CanaryTokens

Like real canaries, there exist digital canaries that can warn humans of potential danger in their systems.These digital canaries are called Canarytokens and can come in the form of regular files, API keys, or even websites. When it is activated, it will send a beacon signal to its site of creation. When the site receives the beacon signal it will email you that your canarytoken has been activated and what IP source activated it.

This ability to alert the creator of the token if anyone has touched it has a myriad of uses. If someone wanted to test if their computer was being looked through by an external actor this would be a perfect tool. They would create a Word file with the token embedded into it and just leave it on their desktop. If an attacker were to come and go through their system when they open the Word document, it would send an alert to the creation site which would then email the creator that their file was opened letting them know someone might be tampering with files on their computer. Another use could be for tracking down cloned websites. You can make a cloned website token that inserts the canarytoken code into the JavaScript of your website. If a person clones your site and loads it, the canarytoken script will alert the creator that the site has been copied.

While there are many positive uses for canarytokens there are also negative ones. The most famous example is the use of canarytokens by the Iranian hacking group MuddyWater. MuddyWater had started an email phishing campaign where if you opened their corrupted documents a canarytoken was downloaded and opened on your computer. When it was opened a signal was sent back to them containing the users IP address. This would then let MuddyWater know that the person was susceptible to attacks and they would begin the process of hacking into the individual or organizations’ network.

Although it can also be used to alert malicious actors that a system might be vulnerable, CanaryTokens are a simple way for a user or organization to recognize malicious activity on their network, tell if their website has been cloned, or even if a computer or service within their organization has gone offline.