WEBVTT 00:13.880 --> 00:14.960 Hello, everyone. 00:14.960 --> 00:15.900 Welcome back. 00:15.900 --> 00:22.580 My name is Rubix1138, and I welcome you to the Thinkist Canary workshop. 00:22.580 --> 00:36.020 If you have not already joined us in the Discord chat, please go to blueteamvillage.org and click on DEF CON 28 and join us in the Discord. 00:36.040 --> 00:45.840 The text chat while we go through this presentation will be in the Texts Workshops Track 1 under Flamingo Hotel. 00:45.840 --> 00:52.560 Just scroll all the way down, go to Texts Workshops Track 1, and you can post your questions there. 00:52.560 --> 00:58.020 I'd like to welcome Adrian and Bradley from Thinkist. 00:58.020 --> 00:59.480 Go ahead, guys, take it away. 00:59.480 --> 01:00.460 Thank you. 01:02.000 --> 01:04.640 Hello, and thank you very much for that. 01:04.640 --> 01:06.320 That was a kind intro. 01:08.280 --> 01:11.420 And we are very excited to be here. 01:12.740 --> 01:30.460 And we're going to talk a little bit about how Canaries and Canary Tokens are now going to be integrated into OpenSOC and give you a little bit of context and background on them so you can understand how to use them when going through OpenSOC. 01:31.780 --> 01:34.480 So again, big, big thanks to OpenSOC. 01:34.600 --> 01:42.140 Really excited to be part of it and really glad that, you know, they thought to include us in this. 01:45.610 --> 01:50.310 All right, so what we're going to do first is just go through some slides real quick here. 01:50.310 --> 01:52.650 We'll go through some live demos as well. 01:52.970 --> 01:58.890 A lot of what you're going to see is kind of a mix of the commercial product and the free product. 01:58.890 --> 02:02.370 Really, the free stuff we have out there worked the same way. 02:02.410 --> 02:06.730 Same principles, same data you get in the alerts. 02:07.610 --> 02:14.210 Just for convenience and time sake, you know, you might see a little bit of the commercial product here. 02:14.910 --> 02:25.070 So some of our goals when we designed Canary and Canary Tokens was, you know, a tool that gets deployed and gets used is useful. 02:25.070 --> 02:30.250 So a lot of work went into making them super easy and simple to use. 02:30.730 --> 02:33.250 They take minutes to set up and deploy. 02:33.670 --> 02:38.190 So a lot of work goes into making them super easy to do that. 02:38.470 --> 02:41.010 And little to no maintenance, you know. 02:41.010 --> 02:45.410 So again, you know, for a tool to be useful, it has to function, you know. 02:45.410 --> 02:53.990 So any kind of maintenance, you know, we try and make non-existent or, you know, we can do it automatically for you in the background. 02:53.990 --> 03:05.890 Even a free tool, most of that you can just generate Canary Tokens, deploy them, forget them, deploy open Canary and pretty much forget about it until it sends you alerts. 03:07.710 --> 03:15.230 So yeah, and those alerts, that's a big goal also is, you know, how can we get this as close to zero false positives as possible? 03:16.490 --> 03:21.770 And ultimately, you know, the goal here is to know when it matters. 03:21.770 --> 03:27.830 To know when an attacker's in your environment as soon as possible, when it matters to know that. 03:30.980 --> 03:38.560 All right, so as I mentioned, our open source and free products here, open Canary is available. 03:38.560 --> 03:39.780 It's well documented. 03:39.780 --> 03:41.340 You can grab it from GitHub. 03:41.760 --> 03:47.420 I think the Docker container has been downloaded tens of thousands of times. 03:47.420 --> 03:50.260 So we know it's getting a lot of use out there. 03:50.580 --> 04:01.320 You know, the package has been installed and you can run your own Canary token server as well with a Docker container or you can use canarytokens.org. 04:02.100 --> 04:06.020 I think we have over 100,000 people using canarytokens.org. 04:06.020 --> 04:08.040 You don't even need to create an account to use it. 04:08.040 --> 04:18.440 You can just go there right now and start creating tokens and distributing them throughout your personal devices, you know, your production environment, wherever you want to use them. 04:18.440 --> 04:19.840 People use them all over. 04:21.920 --> 04:31.720 All right, so talking about the context a little bit here, what are these and why would you use them in a Blue Team environment or Open Sock? 04:33.060 --> 04:37.800 So the goal here is to let you know as soon as the attacker gets in the environment. 