Blog Posts

Alerts Come in Many Flavours

‪If you force people to jump through hoops to handle alerts, they’ll soon stop doing it 🤯‬ ‪Canary optimizes for fewer alerts but we also ensure that you can handle alerts easily without us.‬ ‪So it takes just 4 minutes to setup a Canary but far less to pull our alerts into Slack‬. By default, your console will send you alerts via email or SMS, but there are a few other tricks up its sleeve. It is trivial to also

Continue Reading

I'm Running Canaries, but…

…what if someone finds out? Do attackers care if there are canaries in my network? People wonder if they need to hide the defensive tech used on their networks. Like all interesting dilemmas, the answer is nuanced. In defense of obscurity In any discussion about obscurity you will almost certainly have someone shout about “security through obscurity” being bad. As a security strategy, obscurity is a terrible plan. As an opportunity to slow down or confuse attackers, it’s an easy

Continue Reading

Introducing Rapsheet

We’ve got hundreds of servers and thousands of Canaries deployed in the world. Keeping them healthy is a large part of what we do, and why customers sign up for Canary. Monitoring plays a big role in supporting our flocks and keeping the infrastructure humming along. A pretty common sight in operations are dashboards covered with graphs, charts, widgets, and gizmos, all designed to give you insight into the status of your systems. We are generally against doing things “just

Continue Reading

Introducing the Office 365 Mail Token

Shared passwords, sensitive documents: mailboxes are great targets for attackers. Would you know they were targeted? We’ve got your back! Our Office 365 token deploys to thousands of mailboxes in minutes and alerts you when someone is snooping around. Why an Office 365 Mail token? Enterprises have been flocking (ha) to Office 365 for years now and a large number of Thinkst customers are using it. The Canaries will detect attackers on their networks, but nothing lets them know if

Continue Reading

USENIX Security Symposium 2019

Thinkst in Santa Clara Last week Haroon and I found ourselves at the 28th USENIX Security Symposium in balmy Santa Clara. We made the trip from Vegas for Haroon’s invited talk at the main event, and I took the opportunity to present at one of the side workshops (HotSec). This is a short recap of our USENEX experience. Neither Haroon nor I have attended USENIX events previously, despite over 20 Black Hat USAs between the two of us. What’s worse, we

Continue Reading

One Month with Thinkst

Recently, I was faced with a career dilemma. Go back to the enterprise and be a CISO Take a gig that would be part research, part bizdev A research and writing gig Consulting/Advisory work Join another vendor SPOILER: I chose the last one… but why? Why Thinkst? Thinkst Applied Research is the company behind the popular Canary product. Though they started off as more of a research firm that would build various products, the Canary product took off and has

Continue Reading

When document.domain is not equal to document.domain

Background One of our most popular Canarytokens is one we call the “Cloned-Site Token”. Essentially, we give you a tiny piece of JavaScript to add to your public webpage. If this JS is ever loaded on a server that doesn’t belong to you, it fires an alert. You can be alerted at an email address or webhook in the free version, or to your SIEM, slack channel or a bunch of other alternatives in the paid version. The Cloned-Site Token

Continue Reading

Developing a full stack… of Skyballs

We like solving problems. Sometimes, we make up new ones so we can solve them. Skyball Pyramids are one such case! Last year we discovered these amazing Skyballs and decided to make them a regular feature at our conference booths.  Canary Skyballs They have just the right amount of heft and weight to make them genuinely fun to play with. Of course, this leaves us with the devilish problem of how to display them… At Infosec Europe 2018, some of

Continue Reading

When you can’t do awesome things, because of crushing bureaucracy

I’ve sometimes bumped into people who bemoan their broken company cultures with varying degrees of self-awareness. Around 2007, a then-customer heard we were heading to Vegas to speak at BlackHat and said: You guys are so lucky.. my company won’t let us go to anything like that At the time I bristled. We worked for months on that research, dedicating many nights and burnt family time before we could stand up and talk. For sure our company celebrated those wins,

Continue Reading

Save My Vid

SaveMyVid was created during our 2018 HackWeek. It’s goals are simple. I want to be able to tag/submit videos for watching, and then want them reliably stored somewhere (ideally on my iPad) Usage: Once you have an account on savemyvid.net, you are given an email address (like savemyvid+d1cf..@savemyvid.net) and a URL which is your personal podcast (like: http://d1cfc…savemyvid.net/podcast/output.rss) When you see a tweet with a video you want, or come across some video you are interested in, simply forward the

Continue Reading

Site Footer

Authored with 💚 by Thinkst