Canarytokens: Token Anything, Anywhere

InfoSec superstar (and long-time Canary fan) theGrugq recently mused on twitter about generating alerts when certain binaries are run on your hosts.

We definitely think it has its uses, and we figured it would be worth discussing a quick way to make this happen (using the existing

TL;DR: You can pass arbitrary data to a web-token allowing you to use it as a reliable, generic alerter of sorts.

We often refer to our Web and DNS Canarytokens as our token ‘primitives’. With these two tokens, you can create traps for attackers nearly anywhere, on any system for any kind of scenario. In fact, nearly all of our other token types are built on top of the Web and DNS tokens.

A brief overview of how they work:

Web token

  1. Visit and create a web token with the label “Fake email in the finance folder of Adrian’s inbox”.
  2. The server gives me a unique Canarytoken/link. I place it in the finance folder of Adrian’s inbox.
  3. If an attacker clicks/follows the link, I get an alert.
The association between this unique token URL and my label tells me someone MUST be accessing that fake email in the finance folder in my Inbox.
DNS token
  1. Visit and create a DNS token with a label, describing where I plan to hide it.
  2. The server gives me a unique DNS name.
  3. If an attacker (or software the attacker is using) causes the DNS name to be looked up, I get an alert
The mere act of resolving this DNS hostname causes the alert to trigger.
The lovely thing about tokens is that you can now use those base tokens, to mint heaps of creative alternatives.

Back to theGrugq's Question

There are many cases where you can get the alert you need simply by dropping the Canarytoken natively: a link in an email folder, a link shared in a private zoom chat, a link shared in a private slack channel, etc. In those cases, when an attacker views the link, we get a notification that a link that should never have been seen, has been seen (and the free Canarytoken server will go a little further to then geolocate the attacker, tell you about her browser, etc)

On typical Linux boxes, everything’s a file and the operating system is heavily script-driven. There’s much we can use to our advantage here. It means that in a pinch, we can create and trip our own web token, just to get a reliable, coherent message out.

One advantage of the Web Canarytoken is that web servers expect to receive a User Agent string from web browsers.

We can use this field to smuggle out some data related to the attacker!

Now, since we can use curl, wget or even just bash, we can use this technique in a bunch of places.

We can create users with login-scripts that trip the token and leave their ssh-keys lying around. We could also wrap binaries that are usually run by attackers with a wrapper that first trips the token.

Lets create a simple wrapper for netcat:

Now, an attacker who runs nc, actually runs your script. It looks the same to her, but you’ve received your alert letting you know that bad stuff is afoot:

There are a few ways to use this wrapper. To set the tripwire for a single user, set an alias in .zshrc, .profile, .bashrc or your equivalent.

alias nc='~/.local/bin/'

To set the trap globally on the system, drop a similar alias in /etc/profile, /etc/zshrc or your equivalent. Another alternative would be replacing the in-path binary with a script and/or using symlinks to ensure runs before the nc binary (but beware package updates breaking this approach).

Maybe this server doesn’t have outbound Internet access? No problem - simply swap the curl/wget approach with a DNS lookup command and a DNS token.

Dominic White was also kind enough to code up and donate a wrapper as well. This shows there are many ways to implement this idea. For details on compiling, he has some guidance on that as well.

Why tokens work

Not every dropped token will get tripped, and some tokens may be discovered, but this really isn't a problem. In the real world, an attacker isn’t usually thinking “is this a trap” every step of the way, they’re thinking “this could be the jackpot”. Sooner or later, they tip their hand and announce their presence. (And if they do suspect traps/tripwires, that’s also to your advantage - it’s going to slow them down considerably because now they will second-guess everything).

Even if a dropped Canarytoken isn’t a perfect match for the environment, an attacker's M.O. forces them to follow the lead.

Any red-teamer/attacker will tell you that successful breaches are usually a death by a thousand cuts. You find a file on one machine that points to a new network. You find credentials on that network that give you access to a jump box. If I find an AWS-API key on your machine, I will never be able to ignore it saying: “I don't think they run any AWS infrastructure”. Instead, it's much more likely I've stumbled on someone's skunkworks, and chances are it's ripe for the taking.

It doesn’t matter if an Excel document named 20200504_daily_settlement.xlsx is discovered on a Linux server instead of a Windows server. A criminal on the hunt for payment data to steal has to open it.

Token anything, anywhere. Embed tokens multiple layers deep. Make attackers question their sanity and their desire to continue the attack.

3D-Printed Emergency Services Face Shields

tl;dr: If you are looking to 3d-print face-shield frames for emergency services, but have a print-bed thats too small, here is an STL that should allow for the same result (with a modular frame)

For convenience, you can 3d-print these clips which seem to work for it too


Last week we saw a tweet from Lize Hartley that they were printing protective shields and handing them out to emergency services.

