Canary in Cyber security

Introduction

Cyber security is meant to provide security to the cyber/ internet/ IT world. It aims to secure the organization against cyber-attacks by using various security products. Not just data, applications or software, but network and physical devices need security measures to keep them safe from inner or outer attacks.

For this purpose, security may use industry terms or a slew of buzzwords like firewall, ransomware, encryption, artificial intelligence, cloud, zero-day, botnet and next generation to capture the attention and secure you in terms of solving user problems and providing all-around security. The cyber security products available in the market with the endless list of available options help reduce efficiency and effectiveness and ultimately negatively impact overall security.

All security programs have defending programming, including preventing breaches and intrusion, as their top priority, but when an intrusion occurs, the situation changes. Rather prevention is the key to success, but detection is equally important because prevention is not 100% guaranteed to stop all the cyber-attacks. An organization takes about six months to detect or longer to identify a breach. This higher cost of remediation can result in a loss in business.

To conquer this, cyber security experts find a mediocre way to lie between prevention and curing of cyber-attack and this is termed alarming cyber-attack. This is a new concept taken from the early 90s and designed as a product to increase the detection of malicious actors inside an environment named Canary.

Canary is a bird used in the mining process up to the late 20th century to detect dangerously high levels of toxic gages such as carbon monoxide in the mines and protect them from inhaling dangerous substances. The canary bird suddenly dies after inhaling the poisonous gases. Therefore, it alarms the workers to stop mining; the danger is waiting ahead.

Canary in cyber security

In cyber security, cyber security experts of a company, Thinkst, deploy or create a virtual or physical device that can be intimate with any device in various configurations. It works similarly to a honeypot, based on a cloud, physical or virtual device capable of mimicking any device in any configuration. It results in a token that can track user actions online.

The canaries present in the network send messages to the admin or others when they encounter a threat. Two main functions of canaries in the IT field are:

• They provide information to the IT team about the attacker's methodology
• Helps pinpoint a hacker’s attack surface of choice

The best part of canaries is that they can be preconfigured by the user to be deployed and ready to strengthen security within minutes. These canaries are cost-effective as they don't need a lot of time-consuming maintenance and soon gather all the information about the threat. This also empowers the IT staff to respond appropriately and quickly.

Canary honeypots

Canary honeypots create a virtual network mimic system that may attract an attacker. Once the attacker gets into this trap, the administrator studies their behaviour of attacking.      

Canary tokens

Canary tokens are programmed to track the behaviour of cyber criminals by implanting them in regular files. When cybercriminals open these tokens, their token name, IP address and time of file accessed is traced. When files are accessed or executes a process, a certain message is sent to the person who implanted the token so that they can track the functioning.

Canary tokens create a canary trap sold by vendors like ThinkSt Canary or Red Canary. These are physical devices found on http://redcanary.com or http://canary.tools.com. It can also be available in "soft" canary form such as:

URL token	When the user visits a specific URL
Unique email address	When a specific email address is emailed
Word document	When the user opened a word document
DNS token	When the user requests a specific DNS hostname
PDF document	When a particular PDF document is viewed or opened
Window folder	When a certain window folder is viewed or opened
Image token	It is created when a specific image is viewed or opened
Canary free token can be set up at: canarytokens.org/generate

Canary tokens are used for or at certain places:

• Canary tokens are placed inside DNS or another mechanism
• For intellectual property
• For personal identifiable information
• Placed inside the files (mock filed handles the sensitive data)
• Tokens can be placed in databases (when someone tries to extract the database content, they can be notified)    

Note: Honeypot and canary tokens have the same goals but are programmed with different approaches. Where one side, the honeypot pretends to be an attractive target for a cyber-criminal or a place for them to play; on the other side, the canary token gives attackers a toy to play with. The common point is that both can trap the attacker, and once they are trapped, IT security teams can gather valuable information about them.

Terms related to canary

Canary objects: When canary folders and canary files are combined, they are known as canary objects. These objects are not on external hard drives like USB or network devices.

Canary folder: Canary objects are installed in the root folders named as a canary folder in (C:\, D:\ etc.)or in the machine's main directory (C:\Users).   

Canary files: Canary folders contain the canary files. These files or folders use a combination of random common English words or random letters and come in a variety of common file types.

Note: Canary objects can be visible or hidden depending on deployment type. Users must maintain balance with these canary objects as some are deployed visible, and some are hidden. Visible canary objects alarm users who don't understand what they are or why they are there.

So, it's necessary to share information about the canary object in a limited way because too much sharing of information should be risky. Less knowledge of canary files or objects to hackers will help the IT ecosystem to protect against an actual ransomware attack.      

How does canary help?

Canary is programmed to protect networks, systems or applications and provide advance alerts to users, informing them about potential dangers. It is an ongoing threat monitoring system that helps IT teams gather information about the attacker's methodology.

When canaries are strategically positioned throughout the network, they can alert admins about how and when attackers try to penetrate the system.

Canaries tokens are fitted in the system and act like LoJack (a stolen vehicle recovery system for network defenders). They prevented attaining sensitive data and proved it like traditional spyware.