04:38.080 --> 04:44.000 So, you know, over the last couple of decades, dwell time is really long. 04:44.000 --> 04:49.140 Attackers are in environments way too long and they just, they go on undetected. 04:49.140 --> 05:00.460 And that's a problem we set out to solve here is, you know, what if we could get that dwell time down to minutes to when you at least know that there's something suspicious going on inside the environment. 05:00.460 --> 05:09.820 So that's the goal here is the attacker's already in the environment and doing suspicious things and that's what we alert on. 05:11.180 --> 05:14.040 So that's important context to understand. 05:15.340 --> 05:17.020 And how do we do that? 05:17.180 --> 05:25.940 So I've got a quick diagram here just to show you simply what we leverage to make our product work here, to make it win. 05:26.760 --> 05:31.240 And when an attacker gets in, they don't know where anything is in your environment. 05:31.240 --> 05:39.320 They don't, you know, unless they land on a Visio diagram, on a highly detailed Visio diagram, the moment they get in, they're going to have to explore the network. 05:39.320 --> 05:42.940 They're going to have to look around for what they're hoping to find. 05:45.760 --> 06:06.540 And if you drop in these canaries, which are honeypots, which can look like anything else in your network, anything from Windows Server 2016 to a Linux server, you know, the idea is it looks like a normal server, but there's no real reason anybody should be touching it or using it. 06:06.780 --> 06:13.000 So the attacker comes in, does that same exploration, and they start setting off alerts. 06:15.700 --> 06:22.780 And furthermore, when you take canary tokens, you can set traps throughout even more of the environment. 06:22.780 --> 06:31.380 You can make it even more tricky and difficult for the attacker to explore around the network without setting off even more of these alerts. 06:31.380 --> 06:37.800 So really what the attacker is doing, when you've deployed these traps around in your network, is they're painting a roadmap for you. 06:37.800 --> 06:45.140 They're painting a picture for where they're going, what they're doing, even their motivations, what servers are they targeting. 06:45.380 --> 06:51.400 When they open up some of these token files, what are the file names that are getting them to double-click that? 06:51.860 --> 07:01.940 You know, are they files that look like they have employee data, files that look like they have customer data, files that look like they just have more passwords so that they can pivot further into the environment? 07:03.220 --> 07:15.940 You know, a lot of strategies you can use when deploying both the canaries and the tokens here to understand what the attacker is doing, where they're going in your environment, and paint you a nice picture of what's going on. 07:21.830 --> 07:26.770 And of course, when those alarms do get set off, we want to make sure they go where you can get to them. 07:26.810 --> 07:29.770 In the context of OpenSOC, this is going to be Greylog. 07:29.770 --> 07:34.970 That's where you're going to see any canary token alerts or any canary alerts. 07:35.550 --> 07:41.530 Of course, you know, we can send them tons of other places, but that's where you're going to see them for OpenSOC. 07:42.230 --> 07:47.450 And we'll take a closer look at the kind of details that you're going to get in those alerts. 07:48.710 --> 07:59.950 So whereas canaries sit on the network and let you know when suspicious stuff is going on on your network, canary tokens can do it at a smaller level. 07:59.950 --> 08:06.350 So canary tokens can be a bit of code, can be a file, and highly complementary to the canaries. 08:06.350 --> 08:15.630 You can even have canary tokens on canaries or canary tokens within canary tokens, which sit on another place that is triggered by canary tokens. 08:15.630 --> 08:26.630 You can layer these really deep so that even if one or two aren't maybe triggered, you know, something is going to trigger if you deploy enough of these in your environment. 08:27.410 --> 08:32.990 And understand how these work and how you would use them or how you might see them used within OpenSOC. 