Forgot your password?
typodupeerror
Crime Education Security Hardware Technology

Stealing Laptops For Class Credit 138

Posted by timothy
from the for-bonus-points-assassinate-the-prof dept.
First time accepted submitter core_tripper writes "Students at the University of Twente have stolen thirty laptops from various members of the university's staff. They were not prosecuted for this, so they could just get on with their studies. Indeed, these students even received ECTS credits for these thefts. UT researcher Trajce Dimkov asked the students to steal the machines as part of a scientific experiment. Stealing these laptops turned out to be a pretty simple matter."
This discussion has been archived. No new comments can be posted.

Stealing Laptops For Class Credit

Comments Filter:
  • by sethstorm (512897) on Friday February 17, 2012 @08:24PM (#39081233) Homepage

    This sounds like Pwn2Own taken to the next (and otherwise illegal) level. In this case, it looks like they were auditing physical security amongst other things.

    • by daedae (1089329) on Friday February 17, 2012 @08:28PM (#39081279)

      Two relevant anecdotes from when I was in college:

      1) In an artificial life course we got to propose our own semester project. One guy wanted to write a worm, but the professor was afraid that his tenure would not be enough to protect his job if the worm got out of hand.

      2) One faculty member that taught a computer security course used to make the offer that anybody who could successfully access his gradebook and change their grade could have the higher grade. He stopped doing this after students switched from trying to electronically break in to just casing his house.

    • by stephanruby (542433) on Friday February 17, 2012 @09:24PM (#39081711)

      This sounds like Pwn2Own taken to the next (and otherwise illegal) level .

      They did not do anything illegal. They technically didn't trespass, they had prior permission from the University Security office. And they technically didn't steal anything but loaner laptops that had been loaned out to staff for the express purpose of this experiment.

      The only reason you think they might have done something illegal is because of this phrase in the summary: "They were not prosecuted for this, so they could just get on with their studies." And the fact is, this sentence is just poorly worded (by the original non-native English author), and they were not prosecuted for this, not because of some weird altruist reason given by the University. The real reason they were not prosecuted is because they were given prior permission to do this experiment by the University Security office itself (and furthermore, the laptops they were stealing had been supplied by the grad student who wanted them stolen in the first place).

      So in all regards, this seems like this was a well executed experiment. And it goes without saying that you should get prior permission before doing any kind of penetration testing or security audit. And ideally, such a permission should be clearly spelled out and obtained in writing, since executives have been known to go back on their word with security auditors once they find out how bad their security really is.

      Also note that sometimes, con artists will recruit people to steal things for them under the guise of having them doing a security audit, so if you're going to participate in such an audit yourself, you better be damn sure that the person who's asking you to do such an audit is really the person they're claiming to be (and even if they are, that they're not setting you up for a theft that they've already committed themselves).

      • by LocalH (28506)

        The person you responded to said "otherwise illegal". Not that it was illegal as done here, but that it would otherwise be illegal without collusion with those being "stolen" from.

        • Ah ok, now I see what you're saying! Yes, it could be interpreted that way too. Please ignore my previous anonymous reply.

          The original parent will have to clarify what he meant, because in my personal opinion, it could still be interpreted either way.

          • No. It can only properly be interpreted one way. Taken to an otherwise illegal level means taking it to a level that is (still) not illegal. The reason it is not illegal is presumably and by implication extenuating circumstance.
      • Like Someone picks up the wrong item?

        Other laws are broken in the course of doing the test.

        Some harass cop busts some one and let's say try to hit them with raising arrest or other charges like braking and entering or some other law.

        Let's say you miss a test or class sitting in lock up waiting for it to be cleared up?

        some chains the laptop to a weak point and the person trying to take it end ups makes a big mess by pulling on it.

        What if some posing a technicians give fake advice ends and that turns in to a

      • by JustOK (667959)

        The University Security office does not have the authority to allow people to break the law.

        • The University Security office does not have the authority to allow people to break the law.

          No but the campus cops can choose whether to involve the actual cops or not. Crimes committed on campus don't always leave campus.

          Also certain crimes committed OFF campus by students are given back to the campus cops, particularly the stupid stuff.

          TFA seems to be describing something along the lines of a "security audit" or a "pen test" which would be illegal except when they are .... not.

    • by 1u3hr (530656)

      In this case, it looks like they were auditing physical security amongst other things. "Looks like"?

      If you'd bothered to read the fucking article instead of racing to make a first post, you'd know that was exactly what it was about.

  • Even if the submitter speaks another language, couldn't Timmy at least READ the summary before posting it??

    • by arth1 (260657)

      Even if the submitter speaks another language, couldn't Timmy at least READ the summary before posting it??

      Could you elucidate?

  • In the other news, 30 new government positions have been allocated as part of a "job program" to 30 soon to be graduates out of University of Twente. Seems like all of them will be IRS related jobs.

  • "The university’s security staff were informed in advance, to make sure that the students involved did not end up in jail."

    Physical security is a lot harder to enforce when you tell the physical security not to do their job...

