1
00:00:13,880 --> 00:00:14,960
Hello, everyone.

2
00:00:14,960 --> 00:00:15,900
Welcome back.

3
00:00:15,900 --> 00:00:22,580
My name is Rubix1138, and I welcome you to the Thinkist Canary workshop.

4
00:00:22,580 --> 00:00:36,020
If you have not already joined us in the Discord chat, please go to blueteamvillage.org and click on DEF CON 28 and join us in the Discord.

5
00:00:36,040 --> 00:00:45,840
The text chat while we go through this presentation will be in the Texts Workshops Track 1 under Flamingo Hotel.

6
00:00:45,840 --> 00:00:52,560
Just scroll all the way down, go to Texts Workshops Track 1, and you can post your questions there.

7
00:00:52,560 --> 00:00:58,020
I'd like to welcome Adrian and Bradley from Thinkist.

8
00:00:58,020 --> 00:00:59,480
Go ahead, guys, take it away.

9
00:00:59,480 --> 00:01:00,460
Thank you.

10
00:01:02,000 --> 00:01:04,640
Hello, and thank you very much for that.

11
00:01:04,640 --> 00:01:06,320
That was a kind intro.

12
00:01:08,280 --> 00:01:11,420
And we are very excited to be here.

13
00:01:12,740 --> 00:01:30,460
And we're going to talk a little bit about how Canaries and Canary Tokens are now going to be integrated into OpenSOC and give you a little bit of context and background on them so you can understand how to use them when going through OpenSOC.

14
00:01:31,780 --> 00:01:34,480
So again, big, big thanks to OpenSOC.

15
00:01:34,600 --> 00:01:42,140
Really excited to be part of it and really glad that, you know, they thought to include us in this.

16
00:01:45,610 --> 00:01:50,310
All right, so what we're going to do first is just go through some slides real quick here.

17
00:01:50,310 --> 00:01:52,650
We'll go through some live demos as well.

18
00:01:52,970 --> 00:01:58,890
A lot of what you're going to see is kind of a mix of the commercial product and the free product.

19
00:01:58,890 --> 00:02:02,370
Really, the free stuff we have out there worked the same way.

20
00:02:02,410 --> 00:02:06,730
Same principles, same data you get in the alerts.

21
00:02:07,610 --> 00:02:14,210
Just for convenience and time sake, you know, you might see a little bit of the commercial product here.

22
00:02:14,910 --> 00:02:25,070
So some of our goals when we designed Canary and Canary Tokens was, you know, a tool that gets deployed and gets used is useful.

23
00:02:25,070 --> 00:02:30,250
So a lot of work went into making them super easy and simple to use.

24
00:02:30,730 --> 00:02:33,250
They take minutes to set up and deploy.

25
00:02:33,670 --> 00:02:38,190
So a lot of work goes into making them super easy to do that.

26
00:02:38,470 --> 00:02:41,010
And little to no maintenance, you know.

27
00:02:41,010 --> 00:02:45,410
So again, you know, for a tool to be useful, it has to function, you know.

28
00:02:45,410 --> 00:02:53,990
So any kind of maintenance, you know, we try and make non-existent or, you know, we can do it automatically for you in the background.

29
00:02:53,990 --> 00:03:05,890
Even a free tool, most of that you can just generate Canary Tokens, deploy them, forget them, deploy open Canary and pretty much forget about it until it sends you alerts.

30
00:03:07,710 --> 00:03:15,230
So yeah, and those alerts, that's a big goal also is, you know, how can we get this as close to zero false positives as possible?

31
00:03:16,490 --> 00:03:21,770
And ultimately, you know, the goal here is to know when it matters.

32
00:03:21,770 --> 00:03:27,830
To know when an attacker's in your environment as soon as possible, when it matters to know that.

33
00:03:30,980 --> 00:03:38,560
All right, so as I mentioned, our open source and free products here, open Canary is available.

34
00:03:38,560 --> 00:03:39,780
It's well documented.

35
00:03:39,780 --> 00:03:41,340
You can grab it from GitHub.

36
00:03:41,760 --> 00:03:47,420
I think the Docker container has been downloaded tens of thousands of times.

37
00:03:47,420 --> 00:03:50,260
So we know it's getting a lot of use out there.

38
00:03:50,580 --> 00:04:01,320
You know, the package has been installed and you can run your own Canary token server as well with a Docker container or you can use canarytokens.org.

39
00:04:02,100 --> 00:04:06,020
I think we have over 100,000 people using canarytokens.org.

40
00:04:06,020 --> 00:04:08,040
You don't even need to create an account to use it.

41
00:04:08,040 --> 00:04:18,440
You can just go there right now and start creating tokens and distributing them throughout your personal devices, you know, your production environment, wherever you want to use them.

42
00:04:18,440 --> 00:04:19,840
People use them all over.

