×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

OLPC Has Kill-Switch Theft Deterrent

ScuttleMonkey posted more than 6 years ago | from the paperweight-maker dept.

Portables 138

Sid writes "Ars Technica reports that the One Laptop Per Child (OLPC) XO has an anti-theft daemon in the OS that can be used to remotely disable machines, much like WGA. The Project added the kill switch at the behest of a few countries concerned about laptop theft. From the report, 'OLPC has responded to such concerns by developing an anti-theft daemon that the project claims cannot be disabled, even by a user with root access. Participating countries can then provide identifying information such as a serial number to a given country's OLPC program oversight entity, which can then disable the devices in certain scenarios.'"

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

138 comments

How long before M$ copys this and cames it........ (2, Informative)

Joe The Dragon (967727) | more than 6 years ago | (#18068624)

Wait vista can do this.

Re:How long before M$ copys this and cames it..... (2, Funny)

xtracto (837672) | more than 6 years ago | (#18068790)

I was able to do this and *much more* with Microsoft operating systems. I was able to turn off the computer, open the CD-ROM drive and even play sounds remotely using utilities such as black orifice or sub-seven.

Gosh, this is nothing new...

Re:How long before M$ copys this and .. (-1, Troll)

Anonymous Coward | more than 6 years ago | (#18068884)

hey fag monkey .. $top fucking your $i$ter in your mother'$ ba$ement

uppity kids (0)

Anonymous Coward | more than 6 years ago | (#18068646)

Kid gets out of line, discovers blogging .. time to shut off his access..

furst post from stolen laptop (-1, Troll)

Anonymous Coward | more than 6 years ago | (#18068648)

lunix sucks so much the daemon crashed

what certain scenarios? (1)

192939495969798999 (58312) | more than 6 years ago | (#18068672)

Like when a bunch of rebels steal all the laptops and start using them for crime? Wouldn't you want to leave the machines running so you could track what they were doing? What situation(s) exactly would warrant shutting off the machines?

Re:what certain scenarios? (4, Insightful)

Spad (470073) | more than 6 years ago | (#18068730)

In most cases the value to the thief is not in the object itself but in its resale value. If they know that the laptops will be bricked before they can shift them, it might deter some people from swiping them.

You overestimate the intelligence of thieves ... (2, Informative)

AHumbleOpinion (546848) | more than 6 years ago | (#18069566)

In most cases the value to the thief is not in the object itself but in its resale value. If they know that the laptops will be bricked before they can shift them, it might deter some people from swiping them.

It will deter few. I recall looking at computer equipment in a pawn shop. I was excited as I saw some IBM Model M keyboards. Upon inspection I found that the keyboards had not been unplugged, the cables had been cut. I expect many thieves will have difficulty telling OLPC systems from normal systems at the time of the robbery. I also expect that highly organized thieves will not shy away from stealing a large shipment of these laptops, and stripping the RAM and HD for salvage.

Also, "resale value" may be misleading. It is rarely sale to an end user, rather a middleman, as in pawned, laundered, fenced, etc.

Re:You overestimate the intelligence of thieves .. (2, Informative)

ZachPruckowski (918562) | more than 6 years ago | (#18069780)

There is no HDD. There's like 128 MB of RAM, and 512 MB of Flash (expandable). You couldn't sell a 128 MB stick of RAM for any sort of large profit (most retail sticks start at 256 MB or 512 MB), and a removing the flash and consolidating it into something useable to any other product would exceed the costs of bulk flash in the first place. The displays probably need a custom driver. The only thing really useful is the battery, and even that's low-end.

The fact remains that when you take into account the costs of stripping the OLPCs for parts and selling the parts on the black market, you quickly exceed the possible resale value of the parts.

Re:You overestimate the intelligence of thieves .. (1)

ADRA (37398) | more than 6 years ago | (#18070350)

An even better reason to build in a deterrent. A 'dumb user' may see a laptop and not know the kill switch exists but you can be sure the middle men know what they're buying.

Yes, some thieves are idiots but I'd presuppose that most are just desperate to make any kind of money in order to support substance abuse.

Re:what certain scenarios? (1)

palladiate (1018086) | more than 6 years ago | (#18068738)

A perfect scenario is when that rebel is acting alone, 12 years old, at home, and looking up some seditious website like Slashdot, or Dailykos, or whatever the local, 3rd-world equivalent will be.

Re:what certain scenarios? (1)

slim (1652) | more than 6 years ago | (#18068770)

What situation(s) exactly would warrant shutting off the machines?
It's a deterrent to theft: steal this and there's a good chance it'll get bricked.

"Certain scenarios" was probably added to the sentence to short circuit pedants who'd pipe up with "what if there's no Internet connection?".

Re:what certain scenarios? (1)

192939495969798999 (58312) | more than 6 years ago | (#18069910)

If the authorities are corrupt it could get bad: they steal it, sell it, brick it on purpose after receiving $ and then ransom the un-brick code to the victim/customer.

That's too abusable (2, Interesting)

paladinwannabe2 (889776) | more than 6 years ago | (#18068886)

That makes it too tempting to give the laptops to people you want monitored- For instance, I could give it to random kids, and then figure out their schedules, where they live, and when they are alone in the house. And that's just scratching the surface- give me some time and I can think of worse abuses you could do with some sort of monitor on the computers.

