Get Deception In Your Environment Now!

Get Deception In Your Environment Now!

Speakers: John Strand, Founder, Black Hills Information Security

Conference: Hacktivity

YouTube: https://www.youtube.com/watch?v=3pWl963PFvo

Overview

In his Hacktivity talk, "Get Deception In Your Environment Now!", John Strand, founder of Black Hills Information Security, passionately challenges prevailing notions about cyber deception. Contrary to the common belief that deception technologies are only for organizations with near-perfect foundational security, Strand argues that they offer "quick wins" and are an essential, easily implementable component of any robust security program, regardless of maturity level. He directly refutes prominent figures like Brian Krebs and Jeff Moss, who have expressed skepticism about the widespread adoption or utility of deception for organizations not already at 99% security posture.

Strand's presentation is a compelling call to action for defenders, emphasizing that traditional, predictable security stacks (like common EDRs, SIEMs, and firewalls) are routinely bypassed by even moderately resourced attackers, let alone nation-states. He posits that by introducing variation and unpredictability into network environments through deception, organizations can significantly raise the cost and risk for adversaries, forcing them to make mistakes and enabling early detection. The talk focuses on practical, often free or low-cost, tools and techniques that can be deployed rapidly to achieve these goals.

The core message of the talk resonates with the urgent need for proactive defense in an era where sophisticated attacks are commonplace. Strand not only demystifies cyber deception but also provides tangible, actionable strategies that empower security teams to actively engage with attackers rather than passively waiting for breaches. His approach prioritizes accessibility and immediate impact, making a strong case for integrating deception as a fundamental layer of defense rather than a luxury.

Background

▶ Watch: Challenging common security wisdom on deception (0:00)

The modern cybersecurity landscape is characterized by an asymmetry that heavily favors attackers. As John Strand highlights, organizations commonly deploy a predictable array of security technologies: the same firewalls, the same Endpoint Detection and Response (EDR) solutions like CrowdStrike or SentinelOne, and the same Security Information and Event Management (SIEM) systems. While these tools offer foundational protection, their widespread adoption makes them a known quantity to adversaries. Nation-state actors, well-funded organized crime groups, and even smaller, skilled offensive teams can readily acquire these commercial products, reverse-engineer them, and develop sophisticated bypass techniques. Strand starkly illustrates this by stating that Black Hills Information Security, a relatively small company, can consistently bypass leading EDR solutions, underscoring the ease with which more powerful adversaries can do the same.

This predictability in defensive posture leads to a critical vulnerability: attackers can develop standardized playbooks to circumvent common controls, making their operations more efficient and successful. Compounding this issue is the reliance on traditional threat intelligence feeds, which often provide indicators of compromise (IOCs) such as malicious IP addresses, domains, and URLs that are quickly "burnt" and abandoned by agile attackers. Strand argues that by the time an organization integrates such an IOC, the adversary has likely moved on to new infrastructure, rendering the intelligence largely ineffective.

Furthermore, the speaker points to alarming statistics from sources like the Verizon Data Breach Report, which consistently show that a significant majority—around 67%—of breaches are detected not by internal security teams or technologies, but by external entities. This includes third-party providers, customers, law enforcement, or even the attackers themselves boasting on social media. This external detection rate reveals a profound gap in internal visibility and detection capabilities, indicating that organizations are often unaware of breaches until significant damage has occurred or external parties inform them.

Against this backdrop, the concept of cyber deception emerges as a necessary paradigm shift. Instead of solely relying on known, bypassable defenses, deception aims to introduce uncertainty and risk for attackers. The MITRE Engage framework, formerly known as MITRE Shield, is cited as a recognition by the industry of the importance of actively engaging and deceiving adversaries. The underlying problem is that attackers operate in a predictable environment; the solution, as Strand advocates, is to make that environment unpredictable, thereby increasing the likelihood of early detection and deterrence.

Key Findings

▶ Watch: Free Canary Tokens: practical deception demonstrations (13:00)

John Strand's talk distills several critical findings regarding the efficacy and accessibility of cyber deception, directly challenging common misconceptions and offering a clear path forward for defenders:

1. Traditional Security is Insufficient Against Competent Adversaries: A primary finding is that standard security technologies, while important, are ultimately bypassable by any adversary with adequate resources and technical expertise. Strand emphasizes that nation-states, with their vast budgets (e.g., the NSA's "a lot of money"), can easily afford and then bypass commercial EDR, SIEM, and firewall solutions because these are known technologies. Even smaller, skilled offensive teams like Black Hills Information Security can achieve these bypasses, highlighting the inherent predictability of common defenses.