This seemed like an easy way for us to get involved and 4 of the folks from thinkst started following links and printing shields.

(Design by russiank)

One quick PR that makes this worth sharing is the modification to the original design to allow the shield to be printed on smaller print-beds.

If i run your software, can you hack me?

In our previous post (Are Canaries Secure?) we showed (some of) the steps we’ve taken to harden Canary and limit the blast radius from a potential Canary compromise. Colloquially, that post aimed to answer the question: “are Canaries Secure?”

This post aims at another question that pops up periodically: “If I run your Canaries on my network, can you use them to hack me?”

This answer is a little more complicated than the first, as there is some nuance. (Because my brutally honest answer is: “yeah… probably”.)

But this isn’t because Canary gives us special access, it’s true because most of your other vendors can too.If you run software  with an auto update facility (and face it, it’s the gold standard for updates these days), then the main thing stopping that vendor from using that software to gain a foothold on your network is a combination of that vendor's imagination, ethics, or discomfort with the size of jail cells. It may not be a comfortable fact, but fact remains true with no apparent appreciation for our comfort levels.

Over a decade ago we gave two talks on tunneling data in and out of networks through all sorts of weird channels (the pinnacle was a remote timing-based SQL injection to carry TCP packets to internal RDP machines). [“It’s all about the timing”, “Pushing the Camel through the Eye of the Needle”] 

The point is that with a tiny foothold we could expand pretty ridiculously. Sending actual code down to my software that’s already running inside an organization is like shooting fish in a barrel. This doesn’t just affect appliances or devices on your network, it extends to any software.

Consider VLC, the popular video player. Let’s assume it’s installed on your typical corporate desktop. Even if you reversed the hell out of the software to be reasonably sure that the posted binaries aren’t backdoored (which you didn’t), you have no idea what last night’s auto-update brought down with it. 

You don’t allow auto-updates? Congratulations, you now have hundreds of vulnerable video players waiting to be exploited by a random video of cats playing pianos. 

This ignores the fact that even if the video player doesn't download malicious code, it's always a possibility that it simply downloads vulnerable code, which then allows the software to exploit itself.

It’s turtles all the way down.

So what does this mean? Fundamentally it means that if you run software from a 3rd party vendor which accepts auto-updates (and you do) you are accepting the fact that this 3rd party vendor (or anyone who compromises them) probably can pivot from the internet to a position on your network.

Chrome has successfully popularised the concept of silent auto-updates and it’s a good thing, but it’s worth keeping in mind what we give up in exchange for the convenience. (NB. We’re not arguing against auto-updates at all; in fact we think you’d be remiss not enabling them). 
You can mitigate this in general by disabling updates, but that opens you up to a new class of problems with a only handful of solutions:
  • A new model of computation – You could mitigate this by moving to chromebooks or really limited end-user devices. But remember, no third party Chrome apps or extensions, or you fall into the same trap.
  • You can be more circumspect about whose software you run. Ultimately the threat of legal action is what provides the boundaries for contracts and business relationships, which goes a long way in building trust in third parties. If you have a mechanism to recover damages from or lay charges against a vendor for harmful actions, you’ll be more likely to give their software a try. But this still ignores the risk of a vendor being compromised by an unrelated attacker.
  • You can hope to detect when the software you don’t trust does something you don't expect.
For the second solution, software purchasers can demand explanations from their vendors for how code enters the update pipeline, and how its integrity is maintained. We’ve discussed our approach in a previous post. (It’s also why we believe that customers should be more demanding of their vendors!)

The last solution is interesting. We’re  obviously huge fans of detection and previous posts even mention how we detect if our Consoles start behaving unusually. On corporate networks, where the malicious software could be your office phones or your monitors or the lightbulbs, pretty much your only hope is having some way of telling when your kettle is poking around the network.

Ages ago, Marcus Ranum, suggested that a quick diagnostic when inheriting a network would be to implement internal network chokepoints (and to then investigate connections that get choked). We (obviously) think that dropping Canaries are a quick, painless way to achieve the same thing.

It's trite, but still true. Until there are fundamental changes to our methods of computation, our only hope is to “trust, but verify” and on that note, we try hard to be part of the solution instead of the problem.

Are Canaries Secure?

What a question. In an industry frequently criticised for confusing security software with secure software, and where security software is ranked poorly against other software segments, it's no surprise we periodically hear this question when talking to potential customers. We figured we'd write a quick blog post with our thoughts on it.

