Introduction This is part 2 in a series of posts on our 2015 BlackHat talk, and covers our Canarytokens work. You’ll be familiar with web bugs, the transparent images which track when someone opens an email. They work by embedding a unique URL in a page’s image tag, and monitoring incoming GET requests. Imagine doing that, but for file reads, database queries, process executions, patterns in log files, Bitcoin transactions or even Linkedin Profile views. Canarytokens does all this and …
Author: haroon meer
tl;dr: If you are looking to 3d-print face-shield frames for emergency services, but have a print-bed thats too small, here is an STL that should allow for the same result (with a modular frame) Download: RSA_FACE_SHIELD_MULTI For convenience, you can 3d-print these clips which seem to work for it too Download: MAKER_CLIPS Longer: Last week we saw a tweet from Lize Hartley that they were printing protective shields and handing them out to emergency services. We 3D-printed these frames for shields …
In our previous post (Are Canaries Secure?) we showed (some of) the steps we’ve taken to harden Canary and limit the blast radius from a potential Canary compromise. Colloquially, that post aimed to answer the question: “are Canaries Secure?” This post aims at another question that pops up periodically: “If I run your Canaries on my network, can you use them to hack me?” This answer is a little more complicated than the first, as there is some nuance. (Because …
What a question. In an industry frequently criticised for confusing security software with secure software, and where security software is ranked poorly against other software segments, it’s no surprise we periodically hear this question when talking to potential customers. We figured we’d write a quick blog post with our thoughts on it. We absolutely love the thought of this question coming up. Far too many people have been far too trusting of security products, which is how we end up …
Last week team Thinkst downed tools again for our bi-annual HackWeek. The rules of HackWeek are straightforward: Make Stuff; Learn; Have fun. We discussed HackWeek briefly last year: Our HackWeek parameters are simple: We down tools on all but the most essential work (primarily anything customer-facing) and instead scope and build something. The project absolutely does not have to be work-related, and people can work individually or in teams. The key deadline is a 10-minute demo on the Friday afternoon. …
I’ve sometimes bumped into people who bemoan their broken company cultures with varying degrees of self-awareness. Around 2007, a then-customer heard we were heading to Vegas to speak at BlackHat and said: You guys are so lucky.. my company won’t let us go to anything like that At the time I bristled. We worked for months on that research, dedicating many nights and burnt family time before we could stand up and talk. For sure our company celebrated those wins, …
SaveMyVid was created during our 2018 HackWeek. It’s goals are simple. I want to be able to tag/submit videos for watching, and then want them reliably stored somewhere (ideally on my iPad) Usage: Once you have an account on savemyvid.net, you are given an email address (like savemyvid+d1cf..@savemyvid.net) and a URL which is your personal podcast (like: http://d1cfc…savemyvid.net/podcast/output.rss) When you see a tweet with a video you want, or come across some video you are interested in, simply forward the …
Two weeks ago we ran the second edition of our internal HackWeek, and it was fantastic. Last year’s event was great fun and produced projects we still use; going into this year’s HackWeek we anticipated a leveling up, and weren’t disappointed. We figured we’d talk a little bit about the week, and discuss some of the “hacks”. Our HackWeek parameters are simple: We downtools on all but the most essential work (primarily anything customer-facing) and instead scope and build something. …
aka: You know it’s supposed to hurt, you just don’t know which kind of hurt is the good kind One of the common problems when people start lifting weights (or doing CrossFit) is that they inadvertently overdo it. Why don’t they stop when it hurts? Because everyone knows it’s supposed to hurt. Hypertrophy is the goal, so the pain is part of the deal… right? Pain, Guaranteed In an old interview on the rise of Twitter, Ev Williams said something …
One of the things that surprise new Canary customers, is that we don’t try particularly hard to keep customers looking at their consoles. (In fact, an early design goal for Canary was to make sure that our users didn’t spend much time using our console at all). We make sure that the console is pretty, and is functional but we aren’t trying to become a customer’s “one pane of glass”. We want the Canaries deployed and then strive to get …