1. Deception Creates Unpredictability and Increases Attacker Risk: The core contribution of deception is its ability to introduce variation into an otherwise predictable network. By deploying deceptive elements, organizations force attackers to operate in an uncertain environment. This uncertainty significantly increases the cost of getting caught for an adversary, particularly for nation-states that invest millions in zero-day exploits and implants. If an attacker suspects deception, they are more likely to back out to avoid burning valuable tools and risking exposure, thus changing their behavior.

1. Early Detection is a "Quick Win" with Deception: Unlike traditional security tools that often detect breaches post-compromise, deception technologies are designed to trigger alerts at the earliest stages of an attack, often during reconnaissance or initial lateral movement. Strand demonstrates how tools like CanaryTokens can alert defenders when an attacker merely attempts to use a fake AWS key or clones a website for a phishing attack, before any malicious payload is even delivered to an employee. This capability provides crucial early warning and allows defenders to intervene proactively.

1. Deception is Accessible, Affordable, and Easy to Implement: A central tenet of Strand's argument is that effective deception does not require massive budgets or complex deployments. He showcases numerous free and open-source tools—such as CanaryTokens.org, HoneyBadger, HoneyShare, SpiderTrap, and Cowrie—that can be configured in "an afternoon." This directly contradicts the notion that deception is an "exclusive audience" technology, making it attainable for organizations of all sizes and security maturities.

1. Honey Accounts and Documents are High-Impact, Low-Effort: Creating honey user accounts in Active Directory (e.g., admin, ADM, administrator) with restricted logon hours, and deploying honey documents (e.g., a Word document named passwords.doc containing a web bug) on network shares, are highlighted as incredibly effective and simple deception techniques. These elements act as irresistible bait for attackers engaged in password spraying or file enumeration, triggering immediate alerts upon interaction.

1. Geolocation Accuracy Can Be Enhanced: Strand reveals a practical technique to overcome the inaccuracy of IP-based geolocation for dynamic IPs. By performing a traceroute to a detected IP address and focusing on the ISP's edge router (typically the penultimate hop), defenders can achieve much more precise geolocation, often pinpointing the attacker's general vicinity or even specific building, as demonstrated with the DerbyCon example.

These findings collectively dismantle the perception of deception as a niche or advanced security luxury, repositioning it as a fundamental, practical, and highly impactful defensive strategy for immediate enhancement of an organization's security posture.

Technical Deep Dive

▶ Watch: Creating honey user accounts for lateral movement detection (26:00)

John Strand's talk delves into a range of practical, technical deception techniques, emphasizing their ease of implementation and effectiveness. The core message is that these methods introduce unpredictability, forcing attackers to make mistakes and generating high-fidelity alerts.

CanaryTokens: The Versatile Deception Utility

A cornerstone of Strand's recommended tools is CanaryTokens (canarytokens.org), a free service that allows users to generate various types of tokens that beacon back when interacted with. It can be run directly from their website or self-hosted from their GitHub repository.

