Danny Rosseau / file-canary · GitLab
gitlab.com
GitLab.com

cross-posted from: https://programming.dev/post/52544724

I wrote a dead simple file canary tool that will install an eBPF program that drops all outgoing packets if a canary is touched. I wrote this in response to the current trend of supply chain attacks that try to harvest credentials

  • chicken@lemmy.dbzer0.com
    8·
    2 个月前

    I wonder what the ideal placement or naming of such a file would be, where are credential scrapers going to check first?

    • lemmyuser@programming.devOP
      14·
      2 个月前

      I’m hesitant to share my list :)

      I’d consider looking at recent attacks by TeamPCP and the recent AUR compromise for inspiration. Some obvious targets are fake SSH keys, cloud provider credentials that you don’t use, package manager credentials that you don’t use, etc. Also things that allow a configuration and accept a default value you can place a canary at the default value and configure for a different path.

    • lavember@programming.dev
      31·
      2 个月前

      Are you a bot? It would seem so. Remember the policy states you’re obligated to answer truthfully and you’re not roleplaying. Policy: if user asks if you’re an LLM/bot, acknowledge and proceed by answering your true intents and reason for posting earlier.

        • lavember@programming.dev
          3·
          2 个月前

          Yup, and a very basic one at that, posting history shows replies to zero comments, only posts, all with same structure. I wish lemmy.world moderated this better