43
00:04:21,920 --> 00:04:31,720
All right, so talking about the context a little bit here, what are these and why would you use them in a Blue Team environment or Open Sock?

44
00:04:33,060 --> 00:04:37,800
So the goal here is to let you know as soon as the attacker gets in the environment.

45
00:04:38,080 --> 00:04:44,000
So, you know, over the last couple of decades, dwell time is really long.

46
00:04:44,000 --> 00:04:49,140
Attackers are in environments way too long and they just, they go on undetected.

47
00:04:49,140 --> 00:05:00,460
And that's a problem we set out to solve here is, you know, what if we could get that dwell time down to minutes to when you at least know that there's something suspicious going on inside the environment.

48
00:05:00,460 --> 00:05:09,820
So that's the goal here is the attacker's already in the environment and doing suspicious things and that's what we alert on.

49
00:05:11,180 --> 00:05:14,040
So that's important context to understand.

50
00:05:15,340 --> 00:05:17,020
And how do we do that?

51
00:05:17,180 --> 00:05:25,940
So I've got a quick diagram here just to show you simply what we leverage to make our product work here, to make it win.

52
00:05:26,760 --> 00:05:31,240
And when an attacker gets in, they don't know where anything is in your environment.

53
00:05:31,240 --> 00:05:39,320
They don't, you know, unless they land on a Visio diagram, on a highly detailed Visio diagram, the moment they get in, they're going to have to explore the network.

54
00:05:39,320 --> 00:05:42,940
They're going to have to look around for what they're hoping to find.

55
00:05:45,760 --> 00:06:06,540
And if you drop in these canaries, which are honeypots, which can look like anything else in your network, anything from Windows Server 2016 to a Linux server, you know, the idea is it looks like a normal server, but there's no real reason anybody should be touching it or using it.

56
00:06:06,780 --> 00:06:13,000
So the attacker comes in, does that same exploration, and they start setting off alerts.

57
00:06:15,700 --> 00:06:22,780
And furthermore, when you take canary tokens, you can set traps throughout even more of the environment.

58
00:06:22,780 --> 00:06:31,380
You can make it even more tricky and difficult for the attacker to explore around the network without setting off even more of these alerts.

59
00:06:31,380 --> 00:06:37,800
So really what the attacker is doing, when you've deployed these traps around in your network, is they're painting a roadmap for you.

60
00:06:37,800 --> 00:06:45,140
They're painting a picture for where they're going, what they're doing, even their motivations, what servers are they targeting.

61
00:06:45,380 --> 00:06:51,400
When they open up some of these token files, what are the file names that are getting them to double-click that?

62
00:06:51,860 --> 00:07:01,940
You know, are they files that look like they have employee data, files that look like they have customer data, files that look like they just have more passwords so that they can pivot further into the environment?

63
00:07:03,220 --> 00:07:15,940
You know, a lot of strategies you can use when deploying both the canaries and the tokens here to understand what the attacker is doing, where they're going in your environment, and paint you a nice picture of what's going on.

64
00:07:21,830 --> 00:07:26,770
And of course, when those alarms do get set off, we want to make sure they go where you can get to them.

65
00:07:26,810 --> 00:07:29,770
In the context of OpenSOC, this is going to be Greylog.

66
00:07:29,770 --> 00:07:34,970
That's where you're going to see any canary token alerts or any canary alerts.

67
00:07:35,550 --> 00:07:41,530
Of course, you know, we can send them tons of other places, but that's where you're going to see them for OpenSOC.

68
00:07:42,230 --> 00:07:47,450
And we'll take a closer look at the kind of details that you're going to get in those alerts.

69
00:07:48,710 --> 00:07:59,950
So whereas canaries sit on the network and let you know when suspicious stuff is going on on your network, canary tokens can do it at a smaller level.

70
00:07:59,950 --> 00:08:06,350
So canary tokens can be a bit of code, can be a file, and highly complementary to the canaries.

71
00:08:06,350 --> 00:08:15,630
You can even have canary tokens on canaries or canary tokens within canary tokens, which sit on another place that is triggered by canary tokens.

72
00:08:15,630 --> 00:08:26,630
You can layer these really deep so that even if one or two aren't maybe triggered, you know, something is going to trigger if you deploy enough of these in your environment.

73
00:08:27,410 --> 00:08:32,990
And understand how these work and how you would use them or how you might see them used within OpenSOC.

74
00:08:32,990 --> 00:08:43,290
We're going to take a look at probably one of the most common and popular canary tokens that get used, which is just the WordDoc canary token.

75
00:08:45,210 --> 00:08:54,290
So in this scenario here, whoever's creating this canary token, you know, our canary user creates a WordCanary token.

76
00:08:54,290 --> 00:08:57,810
And this token can look like a real Word file.

77
00:08:57,810 --> 00:09:00,150
You can even upload an existing Word file.