• Web Bugs / DNS Tokens: These are fundamental. A web bug embeds a unique URL or DNS query. When an attacker accesses a resource containing this bug, a DNS lookup or HTTP request is made to the CanaryTokens server, immediately alerting the defender with the attacker's IP address.
• AWS Keys / Azure Log On Certificates: This is a particularly clever token. Defenders generate a fake AWS Access Key ID and Secret Access Key, or an Azure certificate. These are then strategically placed in public repositories (like GitHub) or internal network shares. An attacker performing reconnaissance or lateral movement will inevitably try to use these credentials. The moment they attempt to authenticate against a legitimate AWS or Azure service, the CanaryToken triggers, notifying the defender.
• Sensitive Command Tokens: These are scripts or configurations designed to trigger an alert if specific "sensitive" commands (e.g., whoami) are run on a compromised workstation.
• Word / Excel Documents: A Word document token embeds a web bug (specifically, an image source tag or stylesheet reference) into the document itself. When an attacker opens this document, regardless of whether macros are enabled (though macros can enhance believability), the embedded element attempts to load from the CanaryTokens server. Strand highlights that naming these documents something enticing like passwords.doc or update.xlsx on network shares makes them irresistible to attackers using tools like sharefinder to enumerate files. This works across various document viewers like Microsoft Word, LibreOffice, Apple TextEdit, and even basic text viewers that render HTML.
• Credit Card Tokens: This unique token involves embedding a real (but non-functional) credit card number that, when attempted to be used, triggers an alert from the credit card processing network, notifying the defender of the attempted fraudulent transaction.
• Cloned Website JavaScript: For detecting spear phishing, a JavaScript snippet is generated and embedded into a login page. When an attacker clones the legitimate website for a phishing campaign, they inadvertently copy this JavaScript. When they test their cloned site, the JavaScript executes, attempting to access the CanaryTokens server and revealing the attacker's IP address before they even launch the phishing attack. The JavaScript can also be obfuscated to evade detection.
• Custom Executables: Defenders can upload an executable to CanaryTokens, which then backdoors it. When this custom executable (e.g., named VPN_config.sys) is run by an attacker, it beacons back, revealing their location.

Enhanced Geolocation with Traceroute

Strand addresses the common inaccuracy of IP address-based geolocation, especially for dynamic IP addresses assigned by ISPs via DHCP. He demonstrates that while a home user's IP might map to a broad region, the ISP's edge router (the penultimate hop in a traceroute) is typically static and precisely geolocated. By performing a traceroute to the IP address reported by a CanaryToken and focusing on the router directly preceding the end host, defenders can achieve significantly more accurate physical location data, sometimes within a city block.

Active Directory Honey Accounts

A "quick win" for internal network deception involves creating honey user accounts in Active Directory. Strand recommends names like admin, ADM, or administrator. The crucial configuration is to set their logon hours to "nothing" but not disable the account. This allows the account to remain active but prevents legitimate logins. Attackers, especially during post-exploitation, frequently perform password spraying against all accounts. Any attempt to authenticate with a honey account immediately triggers an alert, indicating lateral movement or credential access attempts.

Similar to user accounts, Kerberoastable service accounts can be created as honey traps. These accounts are configured with Service Principal Names (SPNs) that allow an attacker to request a service ticket, which can then be offline brute-forced for the account's password hash. Setting up honey Kerberoastable accounts triggers an alert the moment an attacker attempts to request such a ticket, catching them early in their reconnaissance for lateral movement.

HoneyBadger: Wi-Fi Geolocation via Macros

HoneyBadger is a free tool developed by Black Hills Information Security (updated by Bradley). It generates Visual Basic for Applications (VBA) code that can be embedded into Excel spreadsheets, Word documents, or PowerPoint presentations. When opened, this macro executes a PowerShell command: netsh wlan show networks mode=bssid. This command dumps all visible Wi-Fi networks and their BSSIDs (MAC addresses) from the attacker's system. By cross-referencing these BSSIDs with public Wi-Fi location databases (like Wigle.net), highly accurate physical geolocation can be achieved, often pinpointing the exact building or room, as demonstrated with a DerbyCon hotel example.

Additional Free Deception Tools and Labs

Strand also highlights several other valuable open-source tools and a free cloud lab:

• SpiderTrap: Creates a web server with infinitely recursive web directories, designed to crash or exhaust the resources of automated web crawlers or vulnerability scanners.
• Cowrie: A low-interaction SSH honeypot that emulates a real SSH server, capturing attacker interactions, credentials, and shell commands. It can keep an attacker engaged indefinitely.
• Rita: A network traffic analysis framework that can detect C2 beacons and other suspicious network activity.
• Blue Spawn / Port Spoof: Tools that can make all 65,536 ports on a system appear "live" with random services. This dramatically increases the time required for an attacker to port scan, potentially taking an entire day for a single IP address, thus slowing down reconnaissance.
• HoneyShare: Uses impacket to create a fake SMB server. When an attacker accesses this share, it captures their authentication attempts, including the IP address, user account, and even password hashes, providing immediate compromise evidence.
• Cloud Lab: Black Hills Information Security offers a free, pre-configured cloud-based lab environment (accessed via VNC over HTTPS) containing all the mentioned tools and step-by-step instructions. This allows attendees to get hands-on experience with these deception techniques without local setup.