08:32.990 --> 08:43.290 We're going to take a look at probably one of the most common and popular canary tokens that get used, which is just the WordDoc canary token. 08:45.210 --> 08:54.290 So in this scenario here, whoever's creating this canary token, you know, our canary user creates a WordCanary token. 08:54.290 --> 08:57.810 And this token can look like a real Word file. 08:57.810 --> 09:00.150 You can even upload an existing Word file. 09:00.150 --> 09:04.630 You can copy any kind of contents you want in it. 09:05.430 --> 09:08.050 Make it look as realistic as you want. 09:08.330 --> 09:11.130 And you're going to name it something the attacker wants. 09:11.130 --> 09:15.190 So really, thinking about this, you're fishing the attacker. 09:15.190 --> 09:20.690 You're using the same principles attackers use against us against them. 09:20.690 --> 09:33.230 You know, you're trying to trick them into opening a file, into taking an action that's going to trigger one of these tripwires, that's going to trigger some of these alerts, and let you know what the attacker's up to. 09:36.590 --> 09:44.190 So after they grab that, you know, maybe they send it off to someone else, you know, they're going to sell the data. 09:44.910 --> 09:46.850 But at this point, it doesn't matter. 09:46.850 --> 09:53.630 Anybody that opens this Word document, this token Word document, is going to set off an alert. 09:53.870 --> 09:59.230 As soon as it's opened, you know, before you've even seen the contents of that file, it could be blank. 09:59.230 --> 10:07.510 You know, it doesn't matter how clever the file is, how cleverly you've made the ruse, you could have just been lazy and left it completely blank. 10:07.650 --> 10:13.470 And by the time the attacker knows that, it's already sent off an alert with some of their data attached to that. 10:13.870 --> 10:20.750 And the Canary admin gets the alert and sees the details of who opened it, where they opened it. 10:21.870 --> 10:28.690 And you know what's going on, you know that that file has left that secure environment wherever you stored that file. 10:32.140 --> 10:36.100 Alright, so what can these alerts tell you? 10:36.100 --> 10:39.680 And at this point, we're going to jump into an interactive demo here. 10:40.420 --> 10:43.660 I'm going to leave the slides behind. 10:46.130 --> 10:55.150 Alright, see how big we can make this without it going off the screen here. 11:02.480 --> 11:04.500 Alright, so this is my console here. 11:04.500 --> 11:06.220 I've got two Canaries running. 11:07.000 --> 11:11.580 One looks like a Cisco and one is set up as a Synology NAS. 11:12.580 --> 11:14.660 And then I've got my command line here. 11:14.660 --> 11:23.140 I'm just going to use this to run some nmap scans against these hosts here, just so you can see what it looks like when one of these alerts does go off. 11:23.280 --> 11:25.920 So I'm going to copy this IP address, 11:29.780 --> 11:31.900 do a quick scan against it. 11:35.760 --> 11:39.400 Hopefully that's big enough to see there, make that larger. 11:49.260 --> 12:04.580 Alright, so the attacker sees this, they see what they would expect to see on a Cisco router, maybe an older Cisco router, it's still got Telnet open, MAC address is Cisco, the operating system looks like Cisco, looks like a Cisco 1921 router. 12:04.800 --> 12:10.420 And as you probably noticed there, as I ran that scan, we got a few alerts. 12:10.440 --> 12:18.740 So, you know, first thing we know when somebody scans a Canary, if you have port scan detection enabled, you're going to get alerts when you get scanned. 12:18.780 --> 12:27.260 And we can even tell that it was an nmap scan, you know, the OS flag and nmap is pretty easy to detect. 12:28.000 --> 12:29.820 Nothing else really looks like it. 12:29.820 --> 12:35.640 So we know when we've been, somebody's doing some OS fingerprinting with nmap specifically. 12:36.040 --> 12:44.080 So maybe the attacker tries to log into SSH, you know, they saw SSH was open here, maybe they're hoping for some default credentials. 12:54.060 --> 12:58.620 And just like SSH, you know, they try three times, you know, it doesn't work. 12:58.920 --> 13:02.980 There is no correct username or password that's going to get you into Canary. 