TEM Task to help recover a stolen Windows Computer - Prey Project

Content Authoring
1

(imported topic written by SystemAdmin)

If anyone can help port this to OS X and Linux, it would be much appreciated. Also, it would be nice to be able to deliver Prey location reporting directly into a BigFix/TEM analysis, and this should be possible since it is open source.

WARNING: you may violate local laws depending on your use of the software without knowledge of the owner & user of the computer

More info here: http://preyproject.com/.

Install Prey Fixlet

Target OS:

Windows (works on Linux & Mac OS as well)

Purpose:

load a tool silently to help recover stolen laptops or WiFi capable desktops

Command Line:

prey-win-batch-install.bat

your_api_key

Relevance 1:

// Windows OS

(name of it = “Win2000” OR name of it = “WinXP” OR name of it = “WinXP-2003” OR (name of it = “WinVista” AND product type of it = nt workstation product type AND NOT x64 of it) OR (name of it = “WinVista” AND product type of it = nt workstation product type AND x64 of it) OR (name of it = “Win7” AND NOT x64 of it) OR (name of it = “Win7” AND x64 of it) OR name of it = “WinXPe”) of operating system​

Relevance 2:

// .Net 2.0 or higher

“2.0” as version <= maximum of ((following texts of firsts “v” of names of keys whose(name of it as string as lowercase contains “v”) of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP” of native registry) as version)​

Relevance 3:

// Prey not already installed

not exists key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CronService” whose (value “DisplayName” of it as string as lowercase contains “Cron Service for Prey” as lowercase) of native registry

Relevance 4:

Remove this relevance to install on Non-WiFi device

// WiFi on machine (prey also works with GPS, but I’m not sure how to detect the presence of GPS)

// Prey will work on a computer that does not have WiFi, but with reduced location finding ability

exists connections whose (name of it as string as lowercase contains “Wireless” as lowercase) of network

Action:

action parameter query “PreyAPI” with description “Please enter your Prey API key found here: http://panel.preyproject.com/profile”

// Download Prey

download Prey: Laptop Tracking & Data security. Find & Protect lost devices.

continue if {(size of it = 5650143 AND sha1 of it = “1fb703d3962db76a8b059529b011f3398a79f889”) of file “prey-0.5.3-win.exe” of folder “__Download”}

// Download Prey silent install Windows BAT script

download Prey: Laptop Tracking & Data security. Find & Protect lost devices.

continue if {(size of it = 2479 AND sha1 of it = “12a00bbbd5b239af185fb9f105728851590e53ee”) of file “prey-win-batch-install.bat” of folder “__Download”}

delete prey-win-batch-install.bat

delete prey-0.5.3-win.exe

copy __Download\prey-win-batch-install.bat prey-win-batch-install.bat

copy __Download\prey-0.5.3-win.exe prey-0.5.3-win.exe

delete __Download\prey-win-batch-install.bat

delete __Download\prey-0.5.3-win.exe

//Need to remove the “PAUSE” from the next to last line of prey-win-batch-install.bat​, otherwise the execution will never end.

delete __appendfile

appendfile {concatenation “%0a%0d” of lines whose (it as lowercase does not start with “PAUSE” as lowercase) of file “prey-win-batch-install.bat”}

delete prey-win-batch-install.bat

copy __appendfile prey-win-batch-install.bat

waithidden {pathname of system folder & “\cmd.exe”} /Q /C “{(pathname of client folder of current site) & “\prey-win-batch-install.bat”}” {parameter “PreyAPI” of action}

delete prey-win-batch-install.bat

delete prey-0.5.3-win.exe​

​

References:

http://support.preyproject.com/kb/installation/how-to-deploy-prey-in-batch-mode-windows​

http://support.preyproject.com/kb/modules-issues/geo-module-doesnt-work

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=2098​
2

(imported comment written by SystemAdmin)

I am aware of the potential abuse and am not installing the software proactively on systems that have not been reported stolen, which is an advantage of BigFix/TEM, it can be done after the fact. As IT Admins, especially in the case of BigFix / TEM and similar systems, we have a greater responsibility to respect the privacy of our users we Administrate. Software such as Prey exists and can be exploited regardless of my making it easier. Prey does not include keylogging functionality, but there is no reason that a malicious administrator could not install such software on users computers, with or without the use of BigFix / TEM. Another advantage of BigFix is that it can be independently verified who installed what software on which computers, and potential abuses could be tracked down, which would be much harder to do if I went around and installed Prey or similar software with a USB key. BigFix / TEM can also be used to detect which computers have Prey installed.

Please Admin responsibly.

3

(imported comment written by NoahSalzman)

jgstew,

BigFix (or ANY similarly powerful admin tool) can be used for malicious intent in the wrong hands. Your “Prey” is no different… but much like S.A.T.A.N you must have picked a name that struck a nerve otherwise you wouldn’t have posted that (I assume, in response to emails).

You shouldn’t have to defend your contribution. Thank you for adding to the arsenal of tools for the beleaguered IT admin.

Noah

4

(imported comment written by SystemAdmin)

Thanks Noah,

I have not received any push back from the BigFix / TEM community itself, but I sent an email about this to my University’s IT list, and some concerns were expressed. Concerns over the use of using Prey are valid, but like you say, BigFix / TEM is so powerful in itself. I am assuming that something like Prey will not be used in an organization by a lone wolf Admin, and will be implemented as a part of a recovery process involving legal council, police reports, and full knowledge of many parties on many levels. Evil people will be evil, but people with good intentions have to work even harder to prevent misunderstanding. Use Prey, BigFix, and your knowledge with care.

~James