78
00:09:00,150 --> 00:09:04,630
You can copy any kind of contents you want in it.

79
00:09:05,430 --> 00:09:08,050
Make it look as realistic as you want.

80
00:09:08,330 --> 00:09:11,130
And you're going to name it something the attacker wants.

81
00:09:11,130 --> 00:09:15,190
So really, thinking about this, you're fishing the attacker.

82
00:09:15,190 --> 00:09:20,690
You're using the same principles attackers use against us against them.

83
00:09:20,690 --> 00:09:33,230
You know, you're trying to trick them into opening a file, into taking an action that's going to trigger one of these tripwires, that's going to trigger some of these alerts, and let you know what the attacker's up to.

84
00:09:36,590 --> 00:09:44,190
So after they grab that, you know, maybe they send it off to someone else, you know, they're going to sell the data.

85
00:09:44,910 --> 00:09:46,850
But at this point, it doesn't matter.

86
00:09:46,850 --> 00:09:53,630
Anybody that opens this Word document, this token Word document, is going to set off an alert.

87
00:09:53,870 --> 00:09:59,230
As soon as it's opened, you know, before you've even seen the contents of that file, it could be blank.

88
00:09:59,230 --> 00:10:07,510
You know, it doesn't matter how clever the file is, how cleverly you've made the ruse, you could have just been lazy and left it completely blank.

89
00:10:07,650 --> 00:10:13,470
And by the time the attacker knows that, it's already sent off an alert with some of their data attached to that.

90
00:10:13,870 --> 00:10:20,750
And the Canary admin gets the alert and sees the details of who opened it, where they opened it.

91
00:10:21,870 --> 00:10:28,690
And you know what's going on, you know that that file has left that secure environment wherever you stored that file.

92
00:10:32,140 --> 00:10:36,100
Alright, so what can these alerts tell you?

93
00:10:36,100 --> 00:10:39,680
And at this point, we're going to jump into an interactive demo here.

94
00:10:40,420 --> 00:10:43,660
I'm going to leave the slides behind.

95
00:10:46,130 --> 00:10:55,150
Alright, see how big we can make this without it going off the screen here.

96
00:11:02,480 --> 00:11:04,500
Alright, so this is my console here.

97
00:11:04,500 --> 00:11:06,220
I've got two Canaries running.

98
00:11:07,000 --> 00:11:11,580
One looks like a Cisco and one is set up as a Synology NAS.

99
00:11:12,580 --> 00:11:14,660
And then I've got my command line here.

100
00:11:14,660 --> 00:11:23,140
I'm just going to use this to run some nmap scans against these hosts here, just so you can see what it looks like when one of these alerts does go off.

101
00:11:23,280 --> 00:11:25,920
So I'm going to copy this IP address,

102
00:11:29,780 --> 00:11:31,900
do a quick scan against it.

103
00:11:35,760 --> 00:11:39,400
Hopefully that's big enough to see there, make that larger.

104
00:11:49,260 --> 00:12:04,580
Alright, so the attacker sees this, they see what they would expect to see on a Cisco router, maybe an older Cisco router, it's still got Telnet open, MAC address is Cisco, the operating system looks like Cisco, looks like a Cisco 1921 router.

105
00:12:04,800 --> 00:12:10,420
And as you probably noticed there, as I ran that scan, we got a few alerts.

106
00:12:10,440 --> 00:12:18,740
So, you know, first thing we know when somebody scans a Canary, if you have port scan detection enabled, you're going to get alerts when you get scanned.

107
00:12:18,780 --> 00:12:27,260
And we can even tell that it was an nmap scan, you know, the OS flag and nmap is pretty easy to detect.

108
00:12:28,000 --> 00:12:29,820
Nothing else really looks like it.

109
00:12:29,820 --> 00:12:35,640
So we know when we've been, somebody's doing some OS fingerprinting with nmap specifically.

110
00:12:36,040 --> 00:12:44,080
So maybe the attacker tries to log into SSH, you know, they saw SSH was open here, maybe they're hoping for some default credentials.

111
00:12:54,060 --> 00:12:58,620
And just like SSH, you know, they try three times, you know, it doesn't work.

112
00:12:58,920 --> 00:13:02,980
There is no correct username or password that's going to get you into Canary.

113
00:13:03,340 --> 00:13:09,640
They just exist, all these services exist there for the attacker to spin their wheels, waste their time trying to get in.

114
00:13:09,800 --> 00:13:15,960
They could try to get in through the web config there, which is just basic auth, nothing fancy here.

115
00:13:16,700 --> 00:13:21,680
But they could, it could throw a brute force, you know, dictionary attack against it.

116
00:13:21,720 --> 00:13:25,200
All they're going to do is generate more and more alerts for you to see what they're doing.

117
00:13:25,720 --> 00:13:31,020
So already we have this picture here, you know, they painted this story of what they're trying to do.