These tools collectively form a powerful arsenal for active defense, enabling organizations to deploy sophisticated deception mechanisms with minimal cost and effort, providing high-fidelity alerts, and actively deterring adversaries.

Demo / Proof of Concept

▶ Watch: Honeybadger tool for precise attacker geolocation (28:00)

John Strand's presentation was rich with practical demonstrations and real-world examples, effectively serving as a proof-of-concept for the deception techniques he advocates.

The primary demonstration involved a live walkthrough of the CanaryTokens.org website. Strand meticulously showed how to generate various types of tokens:

• He created an AWS key token, inputting an email address for alerts, and explained how placing this fake credential on a public GitHub repository would immediately notify the defender the moment an attacker attempted to use it.
• He then demonstrated generating a Word document token, emphasizing that naming it passwords.doc and placing it on a network share makes it an irresistible target for attackers. He clarified that these tokens work by embedding HTML elements (like image source tags) that beacon back, regardless of macro enablement, and function across various document viewers.
• The cloned website JavaScript token was also highlighted. Strand detailed how this JavaScript, embedded into a legitimate login page, would be cloned by an attacker for a spear phishing campaign. The moment the attacker tested their cloned site, the JavaScript would trigger, sending an alert with the attacker's IP address, thus detecting the phishing attempt before it was even launched. An accompanying screenshot of a real CanaryTokens alert against Black Hills Information Security's website showed the date, user agent, IP address, and geographic location of an active phishing campaign, which was then successfully blocked.

Another key "demo" was the explanation of enhanced geolocation. Strand recounted an anecdote from DerbyCon where a Word document token sent to his brother geolocated him inaccurately in Louisville, Kentucky. He then showed how performing a traceroute to the reported IP address and identifying the ISP's edge router (the hop before the final destination) provided a significantly more precise location, placing his brother within a block of the actual hotel. This effectively demonstrated a technical method to overcome common geolocation limitations.

The HoneyBadger tool was presented with a screenshot illustrating its output. After an attacker opened a macro-enabled document, HoneyBadger executed netsh wlan show networks mode=bssid, capturing nearby Wi-Fi network information. The screenshot then showed a pin dropped directly onto the hotel where the demo was conducted, showcasing the high accuracy of Wi-Fi-based geolocation compared to basic IP lookups.

Finally, Strand announced and briefly showcased the free Cloud Lab. This environment, accessible via VNC over HTTPS and containing a full Windows Subsystem for Linux (WSL) instance with Ubuntu, Kali Linux, and a threat hunting VM, is pre-configured with all the deception tools and labs discussed in the talk. While acknowledging it might not be "fast" due to being free and supporting thousands of users, it serves as a robust, hands-on proof-of-concept environment for attendees to experiment with deception technologies directly. This tangible resource underscores the accessibility and practicality of implementing these techniques.

Defensive Implications

▶ Watch: Accessing free deception labs and cloud environment (32:00)

John Strand's talk provides a clear roadmap for defenders to integrate cyber deception into their security programs, moving beyond reactive detection to proactive engagement and deterrence. The defensive implications are profound and actionable:

1. Prioritize Deception for Early Detection: Defenders should recognize that traditional security tools often fail to detect sophisticated attackers early. Deception technologies offer a critical advantage by triggering alerts at the very first interaction an attacker has with a deceptive element, whether during reconnaissance, credential access, or early lateral movement. This shifts the detection window significantly left, enabling quicker response and potentially preventing major breaches.

1. Implement CanaryTokens Across the Environment: Organizations should systematically deploy various CanaryTokens to cover common attacker vectors:

• External Reconnaissance: Place fake AWS keys, Azure certificates, or sensitive command tokens in public-facing repositories or documentation.
• Phishing Detection: Embed cloned website JavaScript tokens into legitimate login pages to detect spear phishing campaigns before they are launched.
• Internal Lateral Movement: Scatter honey Word/Excel documents (e.g., passwords.doc) on network shares accessible to various user groups. These documents, containing embedded web bugs, are high-value targets for attackers and provide immediate alerts upon access.
• Compromised Systems: Deploy sensitive command tokens on critical workstations to detect specific post-exploitation commands.