De-activating the laptops prevents people from stealing and using them, but it also means that if some hostile person has access to your shutdown keys, they can take your laptop but not your data.

Re:That's too abusable (3, Informative)

SirTalon42 (751509) | more than 6 years ago | (#18069490)

The monitor only lets the OLPC authority shutdown the machine IF the anti-theft server says the machine has been stolen, OR the laptop is kept from accessing the server for more than x days (21 I think). And the daemon CAN be disabled, if the child requests the developer key from the OLPC authority (theres a 7 day wait to make sure the laptop wasn't stolen between the request and giving the key). The laptop uses code signing to prevent the operating system from being permanently modified (if you have the master key(s), or the developer key, you can modify it as much as you want, if you don't you can modify most of it but only in a copy of the system files, its a very nice way to allow most of the system to be modifiable by the kids, but if they bork it, you can just reset to using the original system files (assuming you didn't modify the original using the master/developer keys).

Now if the thief steals the developer key with the laptop, then the daemon is useless (unless they're too slow), and in the BitFrost document they acknowledge that theres is no way they can guarantee no laptops will be stolen, just try and discourage the thiefs.

Re:That's too abusable (1)

LuminaireX (949185) | more than 6 years ago | (#18071796)

Your daemon won't do anything when I format the drive. You could Ghost/dd the formatted drive with a modified installation from another laptop, or put another Linux distro on it.

Re:That's too abusable (1)

bhsurfer (539137) | more than 6 years ago | (#18069538)

I couldn't agree more. The first thing I thought of when I saw this was "Oh boy, if they can't own the internet at least they can own the individual machines connected to it." This whole scenario begs for slippery-slope abuse - we already have lots of background on how fair these 3rd (& 2nd & 1st) world governments like to play when it comes to controls over citizens. I think this is an extremely bad idea and will take some serious convincing to ever feel otherwise.

Re:what certain scenarios? (1)

Hal_Porter (817932) | more than 6 years ago | (#18069086)

They're shipping them prepaid to countries where the authorities are highly corrupt and the laptops are highly in demand in the US. You'd expect criminals in those countries to buy the shipments off the authorities and sell them on ebay for as much as possible back in the US. If they have a kill switch it should discourage this I guess, assuming someone high up in the country gives a shit about what's happened.

Re:what certain scenarios? (1)

edittard (805475) | more than 6 years ago | (#18069332)

assuming someone high up in the country gives a shit about what's happened.
ROFLMAO!

Limited Deterrent (4, Insightful)

Nerdfest (867930) | more than 6 years ago | (#18068706)

Sadly, I would imagine it will be a very short period of time before the feature is defeated. It's still a deterent I suppose, just not as much of one ...

Re:Limited Deterrent (3, Insightful)

truthsearch (249536) | more than 6 years ago | (#18068800)

Probably like "The Club" for cars. It'll slow someone down and may prevent some casual theft. But if someone really wants it they'll still be able to steal and use it.

Re:Limited Deterrent (1)

Kadin2048 (468275) | more than 6 years ago | (#18069082)

I think it's more like the car stereos that are "theft resistant" because, once removed from the car, they require some sort of master password to re-activate. I don't know much about stereo theft, but I can only assume that most thieves have ways around this (probably just swiping the car's manual out of the glovebox when they take the radio).

But that's basically the idea; it hopefully makes the item just unattractive enough for a thief, so they move on to easier pastures.

Re:Limited Deterrent (2, Interesting)

Loconut1389 (455297) | more than 6 years ago | (#18069262)

Maybe off-topic, but my in-car DVD player has a removeable face that supposedly is coded and all of that and only replaceable by Phillips, yatta yatta yatta, but if you push in the lever on the front, the thing fires up and works like a charm. I did have a Kenwood MD/CD player that was definitely coded, but I didn't have access to another front panel to test that for sure, but it most definitely didn't work by pressing the contact switch, it just beeped a warning beep.

This is not to say that OLPC's thing is bunk- it probably isn't, but as far as some of the car things go, it's only apparent security, not actual.

Thieves steal low value stuff (2, Interesting)

Anonymous Coward | more than 6 years ago | (#18069290)

OK, I teach in a public school. My computers often are shut down for 21 days or more ... like over vacations. And with intermittent internet connectivity is often down for two months. That's here in a California public school!

And school thieves steal things with zero street value, including keyboards, cables, and AC power cords. Heck, someone stole three VGA monitors over winter break, saving us $30 in dump fees.

Re:Thieves steal low value stuff (1)

cp.tar (871488) | more than 6 years ago | (#18070016)

someone stole three VGA monitors over winter break, saving us $30 in dump fees.

Ever thought of posting notes like "this equipment will not be greatly missed if stolen... hint, hint..."?

It might save you a bit more and help some of those kids get their drugs, thus preventing them to rob someone for the money... </troll>

Re:Limited Deterrent (0)

Anonymous Coward | more than 6 years ago | (#18070000)

From what I understand, the difference is that these computers are not worth much except as part of the OLPC program, when connected to the appropriate services.

I'm pretty critical of the project, but those machines aren't exactly standard PCs.

