Friday | 10 July, 2009
CSO
Tony Soprano's laptop
What would mob-boss Tony Soprano need in a laptop?
Jon Espenschied (Computerworld) 10/04/2007 14:45:57

The Tough(guy)Book

Everything about the laptop fits as part of the cover. While Tony might want a top of the line MacBook Pro to match the Escalade, that's not the right direction. A waste management consultant probably has a computer that can take some abuse; maybe a ThinkPad or a ToughBook. It's not very cool, or even distinctive in any serious way. There would be no love lost if the whole thing had to be dropped or crushed, because it's just a tool. All the same, there's probably a small scratch or worn key that the boss recognizes.

All the hardware is part of the cover, and the less distinctive it is, the more likely it'll be lost or mishandled in any evidentiary process. Everything on the hard drive is a decoy, running a generic copy of Microsoft Windows XP or whatever the license sticker says on the bottom of the system. Maybe it's an educational copy that Meadow picked up from a friend at college, but nothing more illicit than that -- no sense in attracting attention. Times and dates of system use ought to be relatively believable, and match up with the image of consistent legitimate business. Who knows, maybe it's actually useful -- no one says the cover can't be done well or make some money.

Anyone looking for high-value information in plain sight would find a few contract documents (no, not that kind) and spreadsheets about sanitation logistics. The cover's got to be maintained, and it helps to play the part. However there's no sense in tying it too closely with the big guy, and with a few overwritten documents, even the cover can be eradicated.

It's boringly normal. Just to throw the feds off, maybe the primary partition is a little short of the full disk capacity. But there are no real anomalies to distinguish it from any other computer ordered in the default configuration.

So where's the real deal? Kind of in plain sight, and kind of all over the place.

Where's the deal?

The real operating system is transient, reloaded from a clean source each time the system starts up. With the current state of the art, the best options are live UNIX-like distributions that run entirely from a CD. The boss may appreciate nice toys but doesn't have time to mess with anything that doesn't work, so his copy of Ubuntu or Anonym.OS has been worked through by some pretty sharp guys.

The CD might be obfuscated a bit with a few minutes of Junior crooning in Italian on a disk that looks like AJ burned it from iTunes, with a bit of static at the beginning and the OS on track 2 or 3. There's always the option of using a plainly-labeled "live distro" CD, but it's easier to blame geeky stuff on the kids and profess ignorance.

With the CD in the drive, the operating system loads into memory, has no swap file or partition, and never loads any of the local hard drive partitions. In fact, Tony's custom Mob-untu distribution may have the hard drive drivers removed so there's no volume or file "touch" anomaly for the forensics guys to ponder.

Among other things that are removed or re-ordered, the input drivers don't support multiple devices, and the local keyboard and mouse hardware is set to load last. If the system boots up to find a passive keyboard or timing anomaly from a wedge in the device connection, support for the standard input devices won't load. In most situations this means if a physical keylogger has been installed on a PS/2 interface or wired to the inside of the USB port, the real keyboard just stops working. And Tony donates the laptop to charity. Anything more sophisticated than that, and he's got other problems.

There's no logon; the system comes up with an un-named non-privileged account. After a short boot sequence, the system is ready for business -- strictly business. There's no reason to be messing around while the vault's open, so to speak, and a man with Tony Soprano's legendary home-entertainment system isn't going to watch movies on his work laptop even if he had the time or inclination.

Working in risk management and financial services, he wants to keep track of numbers and people, contracts, and a few other bits of information. Complicated lies are trouble, and if they have to be made at all, they have to be kept straight. All we find, then, are a few applications: a word processor and spreadsheet with charting and forecasting tools and some trend analysis software. (And that list of worrisome dreams about Mom.) Contact management may be as simple as a flat text document, or a series of portable vCard files.

Comments

Post new comment

Login or register to link comments to your user profile, or you may also post a comment without being logged in.
The content of this field is kept private and will not be shown publicly.
Enter the fully qualified URL, eg. http://www.example.com/
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

Additional Resources
Newsletter Subscription
Sign up for our CSO Online newsletters!
RSS Feeds
Syndicate content
 
Whitepaper

5 steps to getting started with data loss prevention

Lost and leaked data from stolen laptops, compromised networks, and malware-infected client devices all affect Australian businesses. Read on to discover the five critical steps to prevent data loss within your organisation.

Sponsored Links