    • by RyuuzakiTetsuya (195424) <taiki@co[ ]et ['x.n' in gap]> on Friday February 17, 2012 @09:01PM (#39081533)

      They were testing whether or not the staff followed good practices with physical security.

    • by Telvin_3d (855514) on Friday February 17, 2012 @09:01PM (#39081535)

      From the description, I suspect the notification was more along the lines of "If you catch a student stealing a laptop, see if they are on this list before you call the cops" and not "sure, they can take whatever they want"

    • by KevMar (471257) on Friday February 17, 2012 @09:07PM (#39081589) Homepage Journal

      I think its just the opposite. They didn't tell them to let the students steal the laptops, they let them know in advance that if they catch someone taking the laptop that it may be legit. Just by mentioning this would have made it harder because laptop theft would be on the security teams mind making it easier to spot.

      • by Dahamma (304068)

        Of course, if your theory is true that could skew it the other way, which still affects the outcome ;)

        I assume those students had a list of the exact faculty with said laptops, etc. It's a *bit* more than random theft when you have a coordinated effort to take something *knowing* that you would never be punished for it in the end. Still an interesting study and hopefully provided useful data, but it's still fairly contrived...

    • by Darinbob (1142669) on Friday February 17, 2012 @09:40PM (#39081807)

      Of course, it would be a good scam to tell security that it's a class project anyway. Then after all the laptops are missing and don't show up again, they look up your name and find out you're not a professor and are nowhere to be found.

    • by Teun (17872)
      I am fairly sure the information was not to the individual security persons but more to their manager(s).
      Besides, as others already stated they were not testing the security department.
  • Seems there are still scientists out there that know how to do something both spectacular and scientifically valuable. Impressive! I wish there were a lot more that can do things like this.

  • by MrQuacker (1938262) on Friday February 17, 2012 @08:35PM (#39081337)

    At the UofMN people walk out with entire desktops; while the people are still in their office. We had one person who was at her desk talking on the phone, with her back to the door, looking behind her out the window. Someone walked in, unplugged her iMac, and walked out with it.

    • Did they find the person who did it or are you confessing?

    • Re:Laptops are easy. (Score:5, Interesting)

      by Skyshadow (508) * on Friday February 17, 2012 @11:07PM (#39082435) Homepage

      I work for a large company, large enough that I see people I don't recognize on our campus every single day.

      Two years ago this weekend (Presidents Day, which is a holiday at our office) we had an enterprising thief roll a cart around our office around 5 PM on Friday, loading up laptops. Of course, by then most everyone had skipped out for their long weekend, but if someone was in the office he'd tell them it was for the "weekend virus scanner upgrade", promising people that their machines would be back on Tuesday morning.

      I don't know this part for a fact -- our security people and management don't talk about this at all -- but I've heard it enough that I believe it: When someone objected to having their laptop taken, he'd act irritated and ask why they "didn't reply to any of the emails about the upgrade" and then make a show of updating his clipboard -- he'd collect the asset tag from the machine, office number and actually get the person to sign on the line.

      I have no idea how many machines he made off with, but it was enough that we all had to suffer new BS security procedures for a year afterword. I would imagine that you could do this at pretty much any big office and get away with it.

    • At the UofMN people walk out with entire desktops; while the people are still in their office. We had one person who was at her desk talking on the phone, with her back to the door, looking behind her out the window. Someone walked in, unplugged her iMac, and walked out with it.

      Similar thing happened at a uni I had attended. Someone walked in while the prof was in the office, unplugged the laptop and walked out.

      When the thief found out he had just stolen an Acer though, he just quietly returned to the office and plugged it back in.

  • by martin-boundary (547041) on Friday February 17, 2012 @08:36PM (#39081343)
    Suppose one of the students followed his friend around to see how he stole a laptop, and then later copied the method? Would he get credit, or be marked down for plagiarism?
    • And then suppose that student was not part of the research group (the "thieves"). Hope they had a backup security method.

  • From TFA:

    The members of staff who had loaned the laptops were asked to make sure that these machines were always chained to their desks.

    So the fault was with the people who loaned the laptops for not keeping them chained up. It's hard to loan someone something if you've chained it to your desk, but that's the best security if you don't trust the people you loan things to, I guess.

    • by Osgeld (1900440)

      every laptop for decades has a kingston lock on it, which is a little tiny lock with steel rope that loops around anything you feel is too heavy to lift with your laptop

      If I loaned you my laptop I would be pretty fucking pissed if it got stolen even after my specific requirements to prevent such an action, and lastly for some odd reasons people often view laptops as valueless tools, which has always baffled me.

      I watched a co-worker one day get seriously irate cause someone stole all the pens off of

      • by duk242 (1412949)
        I've had a few laptops stolen from a computer lab that were chained down with kensington locks.. They managed to get the window off its rails, then reach in and pull 3 laptops out, all 3 of them the locks weren't strong enough to survive them pulling them hard enough. Maybe it was because I used a cheaper brand lock or something, but still kinda annoying :(
        • by Osgeld (1900440)

          yea but (and there is always a but) if you had loaned the laptop and told you specifically to lock it down in a locked room, which would you be more mad about when it was stolen?