Potential Abuse Issues (2, Insightful)

broller (74249) | more than 6 years ago | (#18068722)

The potential for abuse here is pretty high. If the controlling government (Read: whoever controls the Internet connection and licensing servers, so maybe a corporation) wants to keep the people in line, they can just threaten to turn everyone's laptop off. If an invading nation wants an information blackout, shut everyone's laptop out.

Re:Potential Abuse Issues (5, Insightful)

chanrobi (944359) | more than 6 years ago | (#18069030)

If the government already controls all the internet this entire "abuse potential" scenario is moot.

If an invading nation wants an information blackout, shut everyone's laptop out.

Yeah since information only flows through laptops... right? How the hell is this modded insightful.

Re:Potential Abuse Issues (1)

badfish99 (826052) | more than 6 years ago | (#18070038)

Traditionally, the first thing you do when you invade is to bomb the television station.
This is becoming less effective now that people have access to alternative sources of information: shutting down everyone's computers will be a valuable tool for invading armies, along with anti-satellite weapons for taking out satellite TV.

Re:Potential Abuse Issues (1)

dk.r*nger (460754) | more than 6 years ago | (#18070258)

(Read: whoever controls the Internet connection and licensing servers, so maybe a corporation)

Uh-uh. Corporations - evil themselves. And when it comes to unprivilegeded, poor africa children, these entities of evil will be in line to throw the kill switch on the laptops. Beware of the corporations!

Newsflash: In the part of the world where things are actually bad, the problem is not with CEOs. They are with who ever happend to throw a revolution that week, and tell the army to start killing people from whatever tribe they don't like. In other words: governments.

Meanwhile you sit in your house that evil coporations mortgaged so you could buy it, sip caffe latte made from beans that evil coporations imported for you, while you visit blogs on an internet connection that evil coporations made available for you and discuss how everything coporate sucks and the government should do as the UN says, because they did so fucking well in Rwanda, Balkans and Darfur.

Re:Potential Abuse Issues (1)

legirons (809082) | more than 6 years ago | (#18070368)

The potential for abuse here is pretty high. If the controlling government (Read: whoever controls the Internet connection and licensing servers, so maybe a corporation) wants to keep the people in line, they can just threaten to turn everyone's laptop off

They can also selectively shut-off laptops - just enter the serial numbers of laptops in a village that didn't vote for you, into the license server...

It will get cracked very quickly..... (2, Insightful)

8127972 (73495) | more than 6 years ago | (#18068734)

..... Just look at what's happening to the guys who do DRM for the MAFIAA. Face it, ANYTHING can be cracked if you try hard enough.

Re:It will get cracked very quickly..... (1)

Chandon Seldon (43083) | more than 6 years ago | (#18069078)

Face it, ANYTHING can be cracked if you try hard enough.

That's a nice hope, but it's not true. Any file based DRM that is functional on general purpose computers can be cracked. This is a security solution rather than DRM, and it's implemented on custom hardware.

Re:It will get cracked very quickly..... (1)

Hijacked Public (999535) | more than 6 years ago | (#18070800)

Do you work for Diebold?

Re:It will get cracked very quickly..... (1)

Chandon Seldon (43083) | more than 6 years ago | (#18071222)

That's actually pretty funny.

In this case the security system is intended to protect *physical hardware* not data or tampering. They don't have to make it theoretically impossible to break, they just have to make it significantly more expensive to crack than the resale value of the device - that's damn easy.

Re:It will get cracked very quickly..... (1)

Zadaz (950521) | more than 6 years ago | (#18071586)

they just have to make it significantly more expensive to crack than the resale value of the device

You're assuming people will do it for the money. There are plenty of other reasons to crack open a system.

Re:It will get cracked very quickly..... (3, Interesting)

SirTalon42 (751509) | more than 6 years ago | (#18069716)

"Face it, ANYTHING can be cracked if you try hard enough."

From the Bitfrost specification (which this killswitch is part of):

"But pushing the envelope on both security and usability is a tall order, and as we state in the concluding chapter of this document, we have neither tried to create, nor do we believe we have created, a "perfectly secure" system. Notions of perfect security are foolish, and we distance ourselves up front from any such claims."

http://dev.laptop.org/git.do?p=security;a=blob;hb= HEAD;f=bitfrost.txt [laptop.org]

Re:It will get cracked very quickly..... (1)

c00rdb (945666) | more than 6 years ago | (#18071266)

I'm still waiting for the P4 DirectTV cards to get cracked. Doesn't look like it's gonna happen, and it's been a couple years at least...

Haha! (1)

Kaioshin (893295) | more than 6 years ago | (#18068752)

Software protection?
Hmm, I believe the correct response would be ROFLMAO*. Seriously, what the frak? That's like saying they will put Windows on it so that no-one can pirate CDs thanks to it's protection.

*Yes, yes, I know it's not physically possible without severe injuries.

IMO: Not possible (3, Insightful)

Anonymous Coward | more than 6 years ago | (#18068764)

If the user has root access, then it is his box. Any component can be removed, including the dhcpcd client which attempts to enforce this rule.

It is only "possible" if you agree to run their software as installed.

Their reliance on GPL components should make it clear which components need to be replaced to avoid asking permission to continue using the software.

