sharing Preferences and make sure YOUR computer is inaccessible to the thief.

Marvin

Quote:

Originally Posted by fat elvis ad


On sunday evening, my office was broken into and the thieves stole 2 iMacs as well as various other things. I have a police report started and an insurance claim going, but I can now see and connect to one of my old computers. I have even copied a file from it. It appears on my network in my shared list (i am running Leopard). Another computer here cannot see it, which makes me think that I am able to somehow connect remotely to this computer (they dont appear to be on my local network as far as I know).



I have tried apple tech support, cox tech support and even my detective and no one seems to know what to do. I want to, if possible, find the IP address of my old computer that it is running and give this to cox to see if they can locate the computers physical location. Is there anything i can do?

Maybe try Bonjour browser:



http://www.macupdate.com/info.php/id/13388



It shows shared volumes and you open the tab to get the IP and MAC hardware address to verify the computer itself.



You can also try using your Network Utility in the utilities folder and try doing a traceroute or ping of the computer shared name.



If you get the IP, you can type e.g whois 104.56.45.34 in the terminal using the IP instead of that number and it should give you some info about it. It might not be all that meaningful but it might give you a lead.



You can do a trace yourself with sites like this:



http://www.ip-adress.com/



but it seems to show the ISP server location.

orionthx

OP let me know hows this goes, Im curious to see if this is even possible

lundy

Telling him to use Screen Sharing isn't a good idea - it will tip off the thief and they will disconnect.



The key thing is to get the public IP of the machine. It may be just an internet hotspot, but it could also be the thief's house.



Just go into Terminal and ping the thing.

adders

Have you done netstat -r in terminal to see if the stolen imac features on the list it gives you. Just thought it might give you a handle on the thief's WAN IP maybe?

adders

Another thought, if you do find an IP address by any of those methods it may be worth noting the date and time seeing as most WAN Ip's seem to be allocated dynamically by the ISP's these days so don't necessarily stay the same for very long. I don't know if ISP's keep information on who IPs are allocated to at a given date and time, but it can't hurt to have the information in case they can pin the person down once you've identified the ISP.

lundy

Quote:

I don't know if ISP's keep information on who IPs are allocated to at a given date and time,

Yes, they absolutely do - that's how the RIAA and law enforcement catch people. Now if it is a public hotspot, then odds are you aren't going to be able to know who it is, but you'll know where the hotspot is.

adders

Quote:

Originally Posted by lundy


Yes, they absolutely do - that's how the RIAA and law enforcement catch people. Now if it is a public hotspot, then odds are you aren't going to be able to know who it is, but you'll know where the hotspot is.

Hey again Lundy. Would have thought it almost certainly is a home network connection, though. Running an iMac from a park bench seems a tad impractical!



Elvis, I noticed that you mentioned you are on Leopard. Is that true of both the stolen computer and the one you can see it on? If that's the case then I would say it's quite possible that you're seeing the stolen machine through Back to my Mac, part of the dotMac service. If you don't have office VPN or the missing iMac isn't a VPN client then I think it can only be the dotMac account that is enabling you to still see the machine. Which leads to the question does Apple log ip's of people when they log on to dotMac. Might be worth putting the question to Apple if you don't have any luck getting the ip from Terminal.



Let us know how you do. Would be fantastic if you get the bar stewards.

mr fish

Quick question:



Did you apply a password lock to your login??



If so, remotely change the password and remotely shut down the Mac.

adders

Elvis,



Was just interested to know what happened in the end?

nefrocatracho

Quote:

Originally Posted by Kishan


if you can share screens via back to my mac, maybe you can turn on the iSight and take their pictures...? Kickass!

Someone did this... http://www.nytimes.com/2008/05/10/ny...nt&oref=slogin



They took a picture with iSight, NYPD circulated it, they caught the bad guy!