News for hackers. Stuff that matters.

A comment on Running a fake power plant on the internet for a month. Parent comment

Re:Running a fake power plant on the internet for a month by merlinscholz on Saturday January 16, 2021 @09:48AM (#25802508)
Internal honeypots as early warning system are called Canaries. Usually they run on a just slightly outdated and vulnerable software version, so that an attacker does not need credentials.

One example would be emulating a forgotten file server with SMB1 enabled. The homepage of Thinkst Canary https://canary.tools/ gives a good overview.

[ Parent | on HN ]
Re:Running a fake power plant on the internet for a month by waihtis on Saturday January 16, 2021 @09:57AM (#25802564)
Canaries has been pretty much replaced by decoys as the "official" term, as denoted by the MITRE SHIELD framework:

https://shield.mitre.org/matrix/

[ Parent | on HN ]
Re:Running a fake power plant on the internet for a month by qwantim1 on Saturday January 16, 2021 @01:29PM (#25804181)
Canary (in a coal mine) makes more sense to me if the goal is an early warning system.
[ Parent | on HN ]