27 ms·
Should be mentioned that this is not a bullet-proof solution (obviously), for some services the canary tokens can be bypassed, see e.g. https://trufflesecurity.
by Tiberium 2y ago
Should be mentioned that this is not a bullet-proof solution (obviously), for some services the canary tokens can be bypassed, see e.g. https://trufflesecurity.com/blog/canaries https://trufflesecurity.com/blog/canaries ("TruffleHog Now Detects AWS Canaries without setting them off")
- playingalong 2y agoBut these are some lame canary tokens then. One could generate real AWS API keys with no actual permissions.
- tptacek 2y agoCanaryTokens AWS tokens are real AWS creds, last time I checked.