[maemo-developers] Remotely Nuking a device (was Re: becomeroot once again but with password)

[From: Paul Klapperich]

On 2/24/07, marc zonzon <marc.zonzon at gmail.com> wrote:
>
> On 2/22/07, Paul Klapperich <maemo.org at bobpaul.org> wrote:
>
> > You could setup pubkey authentication on your home ssh server. Then you
> > could add a script to the device such that when it connects it runs
> > something like:
> > ssh -n -R2022:localhost:22
> >
> Good idea, as your ssh is an outbound connection the local firewall
> may accept it. But your command is incomplete, we must have something
> like:
> ssh -n -R2022:localhost:22 myusername at myserver.com sleep 3600
> and you must be sure that the public key of the nokia user is accepted by
> myusername at myserver.com
> It would be helpful to replace sleep by a script that  warn you, then
> sleep


Yeah, I left it incomplete on purpose ;) I figured someone doing something
like this should already know a bit about what they're doing, or read a
little man page if not. ;)

> Then on your local computer you could "ssh user at localhost -p2022" to
> connect
> > into your device whenever it's on the internet, regardless of where it's
> > connected from. You could manually erase the data, something like:
> > for i in /home/user /media/mmc1 /media/mmc2; do
> >   rm -rf $i
> > done
>
> We can do like that but it might be frustrating when you miss the
> connection, or when it is interrupted before you finish, ...
> I think this can only be an add-on to the second option.
>
> > Another trick I've used--actually to update computer labs--is to keep a
> > script on your server, then have the device use scp to copy that script
> from
> > the server and run it whenever it connects. In my case, the script was
> > simple. In your case the script would do nothing. To nuke your nokia,
> > replace it with one that erases stuff. This will get it the next time it
> > connects and wouldn't require you find know when the device connects.
>
> That's fine we use the same "download at boot and execute" to keep our
> clients up-to-date. We just need to find how the script can be
> triggered when the tablet connect to internet


 Since this is debian based, I would expect one could simply place an
executable script in /etc/network/if-up.d/
My handheld got left at work this weekend, though, so I can't verify this
right now...

(must not be difficult,
> but I have not looked upon the tablet networking). Your emergency
> script can of course erase sensible data but also add a startup
> service in /etc/init.d that shutdown the tablet if some special action
> (say use some key) is not triggered. Making the use of the tablet
> impossible except for you  without reflashing.
>
> Better than scp you can download the script from an httpd server using
> netcat, because outbound http connection on port 80 are always open on
> any
> access point your tablet may use.
>
> > Other options would include writing a lot file to your home machine with
> the
> > IP connecting from. This could be used to track your device so you might
> be
> > able help police recover it. Or you could delete important system files
> and
> > your personal data to make the device worthless without a reflash.
>
> Too complicated just mail a message when you connect "I'm connected
> from ip n° xxx.xxx.xxx.xxx gateway xxx.xxx.xxx.xxx", if you have
> traceroute you can even traceroute to a known point to help locate the
> device. but I suppose it's of no use, some people complain that the
> police is not even looking for their stolen child, what do you expect
> for your tablet!


Good point. I like SSH and SCP because they're secure, but I suppose I don't
really care if someone finds my nuke script on my webserver, or notices an
e-mail bounce around like you described.

I was thinking of something like this, and thus I'd prefer is someone who
stole my tablet used it, but without my private data and with some sort of
log to help track it down:
http://hosted.ap.org/dynamic/stories/T/TECHBIT_ALIENS_LAPTOP?SITE=FLDAY&SECTION=HOME&TEMPLATE=DEFAULT
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.maemo.org/pipermail/maemo-developers/attachments/20070225/20806035/attachment.htm