We’ve just released an update that allows VMWare birds to be pre-configured. This allows customers to deploy them trivially at scale. Our KB article explains how to make use of it, but this post goes deeper under the hood to explore how we made it happen. Automatically Configuring Linux VMs The de facto standard for configuring or customising Cloud virtual machines (e.g. at AWS, GCP, Azure, etc) is cloud-init. Cloud-init works by reading configuration data from datasources outside the VM, …
Blog Posts
Every August, 1000s of people from all over the world consciously decide to brave the balmy 40C/100F+ desert to learn, share, and socialize at the trifecta of Hacker conferences. Whereas Black Hat and DEF CON attendees have been making the sojourn for decades, 2024 marks the 13th year since BSides Las Vegas was added to the mix, lovingly referred to as the “Hacker Summer Camp”. With such a overwhelming buffet of content, we thought it might help to share the …
We’ve previously discussed how Canarytokens can detect when your website has been cloned and used in phishing campaigns. We also released an Azure Entra ID Login token that can be used to detect this activity on your tenant’s Entra ID Login page. Today, we’re taking that concept a step further by introducing an automated response pipeline that detects phishing attempts, correlates which of your users fell victim to the attack and takes immediate action to minimise the impact of the …
Why we use isolated VMs as a hard security boundary. …
Refreshing Canarytokens.org: a new interface, new functionality, and our security assessment results
Today, we’re excited to announce the launch of the revamped Canarytokens.org, our free Canarytokens service. When you visit the updated site, you’ll notice several key enhancements. First, the user interface has undergone a significant refresh. At Thinkst, we view code as a craft, and this philosophy guided us as we meticulously rebuilt the interface piece by piece. The result is an experience that is not only more intuitive but also more enjoyable to use. Second, we’ve expanded the management functionality …
At Thinkst Canary, we make the world’s easiest to deploy and manage honeypots. The high-level architecture for each customer is a web-based management dashboard (called the Console), plus the honeypots that the customer has deployed into their networks. We run the dashboard, customers run the honeypots. Our Console fleet is thousands of machines at this time, and this blogpost describes how we recently upgraded our fleet without any customer-noticeable downtime. Background: Canary Consoles Customers manage their honeypots, configure alerting, and …
A file share is pretty irresistible to an attacker. Check how Canaries can detect these attacks and alert you to them. …
Any Thinksters who have been in physical or virtual proximity to me over the last year have likely suffered at least one whinge session about “the Glorifier”. The especially fortunate have suffered several. I’m relieved to say that, at long last, the whinges are over. In this post, I’m going to walk through the travails of producing the Glorifier mostly as a cathartic exercise but extracting a few lessons from the experience. Our story is told in seven parts: Let’s …
This post focuses on the most recent DFIR Report, IcedID to Dagon Locker Ransomware in 29 Days. …
We are releasing two new versions of the token which alert you when an attacker is using an AitM attack against one of your sites. …