Breach Detection At Scale With AWS Honey Tokens
summary
Demonstrates generating inert AWS access keys instrumented to trigger logging and alerts, builds an open source CloudFormation deployment called Project Space Crab that creates denial-policy honey tokens, stores annotations, and wires Lambda processors to send notifications. Runs experiments posting keys to GitHub and Pastebin, finds ~83% of GitHub tokens are used within ~30 minutes versus ~9% on Pastebin, supports up to 10,000 tokens per account, and shows the system works for large-scale breach detection.
AI-written summary · about
chapters (11)
- 0:00Introduction and demo
- 2:24Understanding honey tokens
- 3:46AWS access keys as traps
- 9:12Scaling with space crab
- 11:30Space crab architecture
- 13:47Alerting and demonstration
- 15:29Deployment and usage
- 17:32The impact of honey tokens
- 19:41Experimental findings
- 22:05Credential exposure stats
- 24:07Conclusion and call to action
related talks
34mWho Goes There? Detecting Intruders With Honeytokens
39mPerils of the cloud
47mBreaking the Cloud to Rebuild It: A Tale of 3 ☁️ Breaches!
17mPreventing unauth'd credential access on GitHub using AWS services
40mBeyond Public Buckets: Lessons Learned on Attack Detection in the Cloud
20mFantastic AWS Attacks and Where to Find Them
39mApisecure, 14 & 15 March 2023 - Jose Palafox, Director of Business Development at GitHub.
31mCloud Hacking Scenarios