Mastodawn

Hi @RyanB
Yes, I created it.
The potted history....I brought up a subdomain and saw hits after 5 seconds. "This can't be right," I said to myself. Thank you, certificate transparency.
And then they scraped.
I countered with robots.txt
They ignored it 😂
So I examined what they were trying to get and designed a way to fulfil their requests. Fake tokens, dodgy ZIPs, #CanaryTokens
And that's how the thing was born, now I polish it up.

The goal? Synthesise delays, synthesise content. Waste hacker time.

I think I like it too 👍

Claus Cramon Houmann Oct 24, 2024

And as the final presenter before lunch on day 3, @Jacob is now on stage talking about protecting against #AiTM attacks at scale with #canarytokens - at @hack_lu !!

#hacklu2024

Jonas Lejon Aug 20, 2024

Brittiska cybersäkerhetscentret NCSC satsar på bl.a. honeypots i en ny stor satsning. Läs mer på bloggen: https://kryptera.se/storbritannien-satsar-pa-honeypots/

#CyberSecurity #NCSC #Honeypots #Honeytokens #Breadcrumbs #CloudSecurity #CyberDefense #ThreatDetection #UKCyberSecurity #IPv4 #IPv6 #Infosec #CyberAwareness #SecurityTokens #NationalSecurity #CyberStrategy #DigitalDefense #Cybersäkerhet #CyberThreats #CanaryTokens #itsakerhet

Gonçalo Valério Feb 8, 2024

"Defending against the Attack of the Clone[d website]s!"

https://blog.thinkst.com/2024/01/defending-against-the-attack-of-the-cloned-websites.html

#security #websites #webdev #canarytokens

Defending against the Attack of the Clone[d website]s!

Thinkst Thoughts

HcInfosec Nov 11, 2023

Can somebody point out what I am obviously missing?
In this guide on #canarytokens

https://docs.canarytokens.org/guide/dns-token.html#encoding-additional-information-in-your-token
it is explained howto make a dns token. Fine, I get how a resolution of a dns something produces a warning.

But then they state: leave in_bash-history or ssh/config or servers.txt

But how do you adding such a token in your bash history lead to a tripwire?
Should you than add something like
ssh root@tokenurl or something?

and than hope the hacker tries this? Or what would you do?
#blueteam
#infosec

DNS Token | Canarytokens

Official docs for Canarytokens

ITSEC News Aug 23, 2023

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders. - In large metropolitan areas, tourists are often easy to spot because they’re far m... https://krebsonsecurity.com/2023/08/tourists-give-themselves-away-by-looking-up-so-do-most-network-intruders/ #thecomingstorm #securitytools #canarytokens #hazelburton #shubhamshah #ransomware #ciscotalos #haroonmeer #assetnote #thinkst

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders. – Krebs on Security

KrebsOnSecurity RSS Aug 22, 2023

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders.

https://krebsonsecurity.com/2023/08/tourists-give-themselves-away-by-looking-up-so-do-most-network-intruders/

#TheComingStorm #SecurityTools #CanaryTokens #HazelBurton #ShubhamShah #Ransomware #CiscoTalos #HaroonMeer #Assetnote #Thinkst

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders. – Krebs on Security

dispatch Aug 22, 2023

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders. https://krebsonsecurity.com/2023/08/tourists-give-themselves-away-by-looking-up-so-do-most-network-intruders/ #TheComingStorm #SecurityTools #CanaryTokens #HazelBurton #ShubhamShah #Ransomware #CiscoTalos #HaroonMeer #Assetnote #Thinkst

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders. – Krebs on Security

Jacob Torrey Feb 13, 2023

Excited to see the open-source canarytokens.org offering #Azure #CanaryTokens! One more type of sensitive data that attackers now need to worry about using: https://blog.thinkst.com/2023/02/canarytokens-org-welcomes-azure-login-certificate-token.html

Know. Before it matters

Canarytokens is a free tool that helps you discover you’ve been breached by having attackers announce themselves. The tokens allow you to implant traps around your network and notifies you as soon as they are triggered.

Canarytokens

tiernano Jan 22, 2023

Day 19 of #100daysofhomelab and not done a lot today, so its mostly links…

---

This site is hosted on my own ASN on AS204994. More details about that over there. I also use Vultr for transit services and HostUs for LIR Services. Check them out. You can also check some of the gear I use on a daily basis over on kit.co/tiernano.

https://www.tiernanotoole.ie/2023/01/22/day-19-of-100daysofhomelab.html

100 Days of HomeLab

#100DaysOfHomeLab - A HomeLab Challenge