Re:IMO: Not possible (3, Interesting)

sumdumass (711423) | more than 6 years ago | (#18069186)

Not if the lock is in firmware on a chip somewhere simular to Tivo's DRM. But then It cannot run GPLv3 code after this. Such a pitty.

Unless they alread thought about this and are using the same provisions that lets GPLv3 code work with a GPLv2 kernel and call it an agregate. Then the point of the GPLv3 restrictions are usless if the lock only stops the GPLv2 code from working.

And to all those thay want to say But the GPLv3 says this, The GPLv2 says "no further restrictions can be applied". And restrictions in a GPLv3 license whatever the final release is, has to honor this unless it is actualy incompatible and can no longer be used with GPLv2 code. You can have the cake, eat the cake but you need to assemble the ingredients to make the cake before any of that happens.

Re:IMO: Not possible (2, Informative)

SirTalon42 (751509) | more than 6 years ago | (#18069896)

The mechanism the laptop will use IS like the Tivo DRM (in fact there was a discussion on lwn whether Bitfrost is drm or not, and whether it would violate the GPLv3 or not). I believe Bitfrost WILL be GPLv3 compliant because the owner of the machine can request a developer key which will allow them to modify anything on the system (even remove the daemon). To prevent the thief from just requesting the developer key theres a 7 day waiting period (to confirm that the laptop hasn't been stolen) and then the key is issued. If the child already has the developer key, and then the key and the laptop are stolen, then the thief can disable the daemon themselves and get around the security. Also the developer keys are machine specific so stealing 1 key won't let you bypass the security on all machines.

This SHOULD make it very hard to defeat the anti-theft daemon (it doesn't reside in dhcpd btw, also removing internet access for 21 days will brick the machine anyways).

Bitfrost is much more than just the kill switch and is actually quite interesting, and at least in theory sounds like it would be quite effective.

Re:IMO: Not possible (2, Funny)

sumdumass (711423) | more than 6 years ago | (#18070244)

The mechanism the laptop will use IS like the Tivo DRM (in fact there was a discussion on lwn whether Bitfrost is drm or not, and whether it would violate the GPLv3 or not). I believe Bitfrost WILL be GPLv3 compliant because the owner of the machine can request a developer key which will allow them to modify anything on the system (even remove the daemon). To prevent the thief from just requesting the developer key theres a 7 day waiting period (to confirm that the laptop hasn't been stolen) and then the key is issued. If the child already has the developer key, and then the key and the laptop are stolen, then the thief can disable the daemon themselves and get around the security. Also the developer keys are machine specific so stealing 1 key won't let you bypass the security on all machines.
Interesting. But even without getting the key, I don't think they would have anything to worry about. The use of GPLv3 items either does place futher restriction on a GPLv2 or it doesn't. So far, It is being claimed that it doesn't to be compatible with a GPLv2 kernel in that it can still be distributed with it so the same rules could apply to TIVO or OLPC.

Bitfrost is much more than just the kill switch and is actually quite interesting, and at least in theory sounds like it would be quite effective.
I going to look more into it. It does sound like something that could be used in other areas. Like in chip manufacturing were a company (lets say soundblaster) could make one chip very well and limit the abilities on it to sell cheaper versions to the public. This could simplify the entire production process and eventualy make the product cheaper in the long run. Verry interesting indeed.

Re:IMO: Not possible (0)

Anonymous Coward | more than 6 years ago | (#18070888)

More details about this are available in the Bitfrost Security Specification [laptop.org] posted to slashdot a couple weeks ago. In short - yes the firmware will only boot a signed BIOS/OS, and the OS will only load signed kernel modules. However, the students may request a developer key from the OLPC project, which they can use to sign bios / kernel code (for their their laptop only, I believe). The only reason that a request will be denied is if the laptop is reported stolen within the small (2 week?) delay time between requesting a key and it being issued.

I don't know if this would be incompatible with GPLv3. Do the keys have to be provided with the binary distribution, or is it okay for them to be requested seperately like you can with the source? Does the fact that the key only works on their personal machine matter? Is the fact they won't give keys to someone accused of being a theif an issue? It is an interesting question.

Re:IMO: Not possible (1)

SCHecklerX (229973) | more than 6 years ago | (#18069660)

well..

A good system could encrypt the filesystem with either strong passphrases or a key pair with one piece being on a USB drive or something.

That would be pretty difficult to defeat.

Re:IMO: Not possible (0)

Anonymous Coward | more than 6 years ago | (#18070154)

Last I read it was a custom OS.

So while your argument is valid for Unix variants, it holds no water when those who created the laptop control both the hardware and the software, and its 100% custom.

Re:IMO: Not possible (1)

kelnos (564113) | more than 6 years ago | (#18070398)

If you read the spec (yeah I know, this is /., no one actually reads), the daemon is marked 'special' by the kernel (due to a custom kernel mod), and can't be killed, even by root. The kernel and bootloader are both signed and checked by the hardware on boot, so if a potential thief tries to run their own kernel, the laptop will fail to boot.

For kids who get a little more advanced and want to mess with the kernel or bootloader of their laptop, they can apply for a special 'developer key' that will allow them to bypass the bootloader/kernel security checks.