13:03.340 --> 13:09.640 They just exist, all these services exist there for the attacker to spin their wheels, waste their time trying to get in. 13:09.800 --> 13:15.960 They could try to get in through the web config there, which is just basic auth, nothing fancy here. 13:16.700 --> 13:21.680 But they could, it could throw a brute force, you know, dictionary attack against it. 13:21.720 --> 13:25.200 All they're going to do is generate more and more alerts for you to see what they're doing. 13:25.720 --> 13:31.020 So already we have this picture here, you know, they painted this story of what they're trying to do. 13:31.020 --> 13:37.580 You know, they've scanned the network, they found something interesting, they tried to log into it, that didn't work. 13:37.580 --> 13:40.320 And they tried to log in a different way, that didn't work. 13:40.700 --> 13:44.880 And, you know, you can see what this attacker is trying to do. 13:45.400 --> 13:52.980 And the main thing you're going to use to pivot off of when you see an alert from one of these Canaries is probably going to be the source IP. 13:53.100 --> 13:55.100 So some of these details can help you as well. 13:55.100 --> 13:58.440 You can see the username and password that they tried. 13:58.560 --> 14:04.460 You can even see the remote SSH version that might tell you something about the host that they're trying to get in from. 14:05.420 --> 14:07.420 You know, so some of these details might help you. 14:07.460 --> 14:23.280 But this IP address and the reverse DNS, these are going to be the main things that you're probably going to pivot off of, looking through Greylog, looking through Moloch, some of these other tools, that's going to point you in the right direction. 14:23.280 --> 14:33.860 And then, the rest of the tools that you saw today, if you watch any of those presentations, those are going to help you build that investigation and figure out what's going on. 14:36.820 --> 14:44.860 When they do hit a web server on the Canary, browsers are nice enough to hand off the user agent that tells you a little bit more about the attacker. 14:44.860 --> 14:49.060 In this case, obviously, I'm using a Mac and that's revealed through it. 14:49.240 --> 14:53.700 Of course, an attacker could, you know, they can change their user agent. 14:54.000 --> 14:56.520 You know, they could even mask their IP address. 14:57.440 --> 15:01.220 But generally, you'd be able to tell if that's happening as well. 15:01.220 --> 15:03.520 You know, there's other ways of telling that. 15:04.940 --> 15:08.020 All right, so that's what that looks like. 15:08.300 --> 15:17.380 Just doing a scan and trying to log into a few things on the Cisco honeypot there. 15:17.380 --> 15:21.280 And this one, the Synology NAS, is also fairly interesting. 15:21.280 --> 15:23.460 We're going to do a quick scan of this one. 15:23.480 --> 15:25.160 It looks a little bit different. 15:25.160 --> 15:29.420 One of the key things that's different about it is it has a file share. 15:32.140 --> 15:34.880 So we're going to run a quick scan against it. 15:36.760 --> 15:39.900 Again, our results come back pretty quickly here. 15:40.140 --> 15:48.920 Mac address Synology services look like what you'd expect of a file share in a network storage device. 15:49.100 --> 15:52.440 They do run Linux, you know, and that's what comes back as. 15:52.780 --> 15:59.720 So, you know, maybe the attacker, any attacker that sees an open file share, you got to know what's on that file share, right? 16:00.360 --> 16:03.780 So we're going to pop in there and take a look. 16:07.260 --> 16:10.380 And by default, we're going to make it pretty easy for them to get on there. 16:10.380 --> 16:14.800 You know, you could lock it down, make them use some stolen credentials to get in there. 16:15.480 --> 16:18.240 But we really want to know what they're interested in. 16:18.240 --> 16:19.740 So we're going to make it easy. 16:19.740 --> 16:22.420 You know, so with a guest login, they can get on there. 16:22.640 --> 16:26.760 They can see the different files on there, you know, and this is where it gets interesting. 16:26.760 --> 16:36.960 If you've got files that look like they have different types of data, depending on what they go after, you know, maybe in this case, they're going to go after the router config. 16:36.960 --> 16:38.920 You know, they're still hung up on that Cisco router. 16:38.920 --> 16:40.460 They really want to get in there. 