"Honeypot" code to send me forensic data when stolen files are opened

Question

An ex-girlfriend has demonstrated an ongoing ability to acquire files from my computer. I am trying to determine when and how this is being done. One stratagem I want to use is to put "honeypot" files on my computer that are likely to be stolen and opened, and that send me a report whenever they are opened that contains as many details as possible on where they are being opened.

I was thinking of trying to write my own VBA to embed in an Excel or Word document for this purpose, but I am not a good hacker (neither "coder" nor of any color hat).

Requirements are a file or code that, on Windows 10:

1. Can disguise itself as/in a file likely to be sought by intruders. E.g., images, videos, or documents.
2. Will get through Windows Defender and other standard Windows 10 firewalls.
3. When opened will likely be run. (A VBA macro would probably be the least desirable in this regard, because it requires enticing the intruder to override Office's warnings against enabling macros.)
4. When run will send or call me with data about its environment. (It is not necessary to obscure the destination of its data. I.e., it can be my plaintext email address or a URL easily associated with me.) Just knowing the time that the file is opened is worthwhile. Other data that would be helpful include: local IP address or traceroute, user/computer name, local system characteristics, local directory contents, other filesystem contents that would further illuminate/confirm who and where it is being accessed.

This doesn't have to be exceptionally sophisticated to be useful. My ex does not have any extraordinary computer skills. It is likely that a more skilled confederate provided her a backdoor into my system, or may be occasionally providing her with file dumps.

My guess is that software that meets these requirements is well known and regularly demonstrated in the hacker community.

Answer 1

I think something like canary tokens fit the bill here. See canarytokens.org and Thinkst Canary.

Also I recommend also posting on infosec for more ideas.

Answer 2

The simplest and least technologically sophisticated way to have something like this is likely an HTML document or an HTML email that links to an external image hosted in your server when opened in a browser. You only need to setup a file server to log the time and IP address of the file access. This requires no scripting and a browser or email app loading a file is not something that would raises suspicion with security software. The image of course won't be loaded if opened in a text editor or other non graphical HTML editor, but that's not something that non technical user normally does.

This is very similar to the email tracking pixel commonly used to track email opens, e.g. for read receipts.

Answer 3

The best solution for proving that someone is illegally accessing your computer is to have some information on there that you can prove is not true and could not have come from anywhere else that the person getting access to it can not resist publishing. This goes back to maps and dictionaries having spurious places/entries so that they could prove that their copyright had been infringed. You do not have to worry as much about legal comebacks as you will not be executing any code on anybody else's computer - just take care that there are no legal consequences for you from the spurious information, e.g. making out that you are involved in some illegal activities could result in the authorities acting on that information. This is known as a Canary Trap.

One possible software way of addressing this is to use Steganography to encode the time, date and who is logged in, possibly from which IP address, into one or more images that your ex is unlikely to resist publishing unchanged.

There are a number of open source solutions including python libraries that could be used from scripts to update the information on a regular basis (being sure to leave the timestamps alone).

Be aware that the use of any cryptographic tools may be illegal in some locations.

Of course, in general, I would advise you to change your passwords and check that there are no unexpected accounts on your machine.