          "they broke into though the window and used all their might to rip the lock out of the laptop"

          or

          "I left it in the wide open, only tethered by its power cord"

  • If they had permission..

  • trust (Score:1, Insightful)

    by Walt Dismal (534799)

    Seems like a douche move rather than a fair one. A university is a place of somewhat more trust in others than the outside, because in academia you share knowledge with others, the spirit is a bit different, you don't take others' tools.

    Taking advantage of that to run a test of whether it's easy to steal laptops is not entirely ethical.

    Not to say that people shouldn't be careful, but exploiting them isn't cool either.

    When I was in school, someone hacked my student account and framed me for downloading and p

    • Interestingly enough, many of these students may never have attempted to steal a laptop because of the legal consequences. Now that they were given permission to become comfortable with the idea, it is more possible that one of them would be inclined to steal a laptop at a later point. After all, they now know how to get past security (assuming nothing is beefed up after the experiment).
      • by Teun (17872)
        People don't engage in criminal acts because they can but because they have a lacking sense of morality and honesty, tests like these aren't going to change their moral outlook to accept dishonesty.
    • Seems like a douche move rather than a fair one. A university is a place of somewhat more trust in others than the outside, because in academia you share knowledge with others, the spirit is a bit different, you don't take others' tools.

      Taking advantage of that to run a test of whether it's easy to steal laptops is not entirely ethical.

      Not to say that people shouldn't be careful, but exploiting them isn't cool either.

      When I was in school, someone hacked my student account and framed me for downloading and piracy. I didn't have to go to court, but if I ever found out who did it, I'd gladly have caused them serious injury.

      LOL.
      Welcome to the real world. Protip: Academia, as much as it tries not to, does lie within the realm of the real world.
      And anyone with a brain would be as untrusting, or more untrusting, of a university student/professor than they would of a random stranger.

    • by Xeno man (1614779)
      Where exactly does this sense of trust come from? Because you were a student and you trusted other students? You trust the faculty because they wouldn't risk their jobs?
      That's great you have that much faith in your friends and such but that is not everyone that is in a university. Most schools have wide open doors most of the day where anyone can come and go as they please. Strangers are welcomed daily from delivery people, maintenance specialists, tour groups and friends of students and staff. It doesn't
    • by EvanED (569694)

      Know how I can tell you didn't RTFA?

      No, it's not because this is slashdot. It's because the profs who were involved all agreed to it, and in fact didn't involve their normal machines. They didn't just go steal laptops and go "ha ha only kidding" after.

    • by Anonymous Coward

      Actually, from a security perspective, Universities tend to be "hostile environments." You get a lot of bright, young minds all in the same place with relatively little to lose (compared to later adult life), a wide variety of background skills and you have a recipe for mischief.

  • "We only looted, raped, and plundered for science." - Vikings

  • by hitmark (640295) on Friday February 17, 2012 @10:12PM (#39082017) Journal

    Reminds me of the early days of computing, where often a student that was found able to break school system security was often given tasks by the IT admin.

  • by DuranDuran (252246) on Friday February 17, 2012 @11:03PM (#39082411)

    Hard to see how a university ethics IRB (Institutional review board) could approve something like this.

    • "Why? It doesn't hurt anyone, after all." -Albert Einstein
    • by Teun (17872)
      Because they too found this an interesting experiment, maybe even more so than others?

      The same counts for the security dept, it would be a valid learning point.

    • by Sigg3.net (886486)

      There is no contradiction between theft and being ethical (or moral, rather) provided your ethical ground does not respect property, property rights aso.

      In example, utilitarianism is perfectly compatible with any conceivable horror, as long as the net pleasure outweighs the pain. (Most utilitarianist will not agree, and they are wrong.)

      However, the story in casu is a competition not a crime.

  • Well done (Score:4, Interesting)

    by PopeRatzo (965947) on Friday February 17, 2012 @11:36PM (#39082613) Homepage Journal

    I once gave my undergrad students a similar assignment where they had to each score an ounce of weed for me.

    It was also a great success and provided them with an important life lesson about society and individual liberty. Or something.

    The Dean of my department at the time was not amused, though he did think the sticky red bud was the bomb.

  • Political science majors would get extra credit for theft.
  • If they were really students at the Univeristy of Twente, how come they stole Thirty instead of Twenty laptops? Not very good students.

  • I had (Score:2, Interesting)

    by Anonymous Coward

    heard of laptops being stolen from large businesses by people dressed and acting like UPS/delivery/IT personel. These types of people are generally ignored. Act as if you belong there and people will think you do, even though they have never seen you before.

    The most sucessful ones that I had heard of had dressed themselves as delivery people and walked in with a 2 wheel cart with empty boxes on it. The boxes were not empty when the walked out again.

  • Lojack for Laptops.

"A great many people think they are thinking when they are merely rearranging their prejudices." -- William James

Working...