16:40.520 --> 16:43.000 They want to check out this config, see how it's configured. 16:43.460 --> 16:46.780 Bummer, looks like the file's password protected. 16:47.000 --> 16:48.640 That's as far as they go with that. 16:48.640 --> 16:50.840 Maybe they're trying on a few others here. 16:51.020 --> 16:55.120 But you get to see which files they're interested in, which files they go after. 16:56.060 --> 16:59.880 So we see here in the alert, they went right after that Cisco router config. 17:00.880 --> 17:05.340 And again, by now, you know, this has painted a pretty nice picture. 17:05.340 --> 17:07.640 You know, we know who the attacker is. 17:07.820 --> 17:12.440 We know they're scanning the network, and we know they're trying to get into things. 17:12.460 --> 17:14.960 So pretty clear picture of what's going on. 17:15.340 --> 17:25.020 And that's really the goal of the product here, is to paint a clear picture that, you know, that yes, this is probably a malicious attack, and we need to investigate it. 17:26.620 --> 17:28.740 That early breach detection. 17:28.740 --> 17:34.140 So now you're going to take that, you're going to pivot to other tools, and you're going to start to dive deeper. 17:35.140 --> 17:37.880 So I'm going to clean up these alerts real quick here. 17:42.240 --> 17:45.860 And we will talk a bit about canary tokens. 17:47.080 --> 17:59.560 So like I mentioned before, where canaries let you know when suspicious stuff is going on in the network, as we saw with scans, login attempts there, canary tokens, you can go even deeper. 17:59.560 --> 18:01.160 You can complement that. 18:01.160 --> 18:05.520 Some of those files in that file share I just showed you could have been token files. 18:05.600 --> 18:14.300 And what that means, so in the case of the Word doc here, and as I mentioned before, you can even upload your own Word doc. 18:14.300 --> 18:18.640 So I can take my fake pen test results here. 18:18.920 --> 18:21.900 I can just, I need to give it a memo. 18:21.900 --> 18:26.980 So one of the key things here is you really want to use one token per location. 18:27.220 --> 18:32.980 So, you know, maybe I'm going to put this on my secret flash drive. 18:37.500 --> 18:38.880 I don't know why it's secret. 18:38.880 --> 18:39.980 It's just a flash drive. 18:39.980 --> 18:41.080 I only have one flash drive. 18:41.080 --> 18:42.140 Let's say that. 18:43.880 --> 18:45.940 So I'm going to put that there. 18:45.940 --> 18:47.580 I'm not going to put it in my email. 18:47.580 --> 18:49.420 I'm not going to put it on my desktop. 18:49.840 --> 18:52.160 It's only going to exist on that flash drive. 18:52.160 --> 18:57.560 So if I see any alert from this canary token, I know somebody's got my flash drive. 18:59.740 --> 19:04.000 Simple as that, because that's the only way somebody could have found this token. 19:05.680 --> 19:07.860 So we download that. 19:08.300 --> 19:11.900 And remember, this was an existing Word doc that I had. 19:12.800 --> 19:16.460 You know, I haven't done anything special to this. 19:16.460 --> 19:23.380 It's just a normal Word doc that you can grab, you can upload, and we've just added a token to it. 19:24.080 --> 19:25.880 So the attacker opens it up. 19:25.880 --> 19:30.700 There's no indication that this canary token has sent out anything. 19:31.440 --> 19:36.340 There's no indication that the attacker has fallen into a trap here. 19:36.340 --> 19:41.160 But in fact, it has sent out several alerts. 19:42.160 --> 19:52.420 Our Word doc canary tokens have what we call our DNS primitive, our DNS tokens embedded within it, and our web tokens embedded within it. 19:52.420 --> 19:57.320 And part of the reason we do that is because it doubles our chance of getting the alert out. 19:57.320 --> 20:02.860 On some networks, maybe HTTP port 80 isn't allowed outbound. 20:02.860 --> 20:07.160 You know, only HTTPS is allowed outbound. 20:07.200 --> 20:10.140 So this wouldn't have gotten back to the console. 20:10.860 --> 20:17.700 But as long as the person that opened that Word file had working DNS, we would still get that back. 20:18.260 --> 20:23.700 You know, so we've got a really good chance of knowing when somebody opens one of these Word docs. 20:24.820 --> 20:32.460 And you can see we get a, you know, the user agent here doesn't give as many details, but we can see what version of Office they've got. 20:32.540 --> 20:40.100 But the key information here is somebody would have had to have physical access to my flash drive for this alert to trigger. 