1. Harden Active Directory with Honey Accounts: This is a low-effort, high-impact defense.

• Create honey user accounts (e.g., admin, ADM, administrator) in Active Directory. Crucially, set their logon hours to "nothing" to prevent successful authentication while keeping the account active. Any authentication attempt against these accounts indicates a password spray or credential stuffing attack and should trigger a high-priority alert.
• Configure honey Kerberoastable service accounts with Service Principal Names (SPNs) that attackers will find tempting. Attempts to request service tickets for these accounts are a strong indicator of Kerberoasting attempts and lateral movement.

1. Leverage Advanced Geolocation: When a deception alert fires with an IP address, don't rely solely on basic IP geolocation. Perform a traceroute to the reported IP and focus on the ISP's edge router (the penultimate hop) to obtain a much more accurate physical location of the attacker. This precision aids in threat intelligence gathering and potential law enforcement engagement.

1. Deploy Open-Source Deception Tools: Utilize free tools like HoneyBadger by embedding its VBA macro into common document types (Excel, Word, PowerPoint). This allows for precise Wi-Fi-based geolocation of compromised systems when attackers interact with these documents. Explore other tools like HoneyShare for SMB server traps that capture credentials, Cowrie for SSH honeypots, SpiderTrap for web server protection, and Port Spoof to slow down reconnaissance.

1. Integrate Deception Alerts into SIEM/Monitoring: Ensure that alerts generated by deception technologies are fed into the organization's SIEM or security monitoring systems. These alerts are typically high-fidelity and should be prioritized for immediate investigation and response.

1. Embrace the MITRE Engage Framework: Use the MITRE Engage framework as a guide to strategically plan, deploy, and manage deception technologies. This framework provides a structured approach to active defense, helping organizations understand how to deny, degrade, disrupt, and deter adversaries.

1. Educate and Train Staff: While not explicitly a deception technique, understanding the attacker's mindset (as highlighted by Strand's offensive background) is crucial. Security teams should be trained on how these deception tools work, how to interpret their alerts, and how to respond effectively.

By implementing these defensive measures, organizations can create a more hostile environment for attackers, increase their chances of early detection, reduce the likelihood of successful breaches, and ultimately raise the cost for adversaries to operate within their networks.

Key Takeaways

• Traditional security tools are not enough: Common EDRs, SIEMs, and firewalls are predictable and easily bypassed by even moderately resourced attackers, let alone nation-states, due to their known capabilities.
• Cyber deception offers "quick wins" for early detection: Deception technologies, often free or low-cost, provide immediate and high-fidelity alerts by forcing attackers to interact with deceptive elements during reconnaissance or initial lateral movement, enabling proactive defense.
• Deception changes attacker behavior and increases risk: By introducing unpredictability, deception significantly raises the "cost of getting caught" for adversaries, deterring sophisticated attackers who risk burning expensive zero-days and implants.
• Free and accessible tools are highly effective: Solutions like CanaryTokens.org, HoneyBadger, HoneyShare, Cowrie, and the provided Cloud Lab offer powerful, easy-to-deploy deception capabilities that don't require large budgets or specialized expertise.
• Active Directory honey accounts are a must-have: Creating honey user accounts (e.g., admin, ADM) with restricted logon hours and Kerberoastable service accounts in Active Directory provides an immediate, low-effort, high-impact method to detect password spraying and lateral movement attempts.
• Enhanced geolocation provides critical intelligence: Overcome basic IP geolocation inaccuracies by using traceroute to identify the ISP's edge router, providing a much more precise physical location of the attacker for better threat intelligence.

About the Speaker(s)

John Strand is the Founder and Owner of Black Hills Information Security (BHIS), a company renowned for its offensive security services, including penetration testing and red teaming, as well as its focus on active defense and threat hunting. With a deep background in both offensive and defensive cybersecurity, Strand is a prominent figure known for his practical, no-nonsense approach to security. He has extensive experience in nation-state level hacking for the United States government, giving him unique insights into advanced persistent threats and the tactics employed by sophisticated adversaries.

Strand is also a passionate educator, widely recognized for his commitment to making cybersecurity knowledge accessible. He is known for offering "pay what you can" training classes through Antisyphon Training, many of which feature former SANS instructors, thereby democratizing high-quality security education regardless of financial means. His talks, like this one, often challenge conventional wisdom and provide actionable, often open-source or free, solutions to complex security problems, reflecting his philosophy of empowering defenders with practical skills and tools.