6 ms·
Canarytokens: Honeypot for critical credentials, get notified when they are used (2015)
- westpfelia 2y agoBeen a big fan of CanaryTokens since it was just 3-4 different types. Super easy to configure via webhooks into a siem or any kind of alerting platform.
- dredmorbius 2y agoPrevious discussion from 28 Dec 2022 (59 comments): <https://news.ycombinator.com/item?id=34157751 https://news.ycombinator.com/item?id=34157751>
- dredmorbius 2y agoThe project documentation is ... slightly ... more useful to generate discussion, though it's pretty lacking in details: <https://docs.canarytokens.org/guide/ https://docs.canarytokens.org/guide/>
- deleted 2y ago[deleted]
- notepad0x90 2y agoa lot of security tools and "platforms" (don't get me started) have deception features now which includes stuff like this. https://learn.microsoft.com/en-us/defender-xdr/deception-overview https://learn.microsoft.com/en-us/defender-xdr/deception-ove... But in my opinion, deception tech is best implemented in-house. Nothing wrong with using externally developed tools, especially for high signal-to-noise things like honeypots but the actual monitoring and alerting data flow should be ideally be environment specific.
- waihtis 2y agoSuper biased (founder of a deception software company) but youre right, deception’s cornerstone is building good quality internal threat data and thus spraying random decoys here and there (a la the platform features you mentioned) will not be of much use.
- notepad0x90 2y agothe first rule of deception imho is that it needs to deceive the threat actor, and you should assume that the threat actor has done enough recon to know what makes sense and what stands out in an environment. If you have a canary in a file about a project that doesn't exist or use an external "canarytokens.com" domain the document, that might be a low quality decoy. Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful. If your company is making deception software, then you already know that Microsoft, Google and similar companies are your competition if your strategy is to do what they do, but I'm sure you've already strategized around all this.
- waihtis 2y ago> Tools to automate deployment, maintenance and alerting/integration (SIEMS,etc..) are much more useful Bingo - between this and not confining yourself into the restrictions of a single platform (what the platform feature vendors have to do - Microsoft deception offers solutions only specific to certain Microsoft infrastructure, etc. ), you can create some terrific outcomes in this domain.
- notepad0x90 2y agoI said "don't get me started" earlier because unfortunately vendor lock in is now a prized feature. I could be wrong but it kind of boils down to CISO's and decision makers looking at how we do things today in security and saying "this too complex, me no get it, me want one thing instead of many, me get that!" (this is why I said don't get me started! lol). I totally support your approach, and I hope your startup succeeds. Although you should really name-drop it here.
- waihtis 2y agoThank you friend! -> defusedcyber.com Hit me up if you'll be at Vegas hacker summer camp next week and want to get a friendly coffee in, the founders email on the website lands into my mailbox.
- mdhb 2y agoI’m currently in the middle of building one at the moment precisely because of how limited I found canary tokens. I also have a lot of security knowledge (mostly from books rather than practical experience) from non infosec case studies like intel agency operations, insurgent groups, law enforcement, military, organised crime and other scenarios where the consequences of making bad decisions is incredibly high and probably involves some level of violence at a minimum. I always thought that this XKCD comic (https://xkcd.com/538/ https://xkcd.com/538/) summed it up nicely precisely how that factor can actually change your threat model fairly significantly in a way that I don’t generally see turn up in the field of cyber security specifically. But more than that I just generally found that to be an invaluable resource for when it comes to how to think about what actually makes these things work in the real world and what you can actually do in order to really make life very miserable for an adversary long before they even realise what’s going on. It’s probably been the most fun thing I’ve built in 20 years.
- jesprenj 2y agoHow do they detect MS Word docs being opened?
- OptionOfT 2y agoOr the mySQL dump?
- CGamesPlay 2y agoThat one appeared to set a replication host and then uses a canary DNS record to do the triggering. The canary payload is just base64 encoded, so it's not hard to reverse engineer if you spot it.
- mdhb 2y agoI don’t know this for sure, I’m just going from memory from an operation the Dutch pulled off when trying to take down some darknet market places where they used this technique. But basically they would embed a remote image inside the file so it would call out to a web server upon loading the image. It also had the added benefit from a LEO perspective that if the users main defence was running TOR browser that it would bypass that and provide the users true IP address. However, as I mentioned in another comment here, I actually think those particular kinds of honeypots are kind of dumb in that they only catch stupid adversaries. Opening those files on your own machine as an attacker while connected to the net is one of those do not pass go, do not collect $200 go directly to jail moves.
- knallfrosch 2y ago> they only catch stupid adversaries. It's enough to catch one guy, one time. Then you follow his physical or digital traces.
