A honey token manager and alert system for AWS.

Last update: Nov 09, 2022

Overview

SpaceSiren

SpaceSiren is a honey token manager and alert system for AWS. With this fully serverless application, you can create and manage honey tokens at scale -- up to 10,000 per SpaceSiren instance -- at close to no cost.¹

How It Works

SpaceSiren provides an API to create no-permission AWS IAM users and access keys for those users.
You sprinkle the access keys wherever you like, for example in proprietary code or private data stores.
If one of those sources gets breached, an attacker is likely to use the stolen key to see what they can do with it.
You will receive an alert that someone attempted to use the key.

Alert Outputs

Email
PagerDuty
Slack
Pushover

Documentation Pages

Requirements

As with any open source project, this one assumes you have the required foundational tools and knowledge, mainly in AWS and Terraform.

Resources

Terraform >= 0.13
AWS CLI
A dedicated AWS account with admin access
A registered domain

Knowledge

Basic Terraform
Basic REST API
Basic AWS CLI, S3, and Route 53
Basic AWS Organizations and IAM Roles for cross-account access
Intermediate DNS (delegating a (sub)domain with NS records)

Contact

If you notice a critical security bug (e.g., one that would grant real access to an AWS account), please responsibly disclose it via email at [email protected].

For standard bugs or feature requests, please open a GitHub issue.

Attributions

Special thanks to:

Atlassian for Project SpaceCrab, the inspiration for this project. If you want to read about why I started SpaceSiren, please see my SpaceCrab critique page.
The wonderful and talented Alia Mancisidor for the artwork.
Anyone who volunteered to test this application for me.

Footnotes

While SpaceSiren was designed to run as cheaply as possible, even for individuals, it will not be entirely free of operating costs. You will incur nominal costs for DynamoDB, Lambda, API Gateway, Route 53, and perhaps CloudTrail, depending on your configuration. You should expect to spend between $1 and $5 per month to run SpaceSiren. Of course, the project's maintainers are not responsible for any actual costs you incur. Please closely monitor your AWS bill while it is in use.

You might also like...

Remote control your Greenbone Vulnerability Manager (GVM)

Greenbone Vulnerability Management Tools The Greenbone Vulnerability Management Tools gvm-tools are a collection of tools that help with remote contro

130 Dec 17, 2022

Encrypted Python Password Manager

PyPassKeep Encrypted Python Password Manager About PyPassKeep (PPK for short) is an encrypted python password manager used to secure your passwords fr

1 Nov 17, 2021

Password-Manager GUI

PASSWORD-MANAGER This repo contains all the project files. Project Description A Tkinter GUI that allows you to store website info like website name,

1 Dec 8, 2021

PassLock is a medium-security password manager that encrypts passwords using Advanced Encryption Standards (AES)

A medium security python password manager that encrypt passwords using Advanced Encryption Standard (AES) PassLock is a password manager and password

44 Nov 18, 2022

🔐 A simple command-line password manager.

PassVault What Is It? It is a command-line password manager, for educational purposes, that stores localy, in AES encryption, your sensitives datas in

5 Aug 15, 2022

This is a Cryptographied Password Manager, a tool for storing Passwords in a Secure way

Cryptographied Password Manager This is a Cryptographied Password Manager, a tool for storing Passwords in a Secure way without using external Service

3 Nov 23, 2022

Providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account.

We are providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account. The script enables security teams to identify external-facing AWS assets by running the exploit on them, and thus be able to map them and quickly patch them

13 Jan 4, 2022

Wonk is a tool for combining a set of AWS policy files into smaller compiled policy sets.

140 Dec 16, 2022

Security offerings for AWS Control Tower

Caylent Security Catalyst Reference Architecture Examples This repository contains solutions for Caylent's Security Catalyst. The Security Catalyst is

1 Oct 22, 2021

Comments

Multiple alert email addresses

Allow for more than one destination email address for alerts. Terraform should take a list of email addresses. They will all need to be verified in SES.

opened by khicks 0
Enhancement/Canary Resources scaffolding
Add support for canary resources:

This is the initial scaffolding, that adds an endpoint to monitor activity for given resource ARNs.

Under the current format, it only supports resources in the account where spacesiren is deployed

Will have to look into the best way to monitor arbitrary trails

TODOs:

[ ] Update documentation for the new endpoint
opened by x4v13r64 0

Releases(1.4.0)

1.4.0(Dec 19, 2021)
IMPROVEMENTS:

Update Terraform to version 1.1.2.