118
00:13:31,020 --> 00:13:37,580
You know, they've scanned the network, they found something interesting, they tried to log into it, that didn't work.

119
00:13:37,580 --> 00:13:40,320
And they tried to log in a different way, that didn't work.

120
00:13:40,700 --> 00:13:44,880
And, you know, you can see what this attacker is trying to do.

121
00:13:45,400 --> 00:13:52,980
And the main thing you're going to use to pivot off of when you see an alert from one of these Canaries is probably going to be the source IP.

122
00:13:53,100 --> 00:13:55,100
So some of these details can help you as well.

123
00:13:55,100 --> 00:13:58,440
You can see the username and password that they tried.

124
00:13:58,560 --> 00:14:04,460
You can even see the remote SSH version that might tell you something about the host that they're trying to get in from.

125
00:14:05,420 --> 00:14:07,420
You know, so some of these details might help you.

126
00:14:07,460 --> 00:14:23,280
But this IP address and the reverse DNS, these are going to be the main things that you're probably going to pivot off of, looking through Greylog, looking through Moloch, some of these other tools, that's going to point you in the right direction.

127
00:14:23,280 --> 00:14:33,860
And then, the rest of the tools that you saw today, if you watch any of those presentations, those are going to help you build that investigation and figure out what's going on.

128
00:14:36,820 --> 00:14:44,860
When they do hit a web server on the Canary, browsers are nice enough to hand off the user agent that tells you a little bit more about the attacker.

129
00:14:44,860 --> 00:14:49,060
In this case, obviously, I'm using a Mac and that's revealed through it.

130
00:14:49,240 --> 00:14:53,700
Of course, an attacker could, you know, they can change their user agent.

131
00:14:54,000 --> 00:14:56,520
You know, they could even mask their IP address.

132
00:14:57,440 --> 00:15:01,220
But generally, you'd be able to tell if that's happening as well.

133
00:15:01,220 --> 00:15:03,520
You know, there's other ways of telling that.

134
00:15:04,940 --> 00:15:08,020
All right, so that's what that looks like.

135
00:15:08,300 --> 00:15:17,380
Just doing a scan and trying to log into a few things on the Cisco honeypot there.

136
00:15:17,380 --> 00:15:21,280
And this one, the Synology NAS, is also fairly interesting.

137
00:15:21,280 --> 00:15:23,460
We're going to do a quick scan of this one.

138
00:15:23,480 --> 00:15:25,160
It looks a little bit different.

139
00:15:25,160 --> 00:15:29,420
One of the key things that's different about it is it has a file share.

140
00:15:32,140 --> 00:15:34,880
So we're going to run a quick scan against it.

141
00:15:36,760 --> 00:15:39,900
Again, our results come back pretty quickly here.

142
00:15:40,140 --> 00:15:48,920
Mac address Synology services look like what you'd expect of a file share in a network storage device.

143
00:15:49,100 --> 00:15:52,440
They do run Linux, you know, and that's what comes back as.

144
00:15:52,780 --> 00:15:59,720
So, you know, maybe the attacker, any attacker that sees an open file share, you got to know what's on that file share, right?

145
00:16:00,360 --> 00:16:03,780
So we're going to pop in there and take a look.

146
00:16:07,260 --> 00:16:10,380
And by default, we're going to make it pretty easy for them to get on there.

147
00:16:10,380 --> 00:16:14,800
You know, you could lock it down, make them use some stolen credentials to get in there.

148
00:16:15,480 --> 00:16:18,240
But we really want to know what they're interested in.

149
00:16:18,240 --> 00:16:19,740
So we're going to make it easy.

150
00:16:19,740 --> 00:16:22,420
You know, so with a guest login, they can get on there.

151
00:16:22,640 --> 00:16:26,760
They can see the different files on there, you know, and this is where it gets interesting.

152
00:16:26,760 --> 00:16:36,960
If you've got files that look like they have different types of data, depending on what they go after, you know, maybe in this case, they're going to go after the router config.

153
00:16:36,960 --> 00:16:38,920
You know, they're still hung up on that Cisco router.

154
00:16:38,920 --> 00:16:40,460
They really want to get in there.

155
00:16:40,520 --> 00:16:43,000
They want to check out this config, see how it's configured.

156
00:16:43,460 --> 00:16:46,780
Bummer, looks like the file's password protected.

157
00:16:47,000 --> 00:16:48,640
That's as far as they go with that.

158
00:16:48,640 --> 00:16:50,840
Maybe they're trying on a few others here.

159
00:16:51,020 --> 00:16:55,120
But you get to see which files they're interested in, which files they go after.

160
00:16:56,060 --> 00:16:59,880
So we see here in the alert, they went right after that Cisco router config.

161
00:17:00,880 --> 00:17:05,340
And again, by now, you know, this has painted a pretty nice picture.