- mdhb 2y agoYeah, I mean like a lot of things in security, it’s better than nothing. But you would have to be very undisciplined or uninformed to get caught by this. There’s even an argument that all you’ve done is tipped your hand to the adversary that deception is at play in this scenario and allow them to adjust their approach accordingly. Not even suggesting that would be a horrible thing to happen, even in that scenario you most likely can at least slow them down but if you never know you’re being targeted in the first place it doesn’t matter too much when that clock starts. The ideal scenario I think you should actually be aiming for here is to craft a situation where you know about them but they don’t know that you know. That’s a window of time where you very clearly have an upper hand. That isn’t actually that hard to create. For example one technique I have at that really early stage is to return a 403 auth error on a web service and set a cookie that looks very natural to its environment but is also very obvious as to how you could change it in order to no longer get a 403 response. The moment I get a request with that new cookie value I instantly know I have something I should be paying attention to and I know it’s a real person not a bot. The adversary however has no idea yet what’s going on, they just think they hit a gold mine.
- pjot 2y agoI’ve used this to see if my employer was spying on my email. They were.
- ActionHank 2y agoProtip, they all are, always, every time, especially if they say they aren't, because they can.
- vntok 2y agoNot because they can, because they must . At least they must in most jurisdictions of most countries, except when the mail's subject is clearly labelled "PERSONAL" or there's some sort of automated classification in place. If someone receives an email coming from your employer's domain with a virus or a child porn video attached, your employer had better be able to identify the sender account through logs & audit trails.
- ActionHank 2y agoIf a corporation has the technology and the legal room to do so they will, even if not required to. It’s just too much potential leverage and supporting material in case of some sort of litigation.
- omh 2y agoSpying how? If you embed a URL in emails then a lot of corporate email gateways will blindly follow the link, trying to check it for malware. This may or may not be a useful security measure but it has many issues. One of which is that it could look like spying.
- Alifatisk 2y agoAre you certain it wasn’t just some gateway that followed the url in the email to give a preview or check for malware?
- pjot 2y ago
- Tiberium 2y agoShould be mentioned that this is not a bullet-proof solution (obviously), for some services the canary tokens can be bypassed, see e.g. https://trufflesecurity.com/blog/canaries https://trufflesecurity.com/blog/canaries ("TruffleHog Now Detects AWS Canaries without setting them off")
- playingalong 2y agoBut these are some lame canary tokens then. One could generate real AWS API keys with no actual permissions.
- tptacek 2y agoCanaryTokens AWS tokens are real AWS creds, last time I checked.
- legobeet 2y agoThe next step is to actually use underprivileged canary tokens on the client for your day-to-day work, intercept them with a proxy, and replace them with the real deal in a more isolated setting. For example, an application-specific HTTP proxy for your GITHUB_TOKEN. You can use a canary token for the internal user-facing auth. https://github.com/legobeat/git-auth-proxy https://github.com/legobeat/git-auth-proxy [0]. That piece is being used here[1] in order to make it transparent for the user and I intend to add more features there for credentials- and secrets compartmentalization. Been keeping it fairly structured so you could also use it as a reference if you ever do similar stuff and want some inspiration or copypasta for your personal hacking. [0]: Caveat: The proxy repo is a fork and the documentation is still more reflective of the previous owners intentions. I ripped out all the Azure/k8s integrations. [1]: https://github.com/legobeat/l7-devenv/ https://github.com/legobeat/l7-devenv/
- ghshephard 2y agoDon't the "underprivileged canary tokens" then become privileged by virtue of being proxied into more privileged tokens?
- legobeet 2y agoSure, but they are only usable as such if attackers also maintain access to the proxy and stay under the radar. Additionally, the proxy has logging and hooks for monitoring so you can audit and filter usage there. As opposed to something which can be smuggled out and reused offsite. I'm also thinking that by centralizing (still locally) the configuration, we can get better key rotation hygiene habits without needing to compromise on credential granularity . Just like there are security benefits in using a secured HSM instead of a world-readable private-key file stored in your unencrypted home directory, even if, yes, the HSM can be abused by a locally privileged attacker. (I'm definitely not saying I have a silver bullet though, and I don't think one exists. Like any realistic solution, it should be part of a defense-in-depth strategy. Things like hardware keys make for incremental gains, etc)
- ghshephard 2y ago
- aflukasz 2y agoBy the way, simple honeypot on Linux using auditd: just set a rule like `-w /etc/secret-file -p rxwa -k some.tag` and use your mechanism of choice to watch logs/journal for the occurrence of `some.tag` string. `-p rxwa` causes logging of any read, exec, write or attributes change on that file. More in `man auditctl`. Among others, this has a benefit that, in principle, such honeypot triggers immediately and not only after someone decides to try using some actual credentials/data. Obviously needs some work to make this robust (logs monitoring plus alerting), but it's a nice building block worth knowing and, if you care, then you probably already have those additional pieces in place anyway.
- deleted 2y ago[deleted]
- declan_roberts 2y agoI don't understand how they can keep such a feature-rich service free forever?
- compootr 2y agoIt's like Costco's rotisserie chickens, a loss leader. They get your foot in the door, and (particularly techniques) eyeballs looking at ads for their hardware. Looking at their site[0], the minimum you can buy is 2, at a price of $5k total [0]: https://canary.tools/ https://canary.tools/
- shortsunblack 2y agoI wonder whether eBPF allows for increased deception capabilities.