SE-Radio Episode 302: Haroon Meer on Network Security

Canary Tools

Canary tools are innovative security measures designed to detect breaches by enticing attackers to interact with decoy systems. Haroon Meer explains that these tools, inspired by traditional honeypots, are easy to deploy and alert users when touched by unauthorized individuals 1. They include canary honeypots and canary tokens, which can be set up in minutes and provide high-fidelity alerts. Meer notes, "The whole idea with canary tokens, much like canaries, is a deploy in minutes or seconds, but a high fidelity message that tells you that bad stuff is happening on your network."

The whole idea with canary tokens, much like canaries, is a deploy in minutes or seconds, but a high fidelity message that tells you that bad stuff is happening on your network.

--- Haroon Meer

These tokens can be embedded in various digital formats, such as URLs or documents, and alert the user when accessed, indicating potential unauthorized activity 2.

   

Applications

The practical applications of canary tools extend to providing early warnings of potential breaches, which are crucial in avoiding prolonged undetected compromises. Meer illustrates how these tools can be used to monitor sensitive data by placing canary tokens in strategic locations, such as Dropbox folders or spare laptops 3. When these tokens are accessed, they send alerts with details like IP addresses, offering a proactive approach to security. Meer shares, "What you're looking for is that early warning. So you not in that 300 day club."

What you're looking for is that early warning. So you not in that 300 day club.

--- Haroon Meer

Additionally, the concept of tokenization is being explored further, with ideas like progressively tokening binaries to detect reverse engineering attempts, showcasing the evolving nature of these security measures 4.