What are Canaries, and how do they Work?

A Canary token alerts you to the presence of an intruder who has found the token. It's like a username and password that doesn't belong to an actual user but an intruder who stumbles across it would have no way of knowing that. It is actually a genuine set of credentials, but to one of our protected systems not to one of yours.

An attacker is very likely to attempt to use it to try to penetrate further layers of security. And when they do, an alert is triggered, warning you of their presence.

Canaries are sometimes also known as sentinels, or decoys, because of this way they detect intrusion.

The Canary in the Coal Mine, how Canaries got their name

In the late nineteenth century Scottish physiologist John Haldane identified Carbon Monoxide as the toxic gas responsible for a mining disaster. This colourless, odourless gas was difficult to identify and detect - just like the intruders who have gained access to systems can be. The solution was small Canary birds, that with their fast metabolism responded to the presence of the toxic gas much faster than people, and before major harm occurred.

By taking these birds into the mine with them, people could be alerted to danger and take action to prevent disaster. This is how something that provides an early warning came to be known as a Canary.

Thankfully Haldane also developed a device that could resuscitate the canaries by supplying oxygen, so they weren't harmed by their helpful service!

Canaries and Honey Pots

An advantage of Traitorbird canary tokens over honey pot servers is that our canaries require absolutely no access to your device or systems. You don't need to run an extra appliance or server with associated costs, and there is no way that using a canary token can introduce additional vulnerabilities.

A honey pot server however could, potentially, include vulnerabilities of its own that allow attackers persistence in your network. Or if the appliance communicates outside your network it could provide a path for the exfiltration of data, or even for an initial intrusion. Canary tokens have none of these risks, because none of our code runs in your systems at all.

Enter your email to sign in, and create your own canary tokens to protect your assets: