Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Stolen Macbook Pro Located w/ iCloud (Pictures!)

I don't think stalking that street taking pictures of cars and houses is a healthy way to approach this... And impersonating a police officer is definitely a felony.

Just keep it up with the local police. They're obligated to follow up such a warm lead, and you could try encouraging them by suggesting the presence of other "hot" items in the house.
 
Update!

Alright guys so my computer was online when I woke up this morning so I grabbed my computer with Kismac installed and drove over there immediately. Once I arrived the computer was still online and stayed online for a good hour. I pinpointed my computer's I.P. address successfully! There was only one open network in the area (strong enough that I could get on the internet with my current macbook) and it only had one "Apple" device on the network = My computer! I also took down the model and license plate number of every vehicle in the culbisack which could help pinpoint a vehicle if and when the macbook moves location.

So now that I have my macbook I.P. address, how can I proceed?

I did not walk around outside with the computer searching for a stronger/weaker signal, although I probably should have. I already felt a bit sketched out and didn't want to blow my cover so fast.

So what now?

I guess I inform the police and try to get the FBI, ICE and Justice organizations involved based on the fact that I have the I.P. address and a tool to find which house it is in based on signal strength.
 
Luke 007 said:
So now that I have my macbook I.P. address, how can I proceed?
Click to expand...

How are you sure it is actually yours? Have you confirmed that its MAC addresses correlates to yours?

If it is, you can always try to further narrow down where exactly the wireless network is based and pass that information onto the appropriate authorities. I wouldn't suggest that you attempt to confront the new owner yourself though..

Good luck!
 
Luke 007 said:
... There was only one open network in the area (strong enough that I could get on the internet with my current macbook) and it only had one "Apple" device on the network = My computer!...
Click to expand...


it could also be an iphone, ipod touch and any other mac.

if you could find out your mac adress of your stolen mbp wlan you could scan with kismac for it's mac adress.
 
Maybe wait til it's online, call the police to the area, and then do the whole "hot/cold, go back and forth between houses searching for the strongest signal" thing with them there, so that, a) you don't get killed snooping around some thugs house, and b) they may get scared with a cop in the very near vicinity snooping around.

Although, I don't know how close the police would be willing to go, but depending on the person, you may get them to walk through the yard or something. Who knows, if you keep the pressure on long enough, you may even spark enough concern to get them to relocate. And considering they don't know that the problem you currently face is that there are so many houses close by, they may move to a place that allows you to easily locate them.

My point is they don't necessarily know the issues you're having, so they aren't looking to keep they only advantages they have left...

Edit: Forgot to add... I have had stuff taken in the past, and I'm sure everyone else here who has been in your place is rooting for you to pull this one out. Certainly, would make my day/week/month to know at least one of them has gone down hard!
 
Luke 007 said:
Alright guys so my computer was online when I woke up this morning so I grabbed my computer with Kismac installed and drove over there immediately. Once I arrived the computer was still online and stayed online for a good hour. I pinpointed my computer's I.P. address successfully! There was only one open network in the area (strong enough that I could get on the internet with my current macbook) and it only had one "Apple" device on the network = My computer! I also took down the model and license plate number of every vehicle in the culbisack which could help pinpoint a vehicle if and when the macbook moves location.

So now that I have my macbook I.P. address, how can I proceed?

I did not walk around outside with the computer searching for a stronger/weaker signal, although I probably should have. I already felt a bit sketched out and didn't want to blow my cover so fast.

So what now?

I guess I inform the police and try to get the FBI, ICE and Justice organizations involved based on the fact that I have the I.P. address and a tool to find which house it is in based on signal strength.
Click to expand...

Luke, use the force...

Which IP address did you get from Kismat?
The local ip or the internet ip?
The local ip address will be something like 192.168.xxx.xxx or 10.xxx.xxx.xxx
The local ip address won't help you or the authorities.
You need to lookup the internet ip address of the network you're connecting to.

Connect up to their wifi again and goto: ipchicken.com
I know that sounds like a joke, but I'm not joking.
Take down the IP address, the time you recorded the ip address, the Reverse DNS or "Name Address" this should tell you which ISP their using as well.

Check to see if your local city police have a cybercrime division. If not, the FBI does. Tell them you have located your stollen property of over $2,000, you have the approximate physical address of the stollen computer, and you have the exact IP address from the Internet Service Provider that your computer is connecting from. You'll also need proof of purchase and your serial number to identify that the laptop in question is indeed your's.

I had my first MacBook Pro stollen a few years ago... and I know how it feels. It's $Hi%. Think rationally and keep it just to the facts when delivering your statements. Try to avoid just getting frustrated and mad when the authorities don't seem to help... They're human, they deal with $Hi% all day, get them to want to help.

another route (pun intended) would be to connect to their wifi again lookup the gateway address your computer receives from their router. put that gateway address into you webbrowser and you should get the login for their wifi router... if they're stupid (and they sound like they are) the username and password is typically admin and admin (depends of the brand/model of router) but if you check you can Google the make's default password. Once you're logged in don't change any settings or they'll loose their interent and you'll loose your Mac. But if you snoop around you should find their ISP username as well. Then call the ISP for tech support with their username, etc, etc. name address... possibly...

hope this helps.
 
