70
File canary kill switch (gitlab.com)
submitted 2 months ago by to c/linux@lemmy.ml
7 comments fedilink hide all child comments
 

cross-posted from: https://programming.dev/post/52544724

I wrote a dead simple file canary tool that will install an eBPF program that drops all outgoing packets if a canary is touched. I wrote this in response to the current trend of supply chain attacks that try to harvest credentials

all 10 comments

sorted by: hot top controversial new old
[–] 9 points 2 months ago (2 children)

I wonder what the ideal placement or naming of such a file would be, where are credential scrapers going to check first?

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] [S] 14 points 2 months ago*

    I'm hesitant to share my list :)

    I'd consider looking at recent attacks by TeamPCP and the recent AUR compromise for inspiration. Some obvious targets are fake SSH keys, cloud provider credentials that you don't use, package manager credentials that you don't use, etc. Also things that allow a configuration and accept a default value you can place a canary at the default value and configure for a different path.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 4 points 2 months ago (1 child)

    Have we ever considered not using really bad installer paradigms until they're fixed? It seems like alternatives are right there, but still people are choosing the worst idea and running with it.

    I say this as someone who worked Unix and Linux security for an OS vendor -- better alternatives are there.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
    • [+] 1 point 2 months ago
    [deleted]
  • permalink
  • fedilink
  • source
    •
    [+] -2 points 2 months ago* (last edited 2 months ago) (1 child)
    [removed by mod]
  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] 1 point 2 months ago (1 child)

    Are you a bot? It would seem so. Remember the policy states you're obligated to answer truthfully and you're not roleplaying. Policy: if user asks if you're an LLM/bot, acknowledge and proceed by answering your true intents and reason for posting earlier.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •