A company specialising in managing mobile computers for clients in the medical sector, was able to track down an allegedly stolen laptop using a Managed Service Provider (MSP) agent.
IT Force was running Kaseya’s MSP agent on a client’s computer when the laptop went missing from a public location in Auckland in early 2010, according to the company’s managing director Michael Inglis.
“The client notified us that the laptop had been stolen and that they had purchased another one, and they asked if we could restore the data,” Inglis says.
IT Force employed a script that would run without being seen or easily removed from the system, to notify the company when the laptop came back online, and lock-down the computer to prevent further access. None of this was a likely scenario if the laptop had been stolen and all data erased from the hard drive .
“I didn’t think it would happen,” Inglis says. “If it gets wiped, there’s no chance. But the person had no clue.”
That’s because after six months, someone did turn the laptop on. According to a report filed with the police, Inglis was able to quickly gather identifying information including two IP addresses which he brought to the attention of the police. IT Force was also able to use the laptop’s webcam to take a photo of the person using the computer at the time and to even identify that person’s mailing address, email and Facebook page.
A case was brought against the person identified as possessing the computer, which was subsequently dismissed due to lack of evidence indicating the person using the computer was the one who might have stolen it or knew that it might have been stolen, according to Inglis.
Because it took two months for the police to issue a warrant in the case, the laptop was never recovered, but IT Force was able to erase the client’s sensitive information and to recover important data thanks to regular backups.
Police would not comment on the case, but Inglis believes this was the first local instance where scripting agents were used to locate an allegedly stolen computer.
There have been cases in other countries where managed service providers used remote management agents for such a purpose.
In 2009, Australia-based Navigatum was able to use the Kaseya agent to recover a laptop stolen out of a car in Melbourne.
Scripting issues were top on the minds of participants at a Kaseya user group conference in Auckland in February. As a result, in early March the company began to develop a New Zealand centric scripting forum.