Stolen iPhone, Tracked Live, Thief Caught
Find Threat Talks on
An iPhone is stolen at a scrapyard in Roosendaal.
Ninety minutes later, Dutch police have three men in custody and the phone back in its owner’s hands. This is not a hypothetical incident response drill. It happened to Lars Nobelen, ON2IT’s Information Security Officer, on a Saturday morning errand.
In this episode of Threat Talks, Lieuwe Jan Koning, Co-founder & CTO at ON2IT, sits down with Lars Nobelen and Robbert van der Linden, Site Reliability Engineer at ON2IT, to walk through exactly what happened: the distraction technique that got the phone stolen, the mobile device management (MDM) commands that turned a dead phone into a tracking beacon, and the decisions that separated a solved case from a write-off. If your organization has never tested what happens when an employee’s phone disappears, this is the closest thing to a live-fire exercise you’ll get without losing a device.
What you’ll learn
- Lost Mode is also a tracking switch. Apple only shares a device’s location once it’s locked into Lost Mode.
- Zero-touch enrollment closes the gap before day one. A new ON2IT phone enrolls in MDM the moment it gets an internet connection, with no manual setup.
- Your MFA token can strand you. When your authenticator lives on the stolen device, you may not be able to sign in anywhere to track it yourself.
Your cybersecurity experts
Lars Nobelen
Cyber Threat Intelligence at ON2IT
Robbert van Linderen
Site Reliability Engineer
Lieuwe Jan Koning
Co-Founder and CTO ON2IT
Episode details
Most incident response tabletop exercises assume the attacker is sophisticated and the target is a server. This one involved three men, a loud trunk slam, and a scrapyard in Roosendaal. The lesson underneath it is uncomfortable: your perimeter now includes your employees’ pockets, and the response has to work on a Saturday morning with no warning and no SOC analyst standing next to the victim.
The technical turn in this story is Apple’s own restriction, not a workaround. Apple will not surface a phone’s live location unless the device is locked into Lost Mode, which simultaneously renders it useless to a thief. That trade-off, usability for the holder in exchange for visibility for the owner, is the same bargain every zero trust control makes. ON2IT’s mobile device management system could flip that switch remotely within minutes of the SOC validating the caller’s identity, because the policy had already been written and tested long before anyone’s phone went missing.
What made the recovery possible was not a single clever tool. It was three design decisions made months earlier: a 24/7 SOC number that employees actually know to call, a reseller agreement that auto-enrolls every new Apple device into MDM before it is ever unboxed, and a deliberate choice to leave the SIM PIN off so a powered-on phone reconnects to the network immediately instead of sitting dark. Each decision looks small in isolation. Together, they turned a stolen phone into a trackable one within fifteen minutes of a thief switching it on.
The uncomfortable question for any security leader watching this is not “could my team pull this off.” It’s “would my employees know who to call, and does that call reach someone in under a minute, at any hour.” Lars Nobelen had a number memorized. Most employees don’t. That gap, not the technology, is usually where this kind of incident actually gets lost.
Get your Hacker T-shirt
Join the treasure hunt!
Find the code within this episode and receive your own hacker t-shirt for free.
