2 ms·
What happens when the attacker modifies /etc/resolv.conf, disables or does not use DNS while on the network. What if the attacker does not use software that au
by pwdisswordfish2 6y ago
What happens when the attacker modifies /etc/resolv.conf, disables or does not use DNS while on the network.
What if the attacker does not use software that automatically loads images, like the "canary token" tracking pixels?
What is the attacker opens the files offline?
Canary tokens still work? How?
Why would anyone advise using canary token instead of port knocking? Makes no sense. Why not use both?
- tptacek 6y agoI don't even understand the question. We were talking about the value of moving SSH to a different port to cut down on logged probes. That at least has the value of giving you a weak signal about IP sources that are somewhat determined to break in. Port knocking doesn't even do that.
- pwdisswordfish2 6y agoMaybe it is not supposed to. Port knocking is not a substitute for anything. Yet most criticisms of it, like yours, seem to assume it is going to be used as a replacement for something else.
- mh_ 6y agoTo defend Canarytokens here (and I’m totally biased because we make it) some tokens can’t be easily avoided. Ie. If the token is a Slack/AWS/something API key, then the only way for the attacker to profit is to use it, and the moment they do, they tip their hand. The joy of Canarytokens is not having to set up infrastructure to get the alerting win, with very little effort.
- pwdisswordfish2 6y agoNot "knocking" the idea but to be honest using someone else's API key and expecting that no one is going to notice sounds really dumb. I guess if that is the level of intelligence you are up against, then "winning" can indeed be quite easy. Although I would argue if the goal is to restrict access and they managed to gain access then regardless of what they do next, whether it is smart or stupid, they have "won".