Provider dependency upgrades.

Source code(tar.gz)
Source code(zip)
1.3.0(Apr 15, 2021)
IMPROVEMENTS:

Update Terraform to version 0.15.

Source code(tar.gz)
Source code(zip)
1.2.1(Aug 23, 2020)
IMPROVEMENTS:

Update AWS provider to 3.3.0.

BUG FIXES:

Lambda logging permissions with the new aws_cloudwatch_log_group ARN format.

Source code(tar.gz)
Source code(zip)
1.2.0(Aug 15, 2020)
FEATURES:

Pushover support. New tfvars are alert_pushover_user_key and alert_pushover_api_key.

Test alert API endpoint: /test-alert.

IMPROVEMENTS:

Remove trimsuffix from Route 53 zone name.

Source code(tar.gz)
Source code(zip)
1.1.0(Aug 14, 2020)
IMPROVEMENTS:

Artwork!

Change directory structure. Terraform code now has its own directory.

If you previously had SpaceSiren set up, delete your functions-pkg/ directory and move the following files/dirs to the terraform/ directory:

.terraform/

terraform-local.tf

terraform.tfvars

Source code(tar.gz)
Source code(zip)
1.0.0(Aug 14, 2020)

Source code(tar.gz)
Source code(zip)

Owner

GitHub Repository

The Linux defender anti-virus software ported to work on CentOS Linux.

By: Seanpm2001, Et; Al. Top README.md Read this article in a different language Sorted by: A-Z Sorting options unavailable ( af Afrikaans Afrikaans |

2 Sep 12, 2022

A secure password generator written in python

gruvbox-factory 🏭 "The main focus when developing gruvbox is to keep colors easily distinguishable, contrast enough and still pleasant for the eyes"

430 Dec 27, 2022

Mr.Holmes is a information gathering tool (OSINT)

🔍 Mr.Holmes Mr.Holmes is a information gathering tool (OSINT). Is main purpose is to gain information about domains,username and phone numbers with t

534 Jan 08, 2023

An ARP Spoofer attacker for windows to block away devices from your network.

arp0_attacker An ARP Spoofer-attacker for Windows -OS to block away devices from your network. INFO Built in Python 3.8.2. arp0_attackerx.py is Upgrad

15 Mar 17, 2022

Python exploit for vsftpd 2.3.4 - Backdoor Command Execution

CVE-2011-2523 - vsftpd 2.3.4 Exploit Discription vsftpd, which stands for Very Secure FTP Daemon,is an FTP server for Unix-like systems, including Lin

5 Nov 08, 2022

A kAFL based hypervisor fuzzer which fully supports nested VMs

hAFL2 hAFL2 is a kAFL-based hypervisor fuzzer. It is the first open-source fuzzer which is able to target hypervisors natively (including Hyper-V), as

115 Dec 07, 2022

CloakifyFactory & the Cloakify Toolset - Data Exfiltration & Infiltration In Plain Sight;

CloakifyFactory CloakifyFactory & the Cloakify Toolset - Data Exfiltration & Infiltration In Plain Sight; Evade DLP/MLS Devices; Social Engineering of

3 Oct 18, 2022

A OSINT tool coded in python

Argus Welcome to Argus, a OSINT tool coded in python. Disclaimer I Am not responsible what you do with the information that is given to you by my tool

2 Mar 20, 2022

DNS hijacking via dead records automation tool

DeadDNS Multi-threaded DNS hijacking via dead records automation tool How it works 1) Dig provided subdomains file for dead DNS records. 2) Dig the fo

45 Dec 20, 2022

A tool to extract the IdP cert from vCenter backups and log in as Administrator

vCenter SAML Login Tool A tool to extract the Identity Provider (IdP) cert from vCenter backups and log in as Administrator Background Commonly, durin

343 Dec 31, 2022

Nmap automated port scanner written in Python

port-scanner Nmap automated port scanner written in Python. USE: Clone the module Import the module: from portscanModule import portscanner Use: ports

1 Dec 03, 2021

A brute force tool for password-protected zip file

Bzip A brute force tool for password-protected zip file/folder(s). Note that this tool can only crack .zip files. Please DO not misuse. Installation g

3 Nov 13, 2021

Buffer Overflow para SLmail5.5 32 bits

SLmail5.5-Exploit-BoