Subject: Re: [dhcwg] Using DHCP to thwart the theft of computers

From: Vidar Løkken <[email-masked]>
Date: Fri, 24 Feb 2006 18:18:03 +0100 (CET)

On Thu, 23 Feb 2006, Tom Loveday wrote:

> Hello,
>
>
>
> This is a high level idea for implementation into DHCP.

And a poor idea.

> Another recent trend has been the inclusion of the NIC on the motherboard of
> most computers. Rendering the MAC address as a unique signature associated
> with a single computer.  By establishing a central repository for the MAC
> addresses of stolen computers and implementing a simple check of that
> repository in DHCP, we could put a dent in the theft of computers.

Unique? It takes 3 seconds to change it, at least on Unix, and I believe 
it is trivial to change under other OSes. If that fails, I'd stick to a 
pcmcia card.

> There are significant problems to overcome.  The size of the repository, if
> not implemented correctly would be a problem. Also, the use of private
> networks is another stumbling block.  However, it is my belief that these
> issues can be overcome.   For example, it would not be the responsibility of
> the DHCP server to wait for a response from the repository, after the MAC
> address is submitted, no further action is required.  The repository would
> be responsible for determining if the MAC is from a stolen device and
> submitting the salient information to the appropriate law enforcement
> agency.
>

Why would I, as a administrator be interested in this? Means paperwork for 
me, probably. It's simply easier to ignore stolen laptops. Nor do I 
believe stolen laptops is used on /professionally/ managed networks to 
often.

> So what information is needed to properly identify a stolen computer well
> enough to locate it?  I would think the public IP, the fqdn and the
> identification of the ISP would be sufficient, but that is not my area of
> expertise.  The existence of a MAC from a stolen computer on their network
> should be enough to obtain a warrant for the client information associated
> with the stolen MAC.

All info about it. You can't locate a machine based on a IP, usually. But 
from dhcp you'll probably know the machine is within your lan...

> Think about it, for the cost of transmitting a single packet to a stolen MAC
> repository, we could greatly increase the chance of recovery of stolen
> network devices.  I would like to work with your group and others toward
> implementing this mechanism within DHCP.

Feel free to implement it. I'd prefer to have such POS turned off on a net 
I managed.
-- 
MVH,
Vidar
Whatever became of eternal truth?

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg