4 ms·

Internal honeypots as early warning system are called Canaries. Usually they run on a just slightly outdated and vulnerable software version, so that an attacke

Internal honeypots as early warning system are called Canaries. Usually they run on a just slightly outdated and vulnerable software version, so that an attacker does not need credentials. One example would be emulating a forgotten file server with SMB1 enabled. The homepage of Thinkst Canary https://canary.tools/ https://canary.tools/ gives a good overview.

waihtis 6y ago
Canaries has been pretty much replaced by decoys as the "official" term, as denoted by the MITRE SHIELD framework: https://shield.mitre.org/matrix/ https://shield.mitre.org/matrix/
- qwantim1 6y ago
  Canary (in a coal mine) makes more sense to me if the goal is an early warning system.