LoJack anti-theft device: would you really install that thing on your laptop? (laptops, bios)

[hotornot]

Designing a security strategy for laptops on the go:

The customized laptop I'm about to buy from HP is kinda expensive. I'm going to use it for work and school. Since it's very much a part of my everyday life and since I'll be using it outdoors a lot I'm going to want to do everything I can and look at every option available that'll help keep it as secure as possible.

Knowing about the potential security hole in LoJack, would you, today, go ahead and customize your new laptop with LoJack embedded in your BIOS firmware or would you say fuhgeddaboudit!!??

http://www.vancouversun.com/business...869/story.html
http://www.google.com/hostednews/ap/...cf6XwD99P33N82
Researchers find insecure BIOS 'rootkit' pre-loaded in laptops | Zero Day | ZDNet.com

[macroy]

These things work on two fronts - physical asset recovery, and data security (by means of remote wipe if necessary). The second goal can also be achieved via other methods like full disk encryption (there are vulnerabilities there too... but nothing is 100% secure), which is cheaper or in some cases, included with your OS.

As for asset recovery, it simply comes down to whether or not you want that "insurance". Personally - I feel laptop theft is more the result of carelessness... and a change of habit can reduce that risk for less money. As for the rootkit issue - you do need to be aware of it. Because whether or not you use the service, that instruction set is preloaded in the BIOS.

I personally would pass on it. The cost does not justify the risk (especially if you place other controls on it) - but that's just me.

[Asheville Native]

Originally Posted by macroy

These things work on two fronts - physical asset recovery, and data security (by means of remote wipe if necessary). The second goal can also be achieved via other methods like full disk encryption (there are vulnerabilities there too... but nothing is 100% secure), which is cheaper or in some cases, included with your OS.

Data security through full disk encryption and for free through TrueCrypt While nothing is 100%, there are some that get pretty darn close. This can also be set up where you can setup a sacrifice encrypted area in case they are holding a gun to your head, wanting your passphrase.

[hotornot]

Gotta wonder about the embed thing with HP and maybe Dell, too:

I know HP offers LoJack on their laptop customization page, that much is certain. if the new HP laptop buyer DOES NOT opt for LoJack when customizing a new laptop - does the laptop come embedded with something (or anything) in the BIOS firmware that pertains to LoJack?

I mean, what if you want to install LoJack later on down the road say like in 6 months or so - does HP embed something in the BIOS firmware just in case someone reconsiders?

I reckon maybe LoJack has a contract with both Dell and HP, a contract that allows them to embed something in BIOS - ya think? If the answer to these questions are 'yes', does something installed in BIOS present a potential problem anyway even though the new laptop buyer did not opt to pay the $119.99 fee that LoJack charges to start up their service?
(the dummy who wrote this post thinks not)

$119.99 lojack-plus fee: Costco - HP 2-Year Accidental Damage Protection and Computrace LoJack for Laptops
decent overview: HP Set to Launch Laptop Lo-jack ~ Revelations From An Unwashed Brain