Thinkst Blog

InfoSec superstar (and long-time Canary fan ) theGrugq recently mused on twitter about generating alerts when certain binaries are run on your hosts. We definitely think it has its uses, and we figured it would be worth discussing a quick way to make this happen (using the existing http://canarytokens.org ) TL;DR : You can pass arbitrary data to a web-token allowing you to use it as a reliable, generic alerter of sorts. We often refer to our Web and DNS Canarytokens as our token ‘primitives’. With these two tokens, you can create traps for attackers nearly anywhere, on any system for any kind of scenario. In fact, nearly all of our other token types are built on top of the Web and DNS tokens. A brief overview of how they work: Web token Visit http://canarytokens.org and create a web token with the label “Fake email in the finance folder of Adrian’s inbox”. The server gives me a unique Canarytoken/link. I place it in the finance folder of Adrian’s inbox. If an attacker clicks/follows ...

tl;dr: If you are looking to 3d-print face-shield frames for emergency services, but have a print-bed thats too small, here is an STL that should allow for the same result (with a modular frame) Download: RSA_FACE_SHIELD_MULTI For convenience, you can 3d-print these clips which seem to work for it too Download: MAKER_CLIPS Longer: Last week we saw a tweet from  Lize Hartley that they were printing protective shields and handing them out to emergency services. We 3D-printed these frames for shields for our staff who need to work during lockdown (we were identified as essential services) and will be printing for healthcare workers next. See post attached if you are able to help. pic.twitter.com/cWCIlxWVfT — Lize Hartley (@lizetheunicorn) March 28, 2020 This seemed like an easy way for us to get involved and 4 of the folks from thinkst started following links and printing shields. ( Design  by  russiank ) One quick PR that makes this worth sharing is the modification to th...

In our previous post ( Are Canaries Secure? ) we showed (some of) the steps we’ve taken to harden Canary and limit the blast radius from a potential Canary compromise. Colloquially, that post aimed to answer the question: “are Canaries Secure?” This post aims at another question that pops up periodically: “If I run your Canaries on my network, can you use them to hack me?” This answer is a little more complicated than the first, as there is some nuance. (Because my brutally honest answer is: “yeah… probably”.) But this isn’t because Canary gives us special access, it’s true because most of your other vendors can too.If you run software  with an auto update facility (and face it, it’s the gold standard for updates these days), then the main thing stopping that vendor from using that software to gain a foothold on your network is a combination of that vendor's imagination, ethics, or discomfort with the size of jail cells. It may not be a comfortable fact, but fact remains true with ...

What a question. In an industry frequently criticised for confusing security software with secure software , and where security software is ranked poorly against other software segments , it's no surprise we periodically hear this question when talking to potential customers. We figured we'd write a quick blog post with our thoughts on it. We absolutely love the thought of this question coming up. Far too many people have been far too trusting of security products, which is how we end up with products so insecure that FX said you'd be " better off defending your networks with Microsoft Word ". In fact, it's one of the things we actively pushed for in our 2019 talk on " the Products we Deserve ": ( The Products we deserve ) So, how do we think about security when building Canary? Most of our founding team have a long history in offense and we've worked really hard to avoid building the devices we've taken advantage of for years. From base arc...

Last week team Thinkst downed tools again for our bi-annual HackWeek. The rules of HackWeek are straightforward: Make Stuff; Learn; Have fun. We discussed HackWeek briefly last year : Our HackWeek parameters are simple: We down tools on all but the most essential work (primarily anything customer-facing) and instead scope and build something. The project absolutely does not have to be work-related, and people can work individually or in teams. The key deadline is a 10-minute demo on the Friday afternoon. The demos are in front of the rest of the team, and results count more than intentions. We pride ourselves on being a "learning organization" and HackWeek is one of the things that help make that happen. It's always awesome seeing a software-developer solder their first board or seeing someone non-technical write their first lines of python. Project highlights this year:  Az used the SimH simulator  to run an obscure Soviet Mainframe (the BESM-6 ): Eventually, he had the ...

Canaries and Canarytokens are tripwires that can alert you to intrusions. When alerts trigger, we want to make sure you get them where you need them. While our Slack integration is cool , you might prefer to send alerts through your SIEM. Or to a security automation tool. Maybe you want to leverage our API to integrate Canary alerts into a custom SOC tool. Want to turn a smart light bulb red and play the Imperial March ? You could do that too. Your way or the highway We often puzzle at products that require customers to totally revamp how they do things. We never presume to be the most important tool in your toolbox, which is why our product is designed to be installed, configured, and (somewhat) forgotten, in minutes. We’d rather disappear into your existing workflow, only becoming visible again when you need us most. Our customers dictate where and how they see our alerts. To enable this, we provide a wide variety of flexible options for sending and consuming alerts. By default, you’...

‪If you force people to jump through hoops to handle alerts, they’ll soon stop doing it 🤯‬ ‪Canary optimizes for fewer alerts but we also ensure that you can handle alerts easily without us.‬ ‪So it takes just 4 minutes to setup a Canary but far less to pull our alerts into Slack‬. By default, your console will send you alerts via email or SMS, but there are a few other tricks up its sleeve. It is trivial to also get alerts via webhooks, syslog or our API. This post will show you how to get alerts into your Slack. The process is similar for Microsoft Teams and other messaging apps that use webhooks for integration. It’s quick, painless and super useful. ( This post is unfortunately now also bound to be anti-climactic - it’s going to take you longer to read this than to do the integration ). Did you know how easy this can be? The Canary Console can integrate with Microsoft Teams and Slack in seconds and with a few more steps, can integrate with any other webhook-friendly platform. The ...