20:40.360 --> 20:44.560 And they were interested in this file out of all the files that were on my flash drive. 20:44.560 --> 20:47.640 This is, you know, the first token file that they opened. 20:47.640 --> 20:55.840 Let's say I had multiple token files on there with, you know, different file names suggesting they have different types of data in them. 20:55.840 --> 20:57.740 And they went after this one first. 20:57.740 --> 20:59.760 So that's useful to me also. 21:00.140 --> 21:07.860 And then I've got the, you know, both the DNS server that handed off that DNS token that triggered. 21:07.860 --> 21:11.640 And then the web token got out as well. 21:11.640 --> 21:16.440 So, you know, that's my actual IP address that's assigned to me by my ISP. 21:16.440 --> 21:25.480 That's what the web server sees when this Word document opens and it reaches back the canary token server that lives on the console here. 21:25.880 --> 21:31.100 So a couple useful pieces of information there that I can leverage. 21:34.460 --> 21:37.720 So, yeah, that's the Word.canary token. 21:38.100 --> 21:44.980 We do have, as you can see here, there's different tokens for all sorts of different purposes. 21:45.200 --> 21:50.360 And this is pretty similar to what canarytokens.org shows. 21:50.360 --> 21:54.740 I think we have almost every single one of these tokens there as well. 21:54.880 --> 21:58.480 The other one I'm going to show you here is the QR code token. 21:59.100 --> 22:01.740 This is a fun one because it's very versatile. 22:01.740 --> 22:06.920 There's a lot of ways that we see QR codes used in technology today. 22:06.920 --> 22:21.820 So setting up your multi-factor authentication, setting up, um, enrollment, you know, maybe into your MDM, EMM product. 22:22.620 --> 22:27.100 You know, you see them out and about in physical places all the time. 22:27.100 --> 22:31.560 You know, scan here for more information about this house that's for sale, that kind of thing. 22:31.820 --> 22:34.360 So the sky's the limit for how you can use these. 22:34.360 --> 22:37.740 You can use them digitally or you can use them in physical environments. 22:38.120 --> 22:43.840 So let's say I want to know if somebody gets into Adrian's lunchbox. 22:44.300 --> 22:47.360 You know, I don't want to know if somebody's just touched my lunchbox. 22:47.360 --> 22:49.540 I want to know if they've actually opened it. 22:54.660 --> 22:59.520 Because I've stuck this QR code on the inside of my lunchbox. 22:59.520 --> 23:14.060 I've printed this out, stuck it in there, um, you know, maybe put some text around it like, uh, recipe for Adrian's, uh, you know, Adrian's secret recipe, you know, handed down through the generations. 23:14.060 --> 23:17.300 Something to that, uh, that respect. 23:17.300 --> 23:20.360 You know, something somebody would be really interested in scanning. 23:21.080 --> 23:24.540 So I put this QR code there. 23:24.540 --> 23:35.660 If I ever get an alert on this, I know somebody has not only touched my lunchbox, but they've opened it up, they spotted the QR code on the inside, they read the words around it, and they chose to scan it with their phone. 23:35.780 --> 23:38.200 You know, that's the only way I would get that figure. 23:38.200 --> 23:39.920 So that's the power there. 23:39.920 --> 23:43.900 And, uh, we've seen people put these in all kinds of locations. 23:43.900 --> 23:58.060 Um, I think one of my favorites is somebody told me that the, uh, they print this out on a sheet of paper, they put the words Microsoft Authentic Recovery, uh, around it, and they just leave that sheet of paper on their desk at work and just wait. 23:59.740 --> 24:02.520 And, uh, that's great. 24:02.820 --> 24:05.760 Four people are checking out my lunchbox. 24:05.760 --> 24:07.420 They want to see that secret recipe. 24:07.420 --> 24:09.040 I know this one is me. 24:09.040 --> 24:11.320 You know, we, first of all, we just saw that source IP. 24:11.320 --> 24:13.220 Everybody knows this is me by now. 24:13.460 --> 24:18.160 Uh, we'll actually do a GeoIP look up here, um, get some details there. 24:18.320 --> 24:23.020 Uh, and, uh, you know, we can even see what kind of phone I'm using here. 24:23.100 --> 24:30.560 You know, we, you get different, uh, details out of these user agents, depending on, on how they're scanned, what devices scan them. 24:30.820 --> 24:37.320 Um, you know, so maybe there's some crazy situation where that, those kinds of details are useful. 24:37.720 --> 24:43.340 But, um, you know, the key point here again is I've only put this token one place. 24:43.600 --> 24:49.640 You know, it took me 30 seconds to do it, to scan it out, uh, tape it to the inside of my lunchbox. 24:49.760 --> 24:52.260 Um, but I can just leave it there forever. 24:52.260 --> 24:57.380 And if I ever get a trigger off of that, I know that somebody has been in that lunchbox. 24:57.380 --> 24:59.960 And maybe that lunchbox is, maybe it's not a lunchbox. 24:59.960 --> 25:00.900 Maybe it's a data center. 25:00.900 --> 25:02.520 Maybe it's a network closet. 25:02.680 --> 25:08.660 Maybe it's underneath the battery on a laptop, you know, all kinds of different places that you could hide these. 25:08.740 --> 25:12.440 It looks like we've got somebody from Oklahoma that scanned it. 25:12.440 --> 25:16.920 Again, you know, if you're coming through a VPN or something like that, that would be reflected here. 25:17.060 --> 25:21.240 Uh, but we've got, uh, an Android, uh, Pixel 3 XL. 25:22.280 --> 25:28.580 Um, we've got, uh, Mission Viejo, somebody coming from California. 25:29.320 --> 25:35.660 And, uh, a lot of these user agents will, um, refer to the application used, uh, to open it. 25:35.660 --> 25:41.420 Like I think that previous one we looked at, uh, ZXING, that's a barcode scanner app. 25:42.280 --> 25:45.560 And then one more here, uh, that would be Bradley. 25:46.280 --> 25:52.900 Uh, Bradley's in, uh, up very early in the morning in South Africa and scanned it with his iPhone. 25:56.170 --> 26:03.850 So hope that helps to, to demonstrate the, the power of how you can use these tokens, um, and, and how the canaries are used. 26:03.850 --> 26:17.490 And most importantly, when you see alerts from these, understanding what the attacker had to do to trigger those alerts and what it tells you about the attacker, where they are, and maybe even their, their motivations and where they're going to go next. 26:18.550 --> 26:22.510 And help you pivot between, uh, some of the different applications here. 26:22.870 --> 26:26.090 So really that's, that's it in a nutshell. 26:26.090 --> 26:27.650 I think we still have 20 minutes. 26:27.650 --> 26:32.190 If there's any questions, we could absolutely take some of those. 26:34.150 --> 26:35.670 Bradley, I appreciate it. 26:35.670 --> 26:37.810 This was a great, uh, great presentation. 26:37.810 --> 26:41.050 I did mark down a couple of questions that were asked during the presentation. 26:41.150 --> 26:51.190 Uh, does carrot, does canary token create, uh, or does the canary token created based off of the session plus protocol plus application? 26:51.190 --> 26:53.610 Is that, uh, uniquely identified? 26:55.930 --> 26:59.310 Um, I'm not sure I understand the question. 26:59.510 --> 27:07.490 Um, based off the... so it might help to talk about the primitives a bit more. 27:07.490 --> 27:13.770 That, that might answer the question if I talk about the web and DNS tokens that are kind of, uh, sit behind this. 27:15.250 --> 27:20.890 Yeah, I think that would be, um, the way to go, Adrian, is to look at how the token is being created. 27:20.890 --> 27:27.690 Because I think the question is related to whether it's being tripped by the protocol or the application. 27:28.350 --> 27:29.310 Okay. 27:29.810 --> 27:30.410 Yeah. 27:30.410 --> 27:33.690 So first one I'm going to create here is a web token. 27:34.890 --> 27:43.910 And I'm going to create a fake email in my inbox that makes it looks like, uh, if an attacker gets in my inbox, maybe they get all my passwords. 27:43.910 --> 27:47.450 They get access to my last pass instance or something like that. 27:47.610 --> 28:03.390 So I can take this web token and I'm going to create a link in this email that this fake email that I put in my inbox, and I'm gonna basically, uh, phish, you know, or social engineer the attacker into clicking it. 28:03.610 --> 28:06.890 And so what we're actually calling a token is this bit right here. 28:06.890 --> 28:10.790 This is the actual token that the web server is looking for. 28:11.030 --> 28:17.050 And this address here, and if you're using canarytokens.org, you know, it would be something based on that. 28:17.050 --> 28:24.610 You can run your own canary token server, use it on your own domain, you know, run your own docker canary token server. 