162
00:17:05,340 --> 00:17:07,640
You know, we know who the attacker is.

163
00:17:07,820 --> 00:17:12,440
We know they're scanning the network, and we know they're trying to get into things.

164
00:17:12,460 --> 00:17:14,960
So pretty clear picture of what's going on.

165
00:17:15,340 --> 00:17:25,020
And that's really the goal of the product here, is to paint a clear picture that, you know, that yes, this is probably a malicious attack, and we need to investigate it.

166
00:17:26,620 --> 00:17:28,740
That early breach detection.

167
00:17:28,740 --> 00:17:34,140
So now you're going to take that, you're going to pivot to other tools, and you're going to start to dive deeper.

168
00:17:35,140 --> 00:17:37,880
So I'm going to clean up these alerts real quick here.

169
00:17:42,240 --> 00:17:45,860
And we will talk a bit about canary tokens.

170
00:17:47,080 --> 00:17:59,560
So like I mentioned before, where canaries let you know when suspicious stuff is going on in the network, as we saw with scans, login attempts there, canary tokens, you can go even deeper.

171
00:17:59,560 --> 00:18:01,160
You can complement that.

172
00:18:01,160 --> 00:18:05,520
Some of those files in that file share I just showed you could have been token files.

173
00:18:05,600 --> 00:18:14,300
And what that means, so in the case of the Word doc here, and as I mentioned before, you can even upload your own Word doc.

174
00:18:14,300 --> 00:18:18,640
So I can take my fake pen test results here.

175
00:18:18,920 --> 00:18:21,900
I can just, I need to give it a memo.

176
00:18:21,900 --> 00:18:26,980
So one of the key things here is you really want to use one token per location.

177
00:18:27,220 --> 00:18:32,980
So, you know, maybe I'm going to put this on my secret flash drive.

178
00:18:37,500 --> 00:18:38,880
I don't know why it's secret.

179
00:18:38,880 --> 00:18:39,980
It's just a flash drive.

180
00:18:39,980 --> 00:18:41,080
I only have one flash drive.

181
00:18:41,080 --> 00:18:42,140
Let's say that.

182
00:18:43,880 --> 00:18:45,940
So I'm going to put that there.

183
00:18:45,940 --> 00:18:47,580
I'm not going to put it in my email.

184
00:18:47,580 --> 00:18:49,420
I'm not going to put it on my desktop.

185
00:18:49,840 --> 00:18:52,160
It's only going to exist on that flash drive.

186
00:18:52,160 --> 00:18:57,560
So if I see any alert from this canary token, I know somebody's got my flash drive.

187
00:18:59,740 --> 00:19:04,000
Simple as that, because that's the only way somebody could have found this token.

188
00:19:05,680 --> 00:19:07,860
So we download that.

189
00:19:08,300 --> 00:19:11,900
And remember, this was an existing Word doc that I had.

190
00:19:12,800 --> 00:19:16,460
You know, I haven't done anything special to this.

191
00:19:16,460 --> 00:19:23,380
It's just a normal Word doc that you can grab, you can upload, and we've just added a token to it.

192
00:19:24,080 --> 00:19:25,880
So the attacker opens it up.

193
00:19:25,880 --> 00:19:30,700
There's no indication that this canary token has sent out anything.

194
00:19:31,440 --> 00:19:36,340
There's no indication that the attacker has fallen into a trap here.

195
00:19:36,340 --> 00:19:41,160
But in fact, it has sent out several alerts.

196
00:19:42,160 --> 00:19:52,420
Our Word doc canary tokens have what we call our DNS primitive, our DNS tokens embedded within it, and our web tokens embedded within it.

197
00:19:52,420 --> 00:19:57,320
And part of the reason we do that is because it doubles our chance of getting the alert out.

198
00:19:57,320 --> 00:20:02,860
On some networks, maybe HTTP port 80 isn't allowed outbound.

199
00:20:02,860 --> 00:20:07,160
You know, only HTTPS is allowed outbound.

200
00:20:07,200 --> 00:20:10,140
So this wouldn't have gotten back to the console.

201
00:20:10,860 --> 00:20:17,700
But as long as the person that opened that Word file had working DNS, we would still get that back.

202
00:20:18,260 --> 00:20:23,700
You know, so we've got a really good chance of knowing when somebody opens one of these Word docs.

203
00:20:24,820 --> 00:20:32,460
And you can see we get a, you know, the user agent here doesn't give as many details, but we can see what version of Office they've got.

204
00:20:32,540 --> 00:20:40,100
But the key information here is somebody would have had to have physical access to my flash drive for this alert to trigger.

205
00:20:40,360 --> 00:20:44,560
And they were interested in this file out of all the files that were on my flash drive.

206
00:20:44,560 --> 00:20:47,640
This is, you know, the first token file that they opened.

