Windows Honeypot user account for tracking laptop

Question

I've been wanting to create a dummy "Honeypot" user account on my Windows 7 laptop in case of theft.

My question is: Has anyone come across useful resources and tips for doing this? Is there a way to have what "looks" like an administrator account with lots of goodies but hides the real stuff; like a sandbox?

The main idea of this is to deter a thief from just reformatting the laptop right away. I imagine most thieves would boot up the laptop to see if anything interesting is going on, so having a user account with no password seems like a decent trap.

What I have been using so far is just a guest account with some interesting start up scripts that makes it easier for me to track the laptop and remote control it. Most tracking software I have looked at doesn't have the "sophistication" I'm looking for, and rolling my own seems like fun.

I know I left this question a bit general, but I'm looking for general suggestions and ideas.

score 6 · Answer 1 · answered Mar 25 '11 at 09:18

6

Might there be some value in going the whole nine yards and instead of just having a dummy 'admin' account, using the hidden operating system functionality of truecrypt to run your own 'actaul' os thereby giving them the whole (unhidden) operating system to play with (which you have installed your tracking rootkit onto etc)? This way, you can really give them the impression of having gained access to somebody's private data (without having to mess around with faking much), install whatever rootkitesque tech you're going to for remote monitoring/control (maybe its just me but installing this kind of thing on my everyday os would make me nervous!) and be more sure of properly protecting your actual data.

answered Mar 25 '11 at 09:18

TobyS

1,597
1
12
17

interesting... I've used truecrypt before but I had no idea it could do that. That looks very useful. – WalterJ89 Mar 25 '11 at 09:36
Of course you could accomplish something similar (if less covert) without truecrypt just by having a seperate os on another partition and having a bootloader for it on an external device. – TobyS Mar 25 '11 at 09:45
this may not work all that great because I use standby most of the time. – WalterJ89 Mar 25 '11 at 10:30

score 2 · Answer 2 · answered May 25 '16 at 19:21

My approach: Install Linux as my primary OS with full disk encryption, install Windows with a no-password default user.

Windows installation is left with the minimal: Firefox, Chrome, WinZip/WinRar, pdf reader, OpenOffice/LibreOffice, steam without account, Origin without account. This installation is to look like something just re-imaged, so the thief will not try to reformat the drive, and will just use everything that was installed.

And add a keylogger, VNC, Prey, DDNS client, a remote shell, and any invisible backdoor I can install and test. If someone steals it, it will keep using Windows and I can get a lot of data from it.

score 1 · Answer 3 · answered Mar 28 '11 at 06:52

1

I suggest that you boot into the cloud with an OS that supports encrypted swap space and the ability to run a subsystem that always frees/secures vDRAM. Run all protocol traffic over Tor with obfsproxy, so as to hide the network signature that you are using Tor.

answered Mar 28 '11 at 06:52

atdre

18,885
6
58
107

is this answer related to this question at all? – WalterJ89 Mar 28 '11 at 09:35
Yes, the laptop is then a giant honeypot. Anything that a potential thief does to the machine will then be forensically available with no chance that the real owner had changed any of it. – atdre Mar 29 '11 at 20:00
still.. "boot into the cloud" I just find that phrase funny. – WalterJ89 Mar 30 '11 at 21:52

Windows Honeypot user account for tracking laptop

3 Answers3

Linked