What IP address do you have? Their local IP address or their modem's IP address? Does it start with 192.168?

When you're connected to their wifi, Google "what is my ip address" and you should be able to find out plenty about their ISP. This would be the IP address that Apple is using to pinpoint the location.

Like the above poster said, if you can log into the router, you can tell pretty easily how close the computer is to the router by it's signal strength.

Once you have the ISP's IP address, you'll (or the DA) probably have to get a court order to have the ISP reveal the account holder's information. From there the police would need a search warrant. Granted that with an open access point, the ISP's customer may not be the one with the stolen computer, but that's why they get a search warrant.
 
As others have noted, you probably captured the machine's local IP. If you can access the wireless network and get on the internet, do so and go to whatismyip.com. It'll give you the real IP (sonething that begins with a 10.*, 172.* or 192.* is going to be useless.). The real IP will tell you what internet service provider they're with, and that'll give you something else the police can subpoena (if it comes to that).

Also, with the mac address of the base station, you can look up what the manufacturer is at http://www.macvendorlookup.com/ and if you want to, maybe try logging in with the default credentials. I'd advise copying down the MAC address but not logging in. That might be considered breaking the law. Also, it might not be the culprit's internet to begin with. But if you do log into it, you can get the user's PPPoE username. Some internet services don't require PPPoE settings. but if it's there, you'll get an email address which they may or may not read.

You may get hints as to the person's identity if you google the IP address but if their ISP refreshes their DHCP lease frequently, it might not be as useful as you think since they'll get a new IP address every few weeks/days/hours.

Here's an idea which is just outside my sphere of knowledge but maybe someone else could flesh out. If you can actually log into the router and change settings, get a dynamic IP service like at dynip.com and add that to the router's settings. You may not get the IP address but if you register mystolenmacbook.dynip.com to that router you'll always be able to find that router on the internet. I'm a little fuzzy on this one but maybe someone else can clarify where I'm going with this.

Another thing would be to change the gateway settings on the router, but that's geekery well beyond my ken.

And another thing: poke around here to see if there are any names you regognize. http://neighbors.whitepages.com/search/neighbor_search?street=2904 47th ave&where=san diego, ca
 
Last edited:
Luke 007 said:
Alright guys so my computer was online when I woke up this morning so I grabbed my computer with Kismac installed and drove over there immediately. Once I arrived the computer was still online and stayed online for a good hour. I pinpointed my computer's I.P. address successfully! There was only one open network in the area (strong enough that I could get on the internet with my current macbook) and it only had one "Apple" device on the network = My computer! I also took down the model and license plate number of every vehicle in the culbisack which could help pinpoint a vehicle if and when the macbook moves location.

So now that I have my macbook I.P. address, how can I proceed?

I did not walk around outside with the computer searching for a stronger/weaker signal, although I probably should have. I already felt a bit sketched out and didn't want to blow my cover so fast.

So what now?

I guess I inform the police and try to get the FBI, ICE and Justice organizations involved based on the fact that I have the I.P. address and a tool to find which house it is in based on signal strength.
Click to expand...

filessharenatorcom_YG6vv_GIF_Collection_of_someone_eating_popcorn-s320x240-181195.gif
 
killerwhack said:
Ok- curious to know how your computer was stolen. Did you leave it someplace unattended? Was it removed from your bag while your bag was secured ? How did this happen ?
Click to expand...

I was at my University working alone in a classroom and left to go to the bathroom for 5 minutes. When I came back by backpack, computer, and everything I had with me was taken. Yes I realize it was stupid to leave my valuables unattended like that, will never happen again.
 
It's common sense to not leave such an expensive item out in the open, especially in a University where all types of people walk around.

I would recommend that you tether the laptop to a table next time using a security chain (such as a kensington lock). It's not the most secure way of doing things, but it's fine for leaving it for a short amount of time (in your case, a bathroom break).

It is understandable that when you're at school, you may be sleep deprived so the thought of someone stealing it would be out of the ordinary, but this is real life and things happen. Humans are detestable sometimes, so it is your responsibility to guard yourself from theft.

When I used to take bathroom or longer breaks back in school, I would put my expensive belongings in my locker and/or just take it with me.
 
Never leave your valuables unattended. Never. Not even for 1, 2 o 3 minutes. That said, good luck finding it, I hope you do.
 
Luke 007 said:
I was at my University working alone in a classroom and left to go to the bathroom for 5 minutes. When I came back by backpack, computer, and everything I had with me was taken. Yes I realize it was stupid to leave my valuables unattended like that, will never happen again.
Click to expand...

