Fri, 06 Aug 2004

Stop! before you steal that laptop...
I have been consulted on more than one occasion to track down laptop computers...in particular stolen laptops. Sound like a daunting task? Well, not anymore.

I am very excited over a growing trend among laptop manufacturers: Built-in WiFi. These typically consist of internal MiniPCI WiFi adapters and antennas built into laptop screens. That means I can use the PCMCIA slot for something else, in my case, a nifty CDMA data card. But I have also noticed that as a side effect, there is no quick way to remove WiFi functionality. After all, who in their right mind would want to disable such a wonderful technology on their computer? If you didn't think wireless was cool, you probably wouldn't be reading this article.

Most people are completely unaware of how WiFi works -- even if you are not connected to a network. And thanks more to a WiFi card's premicious nature, constantly hunting for an Access Point, even if you only have "LINKSYS" or "MYCOMANYAP" assigned.

Thats right, depending on the WiFi client, your laptop may search for a signal several times a minute. My WiFi card on Windows XP seems to send out almost 30 requests a minute. And on each transmission WiFi makes, a unique fingerprint is encoded into the packet, more commonly known as a MAC address. MAC addresses are unique, and no two MACs are alike. Format the machine? Re-install windows? Unless the MAC is purposely changed, it will never go away. Using trivial software (ie: passive 802.11 frame sniffer), we can look for scanning messages (more technically, probe management frames) and hunt for a specific MAC address.

So what happens if a dishonest neighbor or employee lifts a laptop? They better disable that WiFi card, because in combination with available evidence and usual cirumstances, it is the final nail in the coffin. That laptop will be shouting out, in the dark, with a bright flashlight saying "Im here! Im here!" for about 500-1000 feet, depending on equipment.

This technique may sound far-fetched, but its amazing how effective it is.

[/wifi] permanent link