2

An ex-girlfriend has demonstrated an ongoing ability to acquire files from my computer. I am trying to determine when and how this is being done. One stratagem I want to use is to put "honeypot" files on my computer that are likely to be stolen and opened, and that send me a report whenever they are opened that contains as many details as possible on where they are being opened.

I was thinking of trying to write my own VBA to embed in an Excel or Word document for this purpose, but I am not a good hacker (neither "coder" nor of any color hat).

Requirements are a file or code that, on Windows 10:

  1. Can disguise itself as/in a file likely to be sought by intruders. E.g., images, videos, or documents.
  2. Will get through Windows Defender and other standard Windows 10 firewalls.
  3. When opened will likely be run. (A VBA macro would probably be the least desirable in this regard, because it requires enticing the intruder to override Office's warnings against enabling macros.)
  4. When run will send or call me with data about its environment. (It is not necessary to obscure the destination of its data. I.e., it can be my plaintext email address or a URL easily associated with me.) Just knowing the time that the file is opened is worthwhile. Other data that would be helpful include: local IP address or traceroute, user/computer name, local system characteristics, local directory contents, other filesystem contents that would further illuminate/confirm who and where it is being accessed.

This doesn't have to be exceptionally sophisticated to be useful. My ex does not have any extraordinary computer skills. It is likely that a more skilled confederate provided her a backdoor into my system, or may be occasionally providing her with file dumps.

My guess is that software that meets these requirements is well known and regularly demonstrated in the hacker community.

  • It could be possible that you're doing an illegal activity by hacking back. Basically you're gonna change her computer and compromise her data by sending something back to you. – Thomas Weller Apr 19 at 22:19
  • "regularly demonstrated in the hacker community" - perhaps such software is used for demonstrations. But these demonstrations often happen in a controlled environment, because doing it in reality may cause legal problems. Also, the source code is often not provided, because these people want to keep it for themselves. – Thomas Weller Apr 19 at 22:21
  • @ThomasWeller: Yes, could be illegal. I will consult a qualified lawyer for specific legal advice on my contemplated use of any such software. – Lysander Apr 20 at 1:23
3

I think something like canary tokens fit the bill here. See canarytokens.org and Thinkst Canary.

Also I recommend also posting on infosec for more ideas.

| improve this answer | |
2

The simplest and least technologically sophisticated way to have something like this is likely an HTML document or an HTML email that links to an external image hosted in your server when opened in a browser. You only need to setup a file server to log the time and IP address of the file access. This requires no scripting and a browser or email app loading a file is not something that would raises suspicion with security software. The image of course won't be loaded if opened in a text editor or other non graphical HTML editor, but that's not something that non technical user normally does.

This is very similar to the email tracking pixel commonly used to track email opens, e.g. for read receipts.

| improve this answer | |
  • Sorry I don't get it. What about if she opens the mail from her smartphone ? And how does it helps to discover how she accessed cumputer's local files previously ? – AFract Apr 23 at 5:33
2

The best solution for proving that someone is illegally accessing your computer is to have some information on there that you can prove is not true and could not have come from anywhere else that the person getting access to it can not resist publishing. This goes back to maps and dictionaries having spurious places/entries so that they could prove that their copyright had been infringed. You do not have to worry as much about legal comebacks as you will not be executing any code on anybody else's computer - just take care that there are no legal consequences for you from the spurious information, e.g. making out that you are involved in some illegal activities could result in the authorities acting on that information. This is known as a Canary Trap.

One possible software way of addressing this is to use Steganography to encode the time, date and who is logged in, possibly from which IP address, into one or more images that your ex is unlikely to resist publishing unchanged.

There are a number of open source solutions including python libraries that could be used from scripts to update the information on a regular basis (being sure to leave the timestamps alone).

Be aware that the use of any cryptographic tools may be illegal in some locations.

Of course, in general, I would advise you to change your passwords and check that there are no unexpected accounts on your machine.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.