So you already follow all the best security practices,
but you want to be even more certain that no hackers or even overly curious friends
have gotten into your computer. What do you do? Well in this video, I'm going to show you
a couple of different ways on how you can set traps on your computer to alert you.
For example, you could put a file or folder on your desktop with an irresistible name like
"Bitcoin Wallet" or "Private Personal Pictures." And if anyone opens that,
you immediately get sent an email telling you. And I'll also show you a method I
came up with where if anyone tries to access or copy a file that you set,
it will automatically and right away disable all network adapters on your computer.
So it cuts it off from the internet and/or shuts down the computer immediately. And the best part
is none of this requires signing up for any accounts or even installing any software.
Alright now before we continue, I want to thank today's sponsor Blinkist. You see, there's a ton
of books that I would love to read, but I simply don't have the time to get through them all.
So if you're the same way, that's where Blinkist comes in. It's an app that
takes thousands of the top nonfiction books across a whole bunch of different categories
and creates much shorter text and audio explainers they call Blinks for each one,
as well as producing shortcasts, which are Blinks for podcasts.
Each Blink is around 15 minutes. And in that time, you'll learn the biggest takeaways and
most powerful ideas from the book. And listen up because they just added a new feature called
Blinkist Connect, which lets you connect a second account to your premium account
at no additional cost. So effectively it's two for one for you and a family member or friend.
Just find the button that says share your free invite and add them through there.
I'd say my favorite Blink recently is The Upside of Stress, which is one of those
rare books that you can legitimately consider life-changing. And I know it sounds cliche,
but it's really not. The book basically explains how all the usual talk about how
bad stress is for you may not actually be the case, and may even be exactly the opposite.
Not what I was expecting. So if you want to check out Blinkist, go to Blinkist.com/ThioJoe and get
a one week unlimited free trial to try it out. The trial is completely free and you can cancel
at anytime. But just for you guys, if you decide to get a premium membership, you can get 25% off
that. So again, go to Blinkist.com/ThioJoe, same link is down in the description.
And with all that being said, let's continue. Alright now the
first service I'm going to talk about is one I just recently found out about
called Canary Tokens at canarytokens.org. When you're there, all you do is choose
from the drop down the type of token you want to use. And there are a whole bunch.
I'm not going to go over all of them, but a couple of my favorites are the Windows folder
and URL token. So let's do the Windows folder as the first example. You just put in whatever email
address you want to get your notification at and a text note to basically remind you what the token
was for. And then if you want to be really fancy, you can also use what are called webhooks to send
commands to other services and literally have it trigger whatever you can program.
So if you have the know-how, you can have it pretty much do whatever you want,
but I'm just going to put in an email. Then I just hit Create my Canary token. And like I said,
there's no accounts to create it, this is it, it's free. Here you're presented
with a zip file to download, which contains the Canary or trap folder.
Though first you should click Manage This Token and save that URL. That lets
you manage the token if you want, like disabling the notifications,
stuff like that. Anyway, if we download the zip file and extract it, we can see
that it really is just a Windows folder, but I'll show you the secret in a second.
Let's put it on the desktop and rename it. And at this point as you can see, if we refresh
the manage page, it says this token has not been triggered yet. But if we go and open that folder,
nothing appears to happen. But now if we refresh the manage page, it says this token has been
triggered and it tells you how many times, and you can also view the history for all the details.
If you're wondering how this works, it actually takes advantage of the desktop.ini file,
which is a thing in Windows that basically describes what icon to use for a folder,
that sort of thing. But you can also use external remote icons. So what
they did is just put a URL to the Canary Token website that has that unique identifier on it.
So if anyone opens that folder, it pings that URL. So they know that someone must have opened that
folder and that's how it tells you. For the URL type token, it's dead simple. It simply gives you
a URL and if anyone visits that URL, it triggers it. And you can actually customize the URL quite
a bit. So you can change any part of the URL except that unique identifier for the token,
but all this other stuff, like between the slashes, you can have it go to any path.
So if you're trying to make it look like it's supposed to go to, I don't know,
some login page or something, you could just put in /login/secretpage.php or whatever you
want. Or if you want it to be not so obvious and you have your own domain,
you can actually use a DNS token. So basically you'd create a DNS CNAME
on your own domain and then have it redirect to the Canary Token.
So that way they wouldn't even be able to see that it's going to be going to that, but you'd be able
to still trigger it. And like I showed, there are a ton of other tokens of different sorts,
really for almost any occasion. But that being said, these aren't exactly foolproof. For example,
when I was working on this video, the folder tokens on my computer simply stopped working.
I think I had some kind of DNS filtering going on on my network that it might've been blocking it,
but it wasn't doing it at first. So I don't know what the problem was. But the other types of
tokens I was testing, like the URL ones seem to work no problem. So I don't know what the
deal is. Also, I should point out the ones that are for Microsoft Excel and Word files.
You might be tempted to use those, but keep in mind that it relies on macros being enabled,
which is not by default. Usually when you open a Word document or Excel file,
it'll ask you to enable editing. And if the person doesn't do that,
which they probably won't, it will not trigger the thing. So just be aware of that.
And also for the folder tokens, it only works if someone's on a Windows machine and activates
it. So if they're using Linux or they're also maybe on the command line, accessing your files,
it's not going to trigger that desktop.ini because you're not using Explorer. So that's
another limitation. Also as it is, if you're just using email notifications, not like a webhook
or anything, it obviously tells you about the intruder, but it doesn't stop anything.
But like I said, I came up with a method that will actually cut off access and
I'll show you how to do that. The one unfortunate thing is to do my method,
you will need to have at least Windows 10 or 11 Pro because you need to have access to the
group policy editor. And if you don't, you can't change the security settings.
So that is one limitation. You have to have Pro or better. And what I'll show
you how to do is like I said, disable all the network adapters on the computer. So if
they're connecting remotely, they won't have access and also then shut down the computer
immediately. So if someone's actually on the computer, then they'll be kicked off.
But what's cool with my method is it doesn't have the limitations of the Canary Tokens,
where if someone is like remoting in or they're not even opening the file, but they're just
copying it off, that should still trigger it because it uses the Windows APIs or whatever
to basically monitor anything that's going on with the file, not just if it gets opened.
So if it does get renamed or moved or copied off the computer, and then they open it over there,
well it triggered it when they were doing that copying. So I think it should be able
to catch everything. Now to do this, there are several steps. I'll walk you through each one,
but I'll give you the quick outline here.
You first have to enable auditing in the group policy editor. Then we're going to
create a task scheduler task to shut down the computer and do all that stuff. I'm also going
to show you how to create a log in the event viewer so you can see what gets triggered.
And I'll show you a couple issues you might run into and how to address it.
Alright so first let's enable the auditing feature. So we're going
to open up the group policy editor. You can search it in the start menu or do "gpedit".
And then go to Computer Configuration, Windows Settings, Security Settings,
and then Advanced Audit Policy Configuration, System Audit Policies, Object Access, and then
on the right, click on Audit File System, and then enable both success and failure.
If you know what you're doing and you want, you can have Windows monitor for other things
to audit, but this is the only one I'm going to worry about now. Then after you do that,
open the command prompt as admin, and then run this command, "GPUpdate /Force",
and this will force the new group policy settings to take effect.
Now we need to choose a file that we want to create for auditing. And this can be
literally any kind of file you want. So I'll just use an example text file. I believe you
could also technically do this with a folder, but I haven't tried it with that. So you can test that
out yourself if you want. Anyway once you choose a file you want to monitor as the trigger or trap,
just right click it and then go to Properties, then go to the Security tab, and then Advanced,
then go to the Auditing tab and hit continue if necessary.
Then go to Add, select Principal, and then enter "everyone" and then hit check names
and it should be underlined. Then click okay. And then in this window in the "Type" dropdown,
click "All", and then click OK on everything to close out the windows and finish. So at
this point, now anytime that file gets accessed, it will create a log entry in
the Event Viewer, but we need to actually have something trigger when that happens.
So that's where the Task Scheduler comes in next. However, one side note is because
technically the file might be accessed by like the Windows Search Indexer and stuff like that,
which would trigger it. You might want to put this trap file into a folder and
then add that folder to exceptions on the Windows Search Indexer, and maybe also add
the file as an exception to your antivirus if it's going to scan it, stuff like that.
Because again, literally if anything access that file,
it's going to trigger it. Now we can get to the main thing, which is creating the task
scheduler task to do whatever we want. So in here, I actually created a new folder for my
tasks and I'm going to right click and create new task. And for now, just select run only
when the user is logged in for testing and then also check run with highest privileges.
But once you have everything set up and working how you want, you can change it to run whether
the user is logged in or not. And the reason you want that is a trojan might create another
user and access the file with that, even if you're not logged in. So you want it to be
always active. Alright so next we're going to go to the Triggers tab in this window and
in the dropdown for begin the task, we're going to select "on an event" and then select Custom.
Then here we're going to click "new event filter" with "by log" selected and then click event logs
and then in the dropdown, look for Security and check it. Then where it says event sources,
find where it says "Microsoft Windows Security Auditing" and check that box.
Then in the box that says All Event IDs, click into that and change it to say 4663.
This is the file access event. Then in the Task Category dropdown, select file system,
and then you can click OK, and then OK in the other window. However, one important thing
to understand is if you create multiple of these files, this is going to trigger if any of them get
accessed. I'm not sure if there's a way to have a specific task only trigger for a specific file.
You might be able to do it with the advanced XML thing,
but I have not figured out how to do it. But in my case, this is fine because if any of
these files get accessed, that is bad news and I want to shut everything down. Anyway,
back in this window, we are going to go to the actions tab and then click new.
And then here, you're going to have a few options for what you want it to do. And so
you can mix and match these that I'm going to tell you about. If you want the computer to shut down,
what you would do is in this box, type in "shutdown" and then in the arguments box,
type this "-s -t 5 -c" and then some message between quotes here.
You can change the five to any number of seconds. This is going to be the
delay between when it gets triggered and when it actually shuts down the
computer. If you're just testing things out, you can set this number to a large
thing like 30 seconds. And then you can actually cancel it before it shuts down.
If you go into the command prompt and type in "shutdown -a" , and that will
cancel it. So you'll finally probably want to end up setting this to something low,
like three or five seconds, enough where if someone's in there, they won't have time to
react and cancel the shutdown. But also you want time for any other actions to be
able to act like the one that disables the network adapters, if you care about that.
But then again, if it's shutting down, that kind of does that too. So here for whatever message,
this will display when the computer begins the shutdown in the warning thing. So you probably
want to put something that you'll know means that the trap was triggered, but also maybe not
so obvious where if someone's snooping on your computer or hackers on there. And for example,
if it were to say "you triggered the trap file", well that's going to tip them off.
Maybe you don't want them knowing that. But if you said "major critical error activated
in blah blah blah," or something like that, then you'll know what that means because you wrote it,
but anyone else might just think it was some kind of error. And that's probably just good
to do because if you're actually using the computer and it gets triggered either
by mistake or legitimately, you probably want to know why it's about to shut down.
Another action you can do is if you put CMD in this window, and then for the arguments,
you type /k echo, and then whatever you want in these quotation marks. And this way,
if the task gets triggered, it will pop up a command prompt window and say some message. So
this is good if you're just testing it out, you don't want it to shut everything down.
For the action that disables all the network adapters, here you're going to put PowerShell
as the program. And then for the arguments, you're going to put all of this text. So get dash
net adapter, and they're going to put a vertical bar, disable net adapter confirm and then false.
I'll put that in the description, you'll want to just copy and paste it so you don't mess it up.
But what this does is it gets all the network adapters, and then it pipes it into the disable
net adapter command. And then the confirm false makes it so you don't have to confirm it,
it just does it right away. So again, if you're just testing this out to make sure it works,
you can actually just change that false to true.
And then when you're happy with it, you can set it back to false. So those are just a
few examples for actions you can create, but you can really have it do whatever you want,
if you have the know how. Now let's go into the event viewer and create a log
that will make it easier to monitor when this thing gets triggered.
So if it does happen by mistake or whatever, you can see what happened. So just search the
start menu for Event Viewer, and then we're going to go to Action,
and then Create Custom View. And it's basically going to be the same stuff that we did before.
You're going to select [by log], and then look for Microsoft Windows Security Auditing again.
Then type in event ID as 4663, and then task category is file system. And then just hit
okay to finish that, and now you'll see that show up on the left side. And now anytime you copy or
open or do anything to that file, it should show up as a log entry. And it'll actually probably
show as multiple log entries, because usually when you access a file, multiple things happen.
Like the explorer might look up properties of the file or something like that. The actual
program might open it. You'll see that other stuff happens. But at least this will show you
what was going on, and what was trying to access it. So maybe if you do have some kind of Trojan
on here, and you're trying to figure out what was accessing your files, this will probably tell you.
So what I'm going to do, and what you might want to do if you're going to try all this,
is don't have it set to shut down the computer while you're testing it out. Maybe just use
one of the commands that just displays the message, so you can work out all the
kinks. Again, maybe if you have some kind of backup program running and you forgot,
and you realize that triggered it, then you can work around all that until you're happy there's
not going to be any false positives. And then you can maybe enable the real shutdown sequence.
You also don't necessarily have to have it disable all the network adapters. If it shuts down,
that kind of serves both purposes. But I figured you might want the option. And
even if you don't end up using any of this, hopefully it still gave you some ideas and
taught you about a feature that maybe you didn't know about before, like this audit access thing.
Maybe you don't want it to just trigger a shutdown,
but you still want to know when a file gets accessed by some kind of programs, even for
troubleshooting could really come in handy. Let me know what you think down in the comments,
and if you have any ideas for what you might use this for, if it's something totally different.
Thanks again to Blinkist for sponsoring this video. Again
be sure to go to Blinkist.com/ThioJoe and get an unlimited 7 day free trial,
and 25% off a premium membership. And if you enjoyed this video, definitely give it a big
thumbs up for the YouTube algorithm. If you want to keep watching, the next video I'd recommend
is where I was talking about an insane virus trick that I probably would have fallen for.
So I'll put that right here if you want to click on it. So thanks so much for watching,
and I'll see you in the next one.