28:24.610 --> 28:26.630 So this could be anything you want. 28:26.650 --> 28:28.730 This could also be anything you want. 28:29.270 --> 28:31.970 You know, we could name that admin files. 28:31.970 --> 28:32.810 We could name this 28:36.370 --> 28:37.670 password.db. 28:38.230 --> 28:41.350 And that's still going to trigger an alert when we go to that. 28:42.470 --> 28:50.690 So at its base component, and when we just demonstrated the QR code token, that's just using an embedded web token. 28:50.690 --> 29:01.470 So super simple way of doing it by reaching out, touching a web server with this token here, we know to map that back to Adrian's inbox. 29:01.470 --> 29:08.030 We know that that's the token associated with this memo, with this reminder that I set for myself. 29:09.250 --> 29:16.830 So I hope that answers the question of how that, how the token itself works. 29:17.070 --> 29:21.390 And that's the same token that we have embedded in a lot of these other ones. 29:21.390 --> 29:25.550 So the word file has a web token embedded in it. 29:26.190 --> 29:30.670 You know, I mentioned the QR code does, you know, and several of these others do. 29:30.850 --> 29:34.790 The other, what we call our token primitive is DNS. 29:35.950 --> 29:46.070 So again, there's ways to get, if somebody gets in my inbox, we can get a DNS name to resolve. 29:46.310 --> 29:53.950 So if I were to just copy this DNS name, and again, here, this bit is the token, you can tell kind of from the length of it. 29:53.950 --> 30:00.210 And really, it's a C name on the front of this domain, you know, that maps back to us. 30:01.090 --> 30:06.850 So if I do an NS lookup on that, I get an alert. 30:08.050 --> 30:17.550 So wherever I've, that NS address, if anyone resolves it, if it gets resolved for any reason, maybe I'm just sending it in clear text on the network. 30:17.770 --> 30:28.230 Somebody captures that traffic with Wireshark, and they view that traffic, and they tell Wireshark to resolve all the DNS addresses, that would trigger it, you know, something as simple as that. 30:28.230 --> 30:41.950 But if I can find files, you know, any kind of tricks, any kind of ways to get a DNS address resolved, that can trigger a token and send me an alert. 30:43.170 --> 31:04.690 Yeah, just to add on to what Adrian mentioned, is that we're embedding HTTP requests and a DNS request inside of a document, and we're relying on, when the document gets opened with MS Word, for instance, MS Word reaches out with those, to those URLs of the DNS. 31:04.690 --> 31:12.870 So it's MS Word, the application itself, that's looking up those requests that I embedded into the document, and that's what's triggering the alert. 31:14.250 --> 31:25.170 Yeah, and that's important to note, you know, some of these require action from the attacker, like in my example of the fake email in my inbox, I've got to get, I've got to convince them to click that link. 31:25.430 --> 31:32.310 In other cases, like Bradley's example with the Word doc, simply opening it is all they need to do. 31:32.310 --> 31:39.090 You know, they don't see it, it happens in the background, they don't even know that those alerts have been triggered. 31:40.530 --> 31:42.890 And there's nothing else that they need to do. 31:48.390 --> 31:50.010 Well, I appreciate it. 31:50.010 --> 31:51.270 Thank you, Bradley. 31:51.390 --> 31:52.550 Thank you, Adrian. 31:52.550 --> 31:54.510 This has been a great presentation. 31:54.510 --> 32:02.050 So this concludes the presentation for the workshop for Canary. 32:02.810 --> 32:10.550 In any case, if you have any follow-up questions, the speakers will be around in the Discord for a few minutes. 32:10.550 --> 32:22.970 And again, the Discord that we are chatting in is the text dash workshops dash track one, in the Flamingo Hotel group, just scroll all the way down to the bottom. 32:23.510 --> 32:27.950 And so if you guys could sort of come down, I think there's a couple of questions. 32:27.950 --> 32:30.250 If you have some follow-up, that would be great. 32:30.390 --> 32:34.870 Otherwise, I appreciate everybody listening in today and thank you very much for attending.