Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been wanting to create a dummy "Honeypot" user account on my Windows 7 laptop in case of theft.

My question is: Has anyone come across useful resources and tips for doing this? Is there a way to have what "looks" like an administrator account with lots of goodies but hides the real stuff; like a sandbox?

The main idea of this is to deter a thief from just reformatting the laptop right away. I imagine most thieves would boot up the laptop to see if anything interesting is going on, so having a user account with no password seems like a decent trap.

What I have been using so far is just a guest account with some interesting start up scripts that makes it easier for me to track the laptop and remote control it. Most tracking software I have looked at doesn't have the "sophistication" I'm looking for, and rolling my own seems like fun.

I know I left this question a bit general, but I'm looking for general suggestions and ideas.

share|improve this question
add comment

3 Answers

Will try and POP up a better answer, but while I'm on my phone: check out http://www.youtube.com/watch?v=U4oB28ksiIo for some useful thoughts on what can be done about a stolen computer.

share|improve this answer
1  
I love that video... –  WalterJ89 Mar 25 '11 at 8:55
add comment

Might there be some value in going the whole nine yards and instead of just having a dummy 'admin' account, using the hidden operating system functionality of truecrypt to run your own 'actaul' os thereby giving them the whole (unhidden) operating system to play with (which you have installed your tracking rootkit onto etc)? This way, you can really give them the impression of having gained access to somebody's private data (without having to mess around with faking much), install whatever rootkitesque tech you're going to for remote monitoring/control (maybe its just me but installing this kind of thing on my everyday os would make me nervous!) and be more sure of properly protecting your actual data.

share|improve this answer
    
interesting... I've used truecrypt before but I had no idea it could do that. That looks very useful. –  WalterJ89 Mar 25 '11 at 9:36
    
Of course you could accomplish something similar (if less covert) without truecrypt just by having a seperate os on another partition and having a bootloader for it on an external device. –  TobyS Mar 25 '11 at 9:45
    
this may not work all that great because I use standby most of the time. –  WalterJ89 Mar 25 '11 at 10:30
add comment

I suggest that you boot into the cloud with an OS that supports encrypted swap space and the ability to run a subsystem that always frees/secures vDRAM. Run all protocol traffic over Tor with obfsproxy, so as to hide the network signature that you are using Tor.

share|improve this answer
    
is this answer related to this question at all? –  WalterJ89 Mar 28 '11 at 9:35
    
Yes, the laptop is then a giant honeypot. Anything that a potential thief does to the machine will then be forensically available with no chance that the real owner had changed any of it. –  atdre Mar 29 '11 at 20:00
    
still.. "boot into the cloud" I just find that phrase funny. –  WalterJ89 Mar 30 '11 at 21:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.