We absolutely love the thought of this question coming up. Far too many people have been far too trusting of security products, which is how we end up with products so insecure that FX said you'd be "better off defending your networks with Microsoft Word".

In fact, it's one of the things we actively pushed for in our 2019 talk on "the Products we Deserve":

So, how do we think about security when building Canary?

Most of our founding team have a long history in offense and we've worked really hard to avoid building the devices we've taken advantage of for years. From base architectural choices, to individual feature implementations, defensive thinking has been baked into Canary at multiple layers.

We're acutely aware that customers are trusting our code in their networks. We go to great lengths to ensure that a Canary does not introduce additional risk to our customers. The obvious solution here is to make it "more secure" (i.e. that it's a harder target to compromise than other hosts on the network). But that's not sufficient, a harder target is not an impossible target given enough time.

So the second part of "not introducing additional risk" is to ensure that there's nothing of value on the Canaries themselves that attackers might want.

tl;dr: Canaries should be harder to compromise than other targets and should leave an attacker no better off for compromising them.

What follows are some examples of our thinking. We've left out some bits (where prudent), but we (strongly) feel that customers should be asking vendors how they reduce their threat profile, and figure we should demonstrate it ourselves.


All the important services on the Canary are written in memory safe languages and are then sandboxed. The Canary itself holds no secrets of importance to your network. Choosing memory safe languages has a performance tradeoff, and one we're happy to make. With that architectural decision, the only potential memory corruption bugs are in the underlying interpreter, which is well-tested (and harder to reach) at this point.

Network spanning

We also don't allow Canaries to be dual-homed or span VLANs. That's because it would violate the principle of not having anything valued by an attacker on the Canaries. Compromising a dual-homed Canary would allow an attacker to jump across networks, and we won't let this happen on our watch.

Cryptographic underpinnings

During their initial setup, Canaries create and exchange crypto keys with your console. From that point on, all communication between the Canary and your console is encrypted using these keys.

The underlying symmetric encryption library used is NaCl, which provides the Salsa20 stream cipher for encryption and Poly1305 MAC for authentication. Again, we could have chosen slightly more space-efficient cryptographic constructs, but we followed the best practice of selecting a cryptographic library which doesn't permit choices and removes all footguns.


Our birds are remotely updated to make sure they stay current, and that's a common subject of questions from potential customers. To maintain the integrity of our updates, your Canary will only accept an update that's been signed by our offline signing infrastructure. Furthermore, each update file is further signed (and encrypted) by your Console so your bird won't accept an update from another Console (even if it's a legitimate one). Lastly, the update is delivered via our custom DNS transport overlay which is also encrypted. An attacker wishing to push code to your Canary would need to compromise both your cloud Console, as well as the physical offline update-signing infrastructure.

Console monitoring

Your Console is a dedicated instance running on EC2. This simple architectural decision means that even if one customer-console was breached, there's no other customer data present. This single-tenant model also removes the risk of web-app bugs yielding data from other customers.

Aside from the usual hardening, we've taken other steps to further minimise "surprises". All syscalls across our fleet are monitored, and any server doing anything "new" quickly raises alarms. (We also make sure that the server only serves content we've expressly permitted).

By default, your Console won't hold any special data from your network. Alerts come through with information related only to a detected attack, and even though we support masking in the alert to make sure that you wont have an attacker supplied password lying in your inbox, its probably a good idea to cycle a password that an attacker has made use of. :)

(Password "masked" in email alert)

Customer-Support access

On the back-end, selected Thinkst staff need to jump through several hoops and jump-points before gaining access to your console. At every jump, they are required to MFA, and access is both logged and generates an alert. (Once more this means that such access can't happen under the radar).

(CS access to a Canary Console)
In addition to this, some customers request that no Thinkst staff access their console. These customers have the back end authentication/MFA link broken. The means that Thinkst staff will not be able to authenticate to the customer console at all.

Third-party assessments

We've also had a crystal-box assessment performed of both the Canaries and the Console by one of the leading app-sec teams in the business. A copy of their report is available on request, but their pertinent, summarising snippet is:

"The device platform and its software stack (outside of the base OS) has been designed and implemented by a team at Thinkst with a history in code product assessments and penetration testing (a worthy opponent one might argue), and this shows in the positive results from our evaluation.
Overall, Thinkst have done a good job and shown they are invested in producing not only a security product but also a secure product."

Wrapping up

So, is Canary an impossible target? Of course not, it's why we wrote "safer designs" above, not "safe designs". 

But we have put a lot of thought into making sure we don't introduce vulnerabilities to a customer network. We've put tons of effort into making sure that we limit the blast radius of any problem that does show up. And if a bird can get off just one warning before it's owned, it's totally lived up to its namesake and earned its keep...