Would your rather observe an eclipse through a pair of new Ray-Bans, or a used Shade 12 welding helmet? Undoubtably the Aviators are more fashionable, but the permanent retinal damage sucks. Fetch the trusty welding helmet. We’ve made a number of security choices when building Canary that have held us in pretty good stead. These choices are interesting in that they don’t involve the purchase of security products, they don’t get lots of discussion in security engineering threads, and they …
Year: 2024
Refreshing Canarytokens.org: a new interface, new functionality, and our security assessment results
Today, we’re excited to announce the launch of the revamped Canarytokens.org, our free Canarytokens service. When you visit the updated site, you’ll notice several key enhancements. First, the user interface has undergone a significant refresh. At Thinkst, we view code as a craft, and this philosophy guided us as we meticulously rebuilt the interface piece by piece. The result is an experience that is not only more intuitive but also more enjoyable to use. Second, we’ve expanded the management functionality …
At Thinkst Canary, we make the world’s easiest to deploy and manage honeypots. The high-level architecture for each customer is a web-based management dashboard (called the Console), plus the honeypots that the customer has deployed into their networks. We run the dashboard, customers run the honeypots. Our Console fleet is thousands of machines at this time, and this blogpost describes how we recently upgraded our fleet without any customer-noticeable downtime. Background: Canary Consoles Customers manage their honeypots, configure alerting, and …
A file share is pretty irresistible to an attacker. Check how Canaries can detect these attacks and alert you to them. …
Any Thinksters who have been in physical or virtual proximity to me over the last year have likely suffered at least one whinge session about “the Glorifier”. The especially fortunate have suffered several. I’m relieved to say that, at long last, the whinges are over. In this post, I’m going to walk through the travails of producing the Glorifier mostly as a cathartic exercise but extracting a few lessons from the experience. Our story is told in seven parts: Let’s …
This post focuses on the most recent DFIR Report, IcedID to Dagon Locker Ransomware in 29 Days. …
We are releasing two new versions of the token which alert you when an attacker is using an AitM attack against one of your sites. …
Recently friend-of-Thinkst (and CTO of NCSC) Ollie Whitehouse tweeted this interesting tidbit: We’re always looking for new types of Canarytokens, so it would be cool if we used this method to create video file Canarytokens. Quick background explainer We build Canaries that act as entire machines, require almost no configuration and boot as various Operating Systems. The logic is that it takes you less than a minute to set it up, and when an attacker lands on your network, they …
You can do complex things with Canaries but you don’t need to. Even basic configurations can catch attackers off guard. …
tl;dr: You can now create breadcrumbs to lure attackers to your Canaries with just a few clicks. Canaries and (their) Discoverability Our thesis with Canary has always been simple: Attackers who land in your infrastructure need to situate themselves and they do this by looking around. They run commands and touch systems that regular users never need to. By being selective about which services Canaries offer we can find the sweet-spot of services that are super-trivial to deploy, super likely …