207
00:20:47,640 --> 00:20:55,840
Let's say I had multiple token files on there with, you know, different file names suggesting they have different types of data in them.

208
00:20:55,840 --> 00:20:57,740
And they went after this one first.

209
00:20:57,740 --> 00:20:59,760
So that's useful to me also.

210
00:21:00,140 --> 00:21:07,860
And then I've got the, you know, both the DNS server that handed off that DNS token that triggered.

211
00:21:07,860 --> 00:21:11,640
And then the web token got out as well.

212
00:21:11,640 --> 00:21:16,440
So, you know, that's my actual IP address that's assigned to me by my ISP.

213
00:21:16,440 --> 00:21:25,480
That's what the web server sees when this Word document opens and it reaches back the canary token server that lives on the console here.

214
00:21:25,880 --> 00:21:31,100
So a couple useful pieces of information there that I can leverage.

215
00:21:34,460 --> 00:21:37,720
So, yeah, that's the Word.canary token.

216
00:21:38,100 --> 00:21:44,980
We do have, as you can see here, there's different tokens for all sorts of different purposes.

217
00:21:45,200 --> 00:21:50,360
And this is pretty similar to what canarytokens.org shows.

218
00:21:50,360 --> 00:21:54,740
I think we have almost every single one of these tokens there as well.

219
00:21:54,880 --> 00:21:58,480
The other one I'm going to show you here is the QR code token.

220
00:21:59,100 --> 00:22:01,740
This is a fun one because it's very versatile.

221
00:22:01,740 --> 00:22:06,920
There's a lot of ways that we see QR codes used in technology today.

222
00:22:06,920 --> 00:22:21,820
So setting up your multi-factor authentication, setting up, um, enrollment, you know, maybe into your MDM, EMM product.

223
00:22:22,620 --> 00:22:27,100
You know, you see them out and about in physical places all the time.

224
00:22:27,100 --> 00:22:31,560
You know, scan here for more information about this house that's for sale, that kind of thing.

225
00:22:31,820 --> 00:22:34,360
So the sky's the limit for how you can use these.

226
00:22:34,360 --> 00:22:37,740
You can use them digitally or you can use them in physical environments.

227
00:22:38,120 --> 00:22:43,840
So let's say I want to know if somebody gets into Adrian's lunchbox.

228
00:22:44,300 --> 00:22:47,360
You know, I don't want to know if somebody's just touched my lunchbox.

229
00:22:47,360 --> 00:22:49,540
I want to know if they've actually opened it.

230
00:22:54,660 --> 00:22:59,520
Because I've stuck this QR code on the inside of my lunchbox.

231
00:22:59,520 --> 00:23:14,060
I've printed this out, stuck it in there, um, you know, maybe put some text around it like, uh, recipe for Adrian's, uh, you know, Adrian's secret recipe, you know, handed down through the generations.

232
00:23:14,060 --> 00:23:17,300
Something to that, uh, that respect.

233
00:23:17,300 --> 00:23:20,360
You know, something somebody would be really interested in scanning.

234
00:23:21,080 --> 00:23:24,540
So I put this QR code there.

235
00:23:24,540 --> 00:23:35,660
If I ever get an alert on this, I know somebody has not only touched my lunchbox, but they've opened it up, they spotted the QR code on the inside, they read the words around it, and they chose to scan it with their phone.

236
00:23:35,780 --> 00:23:38,200
You know, that's the only way I would get that figure.

237
00:23:38,200 --> 00:23:39,920
So that's the power there.

238
00:23:39,920 --> 00:23:43,900
And, uh, we've seen people put these in all kinds of locations.

239
00:23:43,900 --> 00:23:58,060
Um, I think one of my favorites is somebody told me that the, uh, they print this out on a sheet of paper, they put the words Microsoft Authentic Recovery, uh, around it, and they just leave that sheet of paper on their desk at work and just wait.

240
00:23:59,740 --> 00:24:02,520
And, uh, that's great.

241
00:24:02,820 --> 00:24:05,760
Four people are checking out my lunchbox.

242
00:24:05,760 --> 00:24:07,420
They want to see that secret recipe.

243
00:24:07,420 --> 00:24:09,040
I know this one is me.

244
00:24:09,040 --> 00:24:11,320
You know, we, first of all, we just saw that source IP.

245
00:24:11,320 --> 00:24:13,220
Everybody knows this is me by now.

246
00:24:13,460 --> 00:24:18,160
Uh, we'll actually do a GeoIP look up here, um, get some details there.

247
00:24:18,320 --> 00:24:23,020
Uh, and, uh, you know, we can even see what kind of phone I'm using here.

248
00:24:23,100 --> 00:24:30,560
You know, we, you get different, uh, details out of these user agents, depending on, on how they're scanned, what devices scan them.

249
00:24:30,820 --> 00:24:37,320
Um, you know, so maybe there's some crazy situation where that, those kinds of details are useful.

