[dropcap]A[/dropcap] South African information security start-up, known for its slightly unconventional approach to network defence technology, is preparing to launch two new commercial products. Thinkst’s new Virtual Canary and Cloud Canary are currently in beta and soon will complement the company’s existing Canary commercial and open-source “honeypot” products.
Thinkst Applied Research shook up the network security market in 2015 when it re-introduced an idea that had largely been discarded in infosec circles: the network honeypot. Thinkst, re-introduced not only a concept that had become unfashionable but did it with an appliance in an era where heuristic intrusion detection software had become the norm.
The Canary was a small device that could simply be deployed on a network and could imitate network appliances with minimal setup.
The Canary could be used to mimic a Windows or Linux server, a router, or even network-attached storage in minutes. The idea is that any intrusion on the network would likely interact with the Canary either by scanning ports or by attempting to access files or services. This then delivers an alert to a management console, creating an intrusion detection system.
The Canary is typically “quiet” in that it doesn’t generate any alerts or information if not accessed. Typical heuristic detection software triggers many false positives, and this “noise” makes it difficult for over-stretched security teams to spot real issues. By contrast, any and every alert from a Canary is important, as there can be no false positives. If an alert is triggered, that means that the device is being accessed, and since the Canary has no organisational purpose there can be no legitimate reason for that to be the case.
Intrusion
Only a single alert is required to indicate intrusion, which means that even if an intruder identifies the Canary as a honeypot and acts to isolate it or avoid it, that simple process of identification will trigger the alert.
The Canary doesn’t offer any defence to the organisation other than detection, but given the asymmetry between network attackers and defenders, early detection of a breach is highly important. In some recent high-profile cases, intruders had access to networks for months and even years, and in many cases were only made aware of the breach by third parties.
In the case of the breach of Target in the US, the intruders had access to its system for months, even though Target employed heuristic intrusion detection software. The problem was simply that this software generated so many false positives that the infosec team had disabled some of the alerts.
For any organisation having a malevolent entity on a network for any length of time is a huge risk. Recent research by the Ponemon Institute identified that, in South Africa, organisations that suffered a breach took an average of 155 days to identify the breach — five months of activity before countermeasures could be taken to mitigate the impact. By providing a single alert, the Canary provides a similar utility to that of its namesake in a coalmine: ensuring that the danger is known.
Thinkst Applied Research was founded by Haroon Meer, a well-respected network security researcher, in 2010. Meer had been the technical director of Sensepost, probably the premier offensive network security shop in South Africa. His idea for Thinkst was a bit different. Rather than focusing on offensive hacking and penetration testing, he wanted to take that offensive curiosity and creativity and apply it to defence. The team grew, bringing in some additional ex-Sensepost staffers, and it soon introduced their first product, Phish5.
Phish5 allows organisations to “phish” themselves — giving the network team the ability to identify users that are susceptible to phishing, and to offer training to mitigate that threat. The service is still run daily in many high-profile companies throughout the world. Building on this, the team began to develop the honeypot detection solution that they felt was needed — the Canary. Until then, honeypots were mostly used as an academic way to profile and learn about intruders; they hadn’t been set up as breach detection systems.
Following the success of the Canary devices, Thinkst released another open-source software tool available for anyone to set up lightweight Canary alerts. These Canary Tokens, while not as feature-rich as the hardware solution, can be installed into multiple services and provide similar alerts. These tokens act as software tripwires, hidden within servers, SQL databases, webpages or even Windows folders and provide SMS and e-mail alerts if accessed. Canary Tokens are quick to deploy and the fact that they’re open source and free has added to their popularity. They have been deployed and triggered around the world tens of thousands of times since their inception in 2015.
Thinkst is now moving beyond hardware and simple canary scripts. Currently in beta and due for launch soon, Cloud Canary and Virtual Canary will offer the advantages of the hardware Canaries to some areas where deployment of devices isn’t feasible.
“Now that we have refined and fine-tuned the Canary solution, we have been working on moving this to a purely virtual solution and a solution that lives in Amazon EC2 — Virtual Canary & Cloud Canary respectively,” Meer said.
The products offer the same zero-admin overhead, quick deployment and configuration, but live in the cloud or in a virtual server environment. “This gives organisations more deployment options and, in the case of Cloud Canary, gives a rare warning indicator in an otherwise ignored section of the network: your cloud.” The two new products will be launched this quarter. — © 2017 NewsCentral Media
