1

I've just found out about canary tokens and how they can be hidden in a lot of object types. So I put a canary token on my desktop as a Windows folder. Now, whenever I unplug my phone from the computer, I get a notification that the canary was triggered.

I moved the canary token to another location and it won't trigger the canary. I checked my phone and it isn't in data transfer mode when connected, only charging mode. Why would I be getting a trigger when the canary isn't opened?

edit:link to create canary token http://canarytokens.org/generate

4
  • 1
    Please link to the information you used to create the token. Without knowing exactly what you did, we can't tell you why something is happening.
    – CBHacking
    Oct 15, 2019 at 0:04
  • @CBHacking As you can see, that advice has led to a question that is dependent on a third-party resource. Instead, in future please encourage people to include the relevant information directly in the question. Thanks Oct 15, 2019 at 19:01
  • @LightnessRacesinOrbit Fair point, I should have asked for a step-by-step instead of a link. I suspect it would have ended up being mostly just a link anyhow (or at least, there would be a link that would constitute the bulk of the usable information), but I should have asked differently anyway.
    – CBHacking
    Oct 16, 2019 at 0:07
  • Questions about a specific product should be directed to the vendor. They know how it works under the hood; we do not.
    – DoubleD
    Oct 17, 2019 at 17:16

1 Answer 1

2

Windows Explorer Canary Tokens are used to trigger "browsing activity" within a specific folder and not system wide.

You have put the desktop.ini file on your desktop, which will for sure trigger the alert action.

Canary code should look like:

[.ShellClassInfo]
IconResource=\\%USERNAME%.%COMPUTERNAME%.%USERDOMAIN%.INI.TOKEN.domain.tld\resource.dll

try to put the file inside a folder: C:\testfolder\desktop.ini let's say, so that whenever someone tries to "browse" that path as in C:\testfolder\ locally or within the network (if the folder is shared), an alert will be triggered.

2
  • Ok IAM getting some werid results I put the desktop.ini straight in the desktop folder.now IAM getting trigger s with my computer name in src data but the trigger dns up addresses are Japanese, Ukraine,etc IAM in the USA.this is a little off topic but maybe the canary is working and I have a backdoor on my desktop? Oct 15, 2019 at 20:05
  • if the trigger is showing results of Ukraine and Japan then it could be a possibility yes. Might want to scan your OS for malware and or just simply format it and start clean. In case you're not sure simply spawn a VM and try it out.
    – Viktova
    Oct 15, 2019 at 20:27

Not the answer you're looking for? Browse other questions tagged .