250
00:24:37,720 --> 00:24:43,340
But, um, you know, the key point here again is I've only put this token one place.

251
00:24:43,600 --> 00:24:49,640
You know, it took me 30 seconds to do it, to scan it out, uh, tape it to the inside of my lunchbox.

252
00:24:49,760 --> 00:24:52,260
Um, but I can just leave it there forever.

253
00:24:52,260 --> 00:24:57,380
And if I ever get a trigger off of that, I know that somebody has been in that lunchbox.

254
00:24:57,380 --> 00:24:59,960
And maybe that lunchbox is, maybe it's not a lunchbox.

255
00:24:59,960 --> 00:25:00,900
Maybe it's a data center.

256
00:25:00,900 --> 00:25:02,520
Maybe it's a network closet.

257
00:25:02,680 --> 00:25:08,660
Maybe it's underneath the battery on a laptop, you know, all kinds of different places that you could hide these.

258
00:25:08,740 --> 00:25:12,440
It looks like we've got somebody from Oklahoma that scanned it.

259
00:25:12,440 --> 00:25:16,920
Again, you know, if you're coming through a VPN or something like that, that would be reflected here.

260
00:25:17,060 --> 00:25:21,240
Uh, but we've got, uh, an Android, uh, Pixel 3 XL.

261
00:25:22,280 --> 00:25:28,580
Um, we've got, uh, Mission Viejo, somebody coming from California.

262
00:25:29,320 --> 00:25:35,660
And, uh, a lot of these user agents will, um, refer to the application used, uh, to open it.

263
00:25:35,660 --> 00:25:41,420
Like I think that previous one we looked at, uh, ZXING, that's a barcode scanner app.

264
00:25:42,280 --> 00:25:45,560
And then one more here, uh, that would be Bradley.

265
00:25:46,280 --> 00:25:52,900
Uh, Bradley's in, uh, up very early in the morning in South Africa and scanned it with his iPhone.

266
00:25:56,170 --> 00:26:03,850
So hope that helps to, to demonstrate the, the power of how you can use these tokens, um, and, and how the canaries are used.

267
00:26:03,850 --> 00:26:17,490
And most importantly, when you see alerts from these, understanding what the attacker had to do to trigger those alerts and what it tells you about the attacker, where they are, and maybe even their, their motivations and where they're going to go next.

268
00:26:18,550 --> 00:26:22,510
And help you pivot between, uh, some of the different applications here.

269
00:26:22,870 --> 00:26:26,090
So really that's, that's it in a nutshell.

270
00:26:26,090 --> 00:26:27,650
I think we still have 20 minutes.

271
00:26:27,650 --> 00:26:32,190
If there's any questions, we could absolutely take some of those.

272
00:26:34,150 --> 00:26:35,670
Bradley, I appreciate it.

273
00:26:35,670 --> 00:26:37,810
This was a great, uh, great presentation.

274
00:26:37,810 --> 00:26:41,050
I did mark down a couple of questions that were asked during the presentation.

275
00:26:41,150 --> 00:26:51,190
Uh, does carrot, does canary token create, uh, or does the canary token created based off of the session plus protocol plus application?

276
00:26:51,190 --> 00:26:53,610
Is that, uh, uniquely identified?

277
00:26:55,930 --> 00:26:59,310
Um, I'm not sure I understand the question.

278
00:26:59,510 --> 00:27:07,490
Um, based off the... so it might help to talk about the primitives a bit more.

279
00:27:07,490 --> 00:27:13,770
That, that might answer the question if I talk about the web and DNS tokens that are kind of, uh, sit behind this.

280
00:27:15,250 --> 00:27:20,890
Yeah, I think that would be, um, the way to go, Adrian, is to look at how the token is being created.

281
00:27:20,890 --> 00:27:27,690
Because I think the question is related to whether it's being tripped by the protocol or the application.

282
00:27:28,350 --> 00:27:29,310
Okay.

283
00:27:29,810 --> 00:27:30,410
Yeah.

284
00:27:30,410 --> 00:27:33,690
So first one I'm going to create here is a web token.

285
00:27:34,890 --> 00:27:43,910
And I'm going to create a fake email in my inbox that makes it looks like, uh, if an attacker gets in my inbox, maybe they get all my passwords.

286
00:27:43,910 --> 00:27:47,450
They get access to my last pass instance or something like that.

287
00:27:47,610 --> 00:28:03,390
So I can take this web token and I'm going to create a link in this email that this fake email that I put in my inbox, and I'm gonna basically, uh, phish, you know, or social engineer the attacker into clicking it.

288
00:28:03,610 --> 00:28:06,890
And so what we're actually calling a token is this bit right here.

289
00:28:06,890 --> 00:28:10,790
This is the actual token that the web server is looking for.

290
00:28:11,030 --> 00:28:17,050
And this address here, and if you're using canarytokens.org, you know, it would be something based on that.

291
00:28:17,050 --> 00:28:24,610
You can run your own canary token server, use it on your own domain, you know, run your own docker canary token server.

292
00:28:24,610 --> 00:28:26,630
So this could be anything you want.

293
00:28:26,650 --> 00:28:28,730
This could also be anything you want.

294
00:28:29,270 --> 00:28:31,970
You know, we could name that admin files.

295
00:28:31,970 --> 00:28:32,810
We could name this

296
00:28:36,370 --> 00:28:37,670
password.db.

297
00:28:38,230 --> 00:28:41,350
And that's still going to trigger an alert when we go to that.

298
00:28:42,470 --> 00:28:50,690
So at its base component, and when we just demonstrated the QR code token, that's just using an embedded web token.

299
00:28:50,690 --> 00:29:01,470
So super simple way of doing it by reaching out, touching a web server with this token here, we know to map that back to Adrian's inbox.

300
00:29:01,470 --> 00:29:08,030
We know that that's the token associated with this memo, with this reminder that I set for myself.

301
00:29:09,250 --> 00:29:16,830
So I hope that answers the question of how that, how the token itself works.

302
00:29:17,070 --> 00:29:21,390
And that's the same token that we have embedded in a lot of these other ones.

303
00:29:21,390 --> 00:29:25,550
So the word file has a web token embedded in it.

304
00:29:26,190 --> 00:29:30,670
You know, I mentioned the QR code does, you know, and several of these others do.

305
00:29:30,850 --> 00:29:34,790
The other, what we call our token primitive is DNS.

306
00:29:35,950 --> 00:29:46,070
So again, there's ways to get, if somebody gets in my inbox, we can get a DNS name to resolve.

307
00:29:46,310 --> 00:29:53,950
So if I were to just copy this DNS name, and again, here, this bit is the token, you can tell kind of from the length of it.

308
00:29:53,950 --> 00:30:00,210
And really, it's a C name on the front of this domain, you know, that maps back to us.

309
00:30:01,090 --> 00:30:06,850
So if I do an NS lookup on that, I get an alert.

310
00:30:08,050 --> 00:30:17,550
So wherever I've, that NS address, if anyone resolves it, if it gets resolved for any reason, maybe I'm just sending it in clear text on the network.

311
00:30:17,770 --> 00:30:28,230
Somebody captures that traffic with Wireshark, and they view that traffic, and they tell Wireshark to resolve all the DNS addresses, that would trigger it, you know, something as simple as that.

312
00:30:28,230 --> 00:30:41,950
But if I can find files, you know, any kind of tricks, any kind of ways to get a DNS address resolved, that can trigger a token and send me an alert.

313
00:30:43,170 --> 00:31:04,690
Yeah, just to add on to what Adrian mentioned, is that we're embedding HTTP requests and a DNS request inside of a document, and we're relying on, when the document gets opened with MS Word, for instance, MS Word reaches out with those, to those URLs of the DNS.

314
00:31:04,690 --> 00:31:12,870
So it's MS Word, the application itself, that's looking up those requests that I embedded into the document, and that's what's triggering the alert.

315
00:31:14,250 --> 00:31:25,170
Yeah, and that's important to note, you know, some of these require action from the attacker, like in my example of the fake email in my inbox, I've got to get, I've got to convince them to click that link.

316
00:31:25,430 --> 00:31:32,310
In other cases, like Bradley's example with the Word doc, simply opening it is all they need to do.

317
00:31:32,310 --> 00:31:39,090
You know, they don't see it, it happens in the background, they don't even know that those alerts have been triggered.

318
00:31:40,530 --> 00:31:42,890
And there's nothing else that they need to do.

319
00:31:48,390 --> 00:31:50,010
Well, I appreciate it.

320
00:31:50,010 --> 00:31:51,270
Thank you, Bradley.

321
00:31:51,390 --> 00:31:52,550
Thank you, Adrian.

322
00:31:52,550 --> 00:31:54,510
This has been a great presentation.

323
00:31:54,510 --> 00:32:02,050
So this concludes the presentation for the workshop for Canary.

324
00:32:02,810 --> 00:32:10,550
In any case, if you have any follow-up questions, the speakers will be around in the Discord for a few minutes.

325
00:32:10,550 --> 00:32:22,970
And again, the Discord that we are chatting in is the text dash workshops dash track one, in the Flamingo Hotel group, just scroll all the way down to the bottom.

326
00:32:23,510 --> 00:32:27,950
And so if you guys could sort of come down, I think there's a couple of questions.

327
00:32:27,950 --> 00:32:30,250
If you have some follow-up, that would be great.

328
00:32:30,390 --> 00:32:34,870
Otherwise, I appreciate everybody listening in today and thank you very much for attending.