56
File canary kill switch (gitlab.com)
submitted 1 month ago by to c/linux@programming.dev
14 comments fedilink hide all child comments
 

I wrote a dead simple file canary tool that will install an eBPF program that drops all outgoing packets if a canary is touched. I wrote this in response to the current trend of supply chain attacks that try to harvest credentials

you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 1 month ago (1 child)

Okay, so not for protecting actual creds then. Makes sense, although would be nice to have a way to protect actual creds. No idea how that would be achievable though.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] [S] 12 points 1 month ago*

    Right it's just for things you don't use but a credential harvester would find interesting.

    I've been working a lot on containing the blast radius with some careful LXC usage, but this was a quick way to get some real value without a ton of thought.

  • permalink
  • fedilink
  • source
  • parent