Is it perfect? No, of course not -- in fact, the developers explicitly state that perfect security is a pipe dream. Will it be an effective theft deterrent? We'll see. Will it pose more problems than it's worth and cause hassles for the kids? Again, we'll see.

Massive Backend Infrastructure and Processes (5, Insightful)

blantonl (784786) | more than 6 years ago | (#18068774)

So, does this mean that the OLPC project is going to need a back-end infrastructure to support this Daemon? With the amounts of laptops considered in this project, that means that a pretty large back-end infrastructure is going to be needed to support this process.

In addition, there's going to need to be a tremendous amount of "process defintion" for something of this scale. What constitutes a "stolen" laptop in this case? How is it reported? To Whom? Who is ultimately responsible?

Sounds like a massive undertaking and far from clearly defined, other than a "Daemon is available."

So a hacker could disable OLPCs? (4, Funny)

poopie (35416) | more than 6 years ago | (#18068798)

I can see the writing on the wall.

Greetz griefers! Want to 0wn the n00b in your class? download this script and run it to disable anyone's OLPC.

Here's what you do: ...

Re:So a hacker could disable OLPCs? (2, Insightful)

cduffy (652) | more than 6 years ago | (#18069188)

The command has to be RSA-signed, and the OLPC project folks aren't giving out the private key used to provide the signature.

So no, we aren't going to see forged kill requests.

Re:So a hacker could disable OLPCs? (1)

Kamineko (851857) | more than 6 years ago | (#18069360)

Until, y'know, it's hacked.

Or OLPC HQ is hacked. Or ransacked.

Re:So a hacker could disable OLPCs? (3, Interesting)

cduffy (652) | more than 6 years ago | (#18069748)

Until what is hacked?

RSA? That old dog has still got some life in it yet. Their specific implementation of RSA and how it interfaces with the mechanism for actually throwing the kill switch? Maybe. Depends on whether the crypto validation happens in software or in hardware; in the latter case, they could actually do the crypto in hardware (low-performance RSA hardware implementations are dirt cheap) and not provide any other mechanism to trigger the kill switch -- thus, in this situation there would exist no possibility for the software to be hacked to bypass that check.

This isn't like software-based DRM, where the decrypted bits need to be fed back into a fully programmable mechanism somewhere. This is a security device built into a dedicated hardware system; if done right, it need not have any of the vulnerabilities 'yall around here are accustomed to.

Hacking the HQ is easy to avoid -- just like with any important key, you don't keep the system online; when you need to do work on it, you move your data on and off via static media (my employer uses a USB key for moving CSRs onto and certificates off of our fully disconnected CA). The HQ being ransacked is a slightly different matter, but given that it's located in a 1st-world country with an effective police force, that kind of thing doesn't happen so often.

Or a social engineer (2, Interesting)

Razed By TV (730353) | more than 6 years ago | (#18069618)

"Hi, my name is Valerie Victim. Somebody stole my laptop. It's serial number is 123-456-789. Can you disable it?"
"Certainly."
"Thanks!"
Monique Malicious chuckles, then walks away, her handiwork complete, her rival's laptop disabled.

I certainly hope they've prepared to prevent such scenarios. Granted, you need to know the serial number, but if it's printed on the back of the thing...

Censorship? Extortion? (3, Insightful)

Radon360 (951529) | more than 6 years ago | (#18068834)

Sounds to me like a convenient way to gag someone that a government doesn't want to be heard. "Are they making derrogatory comments about the leadership? Well then, just turn their computer off."

I suppose, it probably will only be a matter of time before some individual will figure out (in their mind) that this is a good way to extort money from someone else. "Send me $nn or I will disable your computer(s)." Then again, if they're using a $100 laptop given to them, what money would there be to extort?

Re:Censorship? Extortion? (1)

hjf (703092) | more than 6 years ago | (#18069380)

Sounds to me like a convenient way to gag someone that a government doesn't want to be heard. "Are they making derrogatory comments about the leadership? Well then, just turn their computer off."
What the hell? This computer is intended for KIDS. If your government is so worried about "free speech" that they need to censor kids an teenagers, then you have a very serious problem. Or a president with a very small dick.

Orwell lives - why steal cheap plentiful laptops? (0, Troll)

scottsk (781208) | more than 6 years ago | (#18068918)

Why would anyone steal laptops that are supposed to be so cheap they're going to be everywhere? Won't they be so plentiful and such a commodity that they'll be cheap as dirt and every family will have several? Why would anyone want to steal them? George Orwell's thought police invent a secret, non-root daemon to control theft on every single one of these? What else can it do? It can't be to deter theft, because the history of these things shows they're usually cracked before the thing is officially released. I will be following this story to see what the real reason for including this "feature" is. Keylogger? Censorship? Backdoor for totalitarian governments? The stated reason for theft seems spurious.

That's not anything like WGA. (2, Informative)

Hymer (856453) | more than 6 years ago | (#18069020)

That's the same functionality as in GSM and UMTS phones: You call, tells that device is stolen and wich IMEI-no. it has and it is then globally disabled.

Renting out stuff ... (5, Insightful)

Gopal.V (532678) | more than 6 years ago | (#18069144)

As an Indian from a relatively unconnected neck of woods, I love the OLPC project and what it might do to the future students of this world - and I've even played around with an OLPC for thirty minutes [flickr.com]. But this particular feature annoys me a bit. I quote from the article.

the system allows countries to optionally establish a "license" period for the laptops, such as 21 days.
When laptops are connected to the Internet, they will synchronize with an NTP server to obtain the correct
time and date, and then obtain a license which must be renewed in the time specified. Laptops which are not
renewed within the timeframe will lock.

As I mentioned before, the whole concept of an unconnected laptop or one with minimal internet access (i.e wireless mesh) goes for a toss with this feature. The worst of the activation features which windows has, negating the real advantage of having a laptop you could take literally anywhere. Locking out someone just because they couldn't hook their PC into the network for twenty days is no way to make OLPC work. The real way to keep them off the black market is to reward those who keep their machines intact - just like the way to get kids to come to school has been a free lunch programme (and I sit in an Indian state with 99% literacy rates).

Or if you're really interested in reducing the utility of the machines, send an access code to the school master every month - for the laptops to get on the internet. You need to go pick up the coupon to get back on the internet and just kick the ones which are reported missing in audits - rather than go in for an active licensing scheme as mentioned in the document.

But in general, technical solutions for social (as well as economic) problems hardly work out, by themselves.

Re:Renting out stuff ... (2, Informative)

Coryoth (254751) | more than 6 years ago | (#18070230)

I think the important point is that the OLPC project "allows countries to optionally establish a license period". I agree that it is hardly ideal, but it is being offered as an option because some countries demanded a feature of this kind. Other countries aren't quite so silly and won't enable the option. I think realistically one of the greatest theft deterrents for the XO machines is that they are seriously targetted towards young children. Sure there are geeks on Slashdot who would love to get their hands on one anyway - it is a linux machine after all, and anyone with sufficient nouse could make it do some fun and interesting stuff. That makes for a fairly small market however. It's not like you can grab one of these things and install Windows on it to have a laptop. If you steal one of these things you'll either have a machine with an unfamiliar interface designed for children and very little software that is particularly useful outside of an educational setting. You'll have to know what you're doing to get anything more out of it than that... and if you know what you're doing then you're more than likely in a position to cheaply and much more easily get and set up a laptop for your needs.

I think you'll find that the XO machines prove to not be terribly attractive targets for theives because they are so target specific - I don't think many people other than kids (and shameless geeks such as hang out here) are going to be able to do much useful with them, and if it isn't going to be very useful, why steal it?

Re:Renting out stuff ... (1)

tepples (727027) | more than 6 years ago | (#18070612)

As I mentioned before, the whole concept of an unconnected laptop or one with minimal internet access (i.e wireless mesh) goes for a toss with this feature.
It doesn't have to connect to the Internet. It can connect to the license server in the village or perhaps to any other license server operated by the same client state.

Re:Renting out stuff ... (0)

Anonymous Coward | more than 6 years ago | (#18070788)

As the other poster has pointed out, this security feature is optional (i.e. the purchasing government controls it). But additionally the licences can be updated with a specific USB key, which covers internet access not being available. I don't know if that was mentioned in TFA, but it has been mentioned somewhere when I read about this security feature previously.

Re:Renting out stuff ... (1)

zlogic (892404) | more than 6 years ago | (#18071332)

KMS volume activation in Vista requires you to renew your license every 180 days, plus a 30-day grace period after that. What's more, you can activate using any server, including the one in your organization.
Linux more locked down than DRMed Vista.
Oh the irony...

This won't be used for theft prevention, (3, Insightful)

rben (542324) | more than 6 years ago | (#18069176)

It will be used to shut off the machines of disadents. Governments don't seem to care that much about machines being stolen, but they do care about giving power to political opponents. If I buy a machine, I should have complete control of it. No one should be able to remotely turn off the machine without my explicit authorization. I can't think of any way to make a feature like this safe from abuse.

Re:This won't be used for theft prevention, (1)

iabervon (1971) | more than 6 years ago | (#18069696)

The kill switch, and whether there is one, is controlled by whoever bought the laptops. The OLPC project is based on governments buying laptops and distributing them to children. The governments care a whole lot about whether the laptops they are giving to children in public schools are going to tempt bands of dissidents to pillage schools for the black-market resale value of the spoils. They also care about whether the shipments of laptops are going to make it to the schools at all without being hijacked by dissidents.

The OLPC is designed for use by kids. The keyboard isn't even big enough for adults to use comfortably. It makes sense to try to make control of the system not depend on physical security, because the intended users are easy to rob. It's like if you were giving kids in the Bronx $100 bills to carry around for school all the time.

Re:This won't be used for theft prevention, (0)

Anonymous Coward | more than 6 years ago | (#18071608)

Though given half the kids in the bronx tend to pack enough firepower to make the marines think twice......

Re:This won't be used for theft prevention, (1)

xoundmind (932373) | more than 6 years ago | (#18071070)

I don't doubt that some "repressive" governments might want to utilize this feature for unsavory reasons. But these are explicitly designed for children. How many 11 year old dissidents do you know of?

Re:This won't be used for theft prevention, (1)

Tracy Reed (3563) | more than 6 years ago | (#18071192)

And since the governments are buying these machines (not you or the kids) they will indeed have complete control over them.

OLPC becoming Big Brother? (5, Insightful)

PetiePooo (606423) | more than 6 years ago | (#18069178)

I have to say, I don't like the decidedly big-brother tilt the OLPC project has been taking lately. With all the news [slashdot.org] that has come out lately on OLPC, the whole "users will be able to read/understand/modify its source code" stance seems to have gone away.

If I can read and compile the O/S, who's to say I can't just remove the kill daemon from my build and then install it? In order to be robust, they'll have to lock down the installed software and make it impossible for the user to change. No community development; no share-and-share-alike; no software libre, counter to the whole "open source" philosophy they tout as the project's base.

This isn't a hacker's dream toy; its a business proposition to sell expensive supporting infrastructure and services along with a loss-leading locked-down client device disguised as charity in the name of educating the poor.

Re:OLPC becoming Big Brother? (2, Insightful)

ChrisUK (92178) | more than 6 years ago | (#18069330)

> If I can read and compile the O/S, who's to say I can't just remove the kill daemon from my build and then install it?

Nothing at all. The article is misleading -- if you want to remove the anti-theft daemon you can, by clicking a button to request a developer key that gives you full access to the machine and its BIOS. Then you can run whatever you like.

If your machine has been reported stolen, though, the developer key won't be issued. So, it's a sensible tradeoff between restricting people from experimenting on their machine (which they should be able to) and stopping laptop theft from being such a worry.

Re:OLPC becoming Big Brother? (0)

Anonymous Coward | more than 6 years ago | (#18070732)

Yes, they have to "request the right" to modify by requesting a key. Why the fuck didn't you just go the whole way and stick a TPM in there... that, at least, would have signaled your intent clearly: this is OUR machine and WE will decide what you do with it, not you.

What you've actually done is made a machine with most of the bad parts of a trusted computing system, and none of the useful ones.

Re:OLPC becoming Big Brother? (2, Insightful)

sumdumass (711423) | more than 6 years ago | (#18069436)

Not really, This is at the request of the people who will be buying it and distributing it to the people. It won't even be enabled if your one of the people who buy it outright or live in a country without te requirment.

And I personaly don't see anything wrong for someone who is buying the device to expect it to be used in a certain way when it is given to the intended recipients. If someone doesn't agree, buy it yourself without the restrictions. It is that simple. And the choice is there.

This isn't news... (5, Informative)

SocialWorm (316263) | more than 6 years ago | (#18069334)

Several people, myself included, specifically pointed this out during the last story on OLPC's BitFrost system. [slashdot.org].

And can we please remember that it's One Laptop Per Child, and not One Laptop Per Slashdot-reading Guerilla Geek? Any abuse regarding deactivation of the laptops is more likely to be carried out by confiscation of the laptop by school personal.

Also, the feature can be disabled with a Developer Key from OLPC:

1018 The anti-theft system cannot be bypassed as long as P_SF_CORE is enabled (and
1019 disabling it requires a developer key). This, in effect, means that a child is
1020 free to do any modification to her machine's userspace (by disabling P_SF_RUN
1021 without a developer key), but cannot change the running kernel without
1022 requesting the key. The key-issuing process incorporates a 14-day delay to
1023 allow for a slow theft report to percolate up through the system, and is only
1024 issued if the machine is not reported stolen at the end of that period of time.
- http://dev.laptop.org/git.do?p=security;a=blob;hb= HEAD;f=bitfrost.txt [laptop.org]

Shouldn't this post at least be tagged YRO? (0)

Anonymous Coward | more than 6 years ago | (#18069336)

chapta: repress

that is freaky

RTF Spec (4, Informative)

fang2415 (987165) | more than 6 years ago | (#18069510)

When this (old [slashdot.org]) news [wired.com] first came out, I posted this gloom and doom [slashdot.org] comment, but after reading the spec, I realized that the picture was more complicated than my comment, or the summary above, indicates.

FTF Spec [laptop.org]:

The anti-theft system cannot be bypassed as long as P_SF_CORE is enabled (and disabling it requires a developer key). This, in effect, means that a child is free to do any modification to her machine's userspace (by disabling P_SF_RUN without a developer key), but cannot change the running kernel without requesting the key. The key-issuing process incorporates a 14-day delay to allow for a slow theft report to percolate up through the system, and is only issued if the machine is not reported stolen at the end of that period of time.

My earlier concerns were that this funcitonality was the same type of call-home spying and TPM kill-switch control that MSFT in its most evil moments would love to have over all of its users and that OLPC had totally screwed the pooch.

The spec makes it seem a bit more like a maximally secure default setting, whose override is difficult but still accessible. They are simply storing the lock (the laptop) and the key (the developer key) in different places. The keys won't be given out if the lock has been reported stolen, but if not, they are available to the machine's owner.

Something about this still worries me, though. The developer key makes this system radically different from something like the WGA's phone-home spyware "feature" in that it can be disabled by the machine's owner, but given that the default setting is so hard to override, is the effect really all that different? Is this going to screw over less techical users who make a mistake and somehow manage not to "renew their lease" frequently enough? Worst of all, if something goes wrong with the centrally-managed key distribution system, millions of kids will be left with fully locked down, unhackable, TPM machines that will brick in an instant if they wait too long to phone home to the server of a government that may be more interested in censoring them than empowering them.

I'd be curious to hear what Stallman has to say about this project, especially this aspect of the security system. I think everything else about this project would suit even his lofty standards to a tee, but I think OLPC is walking a fine line with this anti-theft system.

True Hardware DRM on the horizon? (0)

Anonymous Coward | more than 6 years ago | (#18069654)

If corps don't like what you are doing with their hardware, BZZT!

Slave to the mothership (2, Insightful)

Animats (122034) | more than 6 years ago | (#18069732)

What"s with this "slave the user's machine to the mothership" mentality? "The system allows countries to optionally establish a "license" period for the laptops, such as 21 days. Laptops which are not renewed within the timeframe will lock." Get too far from the local wireless node and your machine dies? And they want to deploy this in third world countries?

That makes life easier for terrorists. The Taliban, which is coming back in Afghanistan, is going to exploit this. Destroy the local school (standard Taliban operating procedure) and its wireless node, and all the kids' computers die. Today at least the parents and kids can hide some books. With OLPC, it's easier for Islamic fundamentalists to destroy knowledge.

Re:Slave to the mothership (1)

LanMan04 (790429) | more than 6 years ago | (#18071488)

With OLPC, it's easier for Islamic fundamentalists to destroy knowledge.
Quick, someone call the RNC, I just know they'll want to use this one!

A Young Lady's Illustrated Primer (1)

iamacat (583406) | more than 6 years ago | (#18069808)

Maybe they shouldn't be so quick to disable or even interrupt service to stolen laptops. Even in the wrong hands, these laptops are not that useful for anything besides learning. Who knows how children of the rebels would be transformed by learning to program Linux.

Re:A Young Lady's Illustrated Primer (1)

imsabbel (611519) | more than 6 years ago | (#18070056)

Or your wont.

Just like you will see people buring american flags wearing nikes and baseball caps, your will get khmer rouge organizing their deportations with KonzentaratonCamp v0.21b.

Technology or knowledge doesnt make people better.

A kill switch that cannot be disabled? (1)

93 Escort Wagon (326346) | more than 6 years ago | (#18070062)

Say what you will - it's great to hear that Macrovision and Microsoft have decided to participate in this worthy project!

This reminds me of DRM... (1)

shish (588640) | more than 6 years ago | (#18070194)

$5 says criminals find a way around this in the first week or so, and the only people who continue to be bothered by it are the legitimate users...

Laptop lockdown, real motives (1, Interesting)

evolutionary (933064) | more than 6 years ago | (#18070266)

Call me a sceptic but I don't think that theft has anything to do with the motivations for this "value add" here. Afer all, you could always take out the hard drive if the data is what you wanted (assuming unencrypted). You can reformat the hard drive and reinstall puppy linux if you just wanted the hardware. Data could be encrypted to keep people from stealing data. So what does "disabling" the laptop OS do to deter "theft"? With a techie, (or even a smart high school student) absolutely NOTHING. It won't stop anyone from stealing a laptop which in some countries are worth a lot even for the parts alone. This is really about "big brother". Pure and simple. Governments want to keep tabs on what people do on the Internet and possibly track where people are, just like in China and a few other countries. If the governent doesn't like what someone is doing, they disable the laptop to stop any "anti-government" e-mail, blogs, chat..word documents, whatever. By "stamping" the laptops in this way, its easier to get a positive ID on the last person the government "allowed" to have it. This is nothing to do with theft deterence. This is about controlling the activities of the population. Wait till China starts this in Red Flag, the Chinese made Linux distro. (Come to think of it, its likely they've built that in already and kept it "hush hush").

Re:Laptop lockdown, real motives (1)

benicillin (990784) | more than 6 years ago | (#18071374)

what country are you from? I was planning on criticizing you for spelling skeptic as sceptic, however I did a little research and see that the US spelling is skeptic - which would imply that the spelling somewhere outside the US is, in fact, sceptic.

better than having your kid get robbed (1, Insightful)

Anonymous Coward | more than 6 years ago | (#18071226)

I'm frankly quite amazed that there doesn't seem to be a single comment acknowledging that this is in fact a very important, even essential, feature.

Those laptops are meant for people who could otherwise never possibly afford to buy a computer. This means that they have a very high value in those places, often places where there is a high crime rate and a tendency toward extreme violence even for simple thefts.

I would not want my kid to walk home from school carrying something that might be worth several months salary (and everybody knowing about it). The only way to protect the children from getting robbed and possibly killed for their laptops is for those laptops to have zero resell value for thieves.

Re:better than having your kid get robbed (1)

evolutionary (933064) | more than 6 years ago | (#18071760)

Problem is in many countries where these laptops are going the parts ALONE are worth a great deal. So as I said in my posting, nothing will stop someone from stealing the laptop for parts as the drives can be wipped and reinitialized, even by people who aren't experts making the machine perfectly usable as a "new" machine (after you've looked for any valuable data on the hard drive unless its encrypted). Unless you can kill the parts, individually as well as collectively (which the software kill switch doesn't do in any event) you can't remove the value. All you can do is force someone to reinitialize the OS or put on a new OS.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...