In this video, we're taking a look at Canary tokens.
Now, Canary tokens are a pretty useful thing to use for figuring out where someone is and kind of the
devices you're using.
I use these a lot when I do investigations, especially on scammers.
So let's take a look.
This one is canary tokens for generate where we can generate these canary tokens.
And essentially what happens is when these tokens are triggered it'll send us an email alert.
So if I go here I can select a token.
We can see all sorts of tokens here web bug DNS, AWS keys, a zero login certificates, sensitive command
tokens, word docs, Excel, Kubernetes VPN, WireGuard QR codes, custom web bugs, PDFs, etc., etc..
So um, for certain scammers, I've used things like word docs or Excel files or PDF files.
I labeled it payroll, for example.
So when they clicked on it, it would trigger.
And then and then I would get the IP address in that.
So on a defensive side this could be used for things like figuring out I use these typically for um
scams for like hookup scams and that.
So someone says, hey, send me money.
Okay, so what I'll do is I will typically get their email address.
We'll do, say, a custom web bug.
And then for the email address you put the email address that you wanted to go to.
Now reminder I always use a reminder.
Things like, uh, this is for a hookup scam.
I'll put a question mark because it can 100% identify whether it is or not.
And um, I'll put down.
I'll typically put the username that they're using and I'll put the email address down.
And what the scam typically is entail they want $50 from a visa.
And then we'll you can put whatever image you want in here.
So I could put like a Where's Waldo.
Um, in this case it's really not going to matter when they trigger the the link, it'll send the address.
And then we do create canary token.
And then if they go to this link here, it'll trigger it and they'll get the information and or we'll
get the information rather.
Now I'll show you what that looks like in a minute.
Now if you send someone this link, it'll usually it'll kind of trigger and go, uh, what the.
What the heck is this?
So I'll usually use a URL shortener.
Like, if I take this, I can go in here.
And then it gives me the short URL and they have no idea what it is.
So I'll typically put in an email like this.
Like we'll have an image that doesn't quite load and go, hey, here's a steam code that you wanted.
Use this link and it links to the canary token.
So when it does trigger, it actually looks like.
Let's see if I can switch the image here.
That's not working.
It'll look like this here.
So we have token reminder I have the email addresses that they put down here.
Um I put the location that they said they were in.
They said they were in San Francisco and this was a financial scam, uh, for this person.
Now, they triggered it.
It gave me the IP addresses here.
And then I can see that they're on Android 11.
I can see the type of device they have.
I can see that they use Chrome when they triggered it.
And I could see the version of Chrome.
Now of course I'll take the IP address, I'll feed it into, see if it's a VPN or proxy.
If it's not, then it then I'll run it to get the actual location.
And if the location doesn't match up where the token got triggered, then that's a huge red flag.
And typically these will actually be Nigeria.
This one I if I remember right, it was uh, I think it was Nova Scotia, which is interesting.
That was the first time for that.
But this is the type of thing that on the defensive side, again, that you could use kind of verify
someone's location.
Now, on the flip side, you need to be careful when people send you weird links.
Uh, always be careful about links or, or word docs, PDF docs and whatnot that they send.
It could either be a canary token or it could be something malicious.
So you do want to feed it into things like, uh, VirusTotal, hybrid analysis and whatnot and check
those files before you actually run them.
So this is about Canary tokens.
Thank you so much for watching.
I'll see you next video.