Harsh lesson, I think the OP more than realises that this was poor judgement at best, no need to berate further.
 
I would go to the University Police and ask them to help. You are putting a lot of energy into locating it but you are powerless if you actually find it.
 
Alright so I jumped the gun. That I.P. address I was talking about may not necessarily be mine.

I thought that my Mac connected to an open network for me to see it on iCloud so I assumed that the only Apple device on the open network was mine. But I just realized iCloud will function with an encrypted network or not.

So now I am in quite the predicament. I am so close yet so far away. When I was at the location I was able to save my Kismac scan data and get all the possible MAC IDs, there are like 14. I have the serial number but when I called Apple they told me that they were not able to match the serial number with a MAC ID.

Once I can identify my MAC ID I will be able to pinpoint the network its on based on my Kismac data. If it's on an encrypted network that would be perfect, my detective on the case said that he would contact the internet service provider, pinpoint the exact residence hosting my stolen computer and get a search warrant in the works!

Any ideas? The MAC ID # is on the original packaging but that got thrown away unfortunately.
 
Maybe your ISP's technical support would be willing to help. If you connected from home, and you connected wirelessly, and your's was the only Mac using the account... Maybe they would tell you the Mac address after you verified yourself as the account owner. Better if they send it in an e-mail, so you can show a copy to the Police with a screenshot of your scan from the site.
 
BTW, if it's unencrypted Wi-Fi, he may well be using his neighbor's internet without their knowledge. Your wardriving really needs to nail down which house it is. If necessary, one walk down the sidewalk should find the max signal strength for both the laptop and the router. You could practice on your own street a couple of times, so you know what to expect.

You're almost there.
 
you can use macvendorlookup.com to review each of the MAC addresses in your kismac dump to get the vendor. Chances are there will only be a few Apple MACs. Once you know which are Apple MAC addresses, a little internet sleuthing might tell you what range of products they came from. Or, call Apple again. Maybe they can't search for the MACs assigned to a serial number but they might be able to do the reverse.

Also, if you have a case number, give it to Apple. That might get you more information such as the IP your machine is connecting to iCloud from. They might have a number for your officer to call.

If you have any backup with an Apple System Profiler report on it, that'll have the MAC.

Finally, and this is a stab in the dark: does your university require your machine to be registered to use the network? Mine does. If yours does, they may have a record of your MAC address.

it might help to post the IP and kismac MAC addresses here. More data is better than less!
 
**UPDATE - GREAT NEWS!**

My family was able to find the original packaging that my Macbook Pro came in and I now have the MAC ID#s (Ethernet and Airport IDs). I can see my computer in my Kismac data, but the odd thing is that it shows up in 5 networks! That doesn't make any sense to me, any ideas guys? Of course, I sent this updated info to my detective working the case as well as all my Kismac data. We are so close to getting it back I can smell it! The Detective has already expressed that he is ready and willing to do what it takes to get a search warrant once we pinpoint the residence by identifying the network.

To reiterate, literally I can see my Apple computer with my unique Airport MAC ID# connected to 5 different networks all in that area. How is that possible, could Kismac be glitching? All of the networks are encrypted except one which is open.

I was hoping after discovering my MAC ID # that I would pinpoint the network immediately but now this...what's going on? Thanks is advance guys!

----------
dynamojoe said:
you can use macvendorlookup.com to review each of the MAC addresses in your kismac dump to get the vendor. Chances are there will only be a few Apple MACs. Once you know which are Apple MAC addresses, a little internet sleuthing might tell you what range of products they came from. Or, call Apple again. Maybe they can't search for the MACs assigned to a serial number but they might be able to do the reverse.

Also, if you have a case number, give it to Apple. That might get you more information such as the IP your machine is connecting to iCloud from. They might have a number for your officer to call.

If you have any backup with an Apple System Profiler report on it, that'll have the MAC.

Finally, and this is a stab in the dark: does your university require your machine to be registered to use the network? Mine does. If yours does, they may have a record of your MAC address.

it might help to post the IP and kismac MAC addresses here. More data is better than less!
Click to expand...

Thanks for the tips man but found the MAC ID on the box! Check out the update and let me know what you think I should do.
 
you should be able to pinpoint your mac's wlan now by tracking the mac adress.

make sure to set the channel to the wlan it's connected to so that you have a constant signal.

If you can get a yagi/directional antenna, it would be easier to spot it.

good luck!
 
How is this any different from the Lo-Jack service in terms of recovering your stolen computer? ...As in how does Lo-Jack get your computer back in this particular case ?

Google is my friend... from the lojack site.

"As the owner of a stolen laptop, you contact police and file a theft report. Then, you log in to the Absolute Customer Center and report your laptop as missing.
The Absolute Theft Recovery Team uses advanced forensic technology to locate the laptop and possibly identify who has it. They share this information with local law enforcement, who recover the computer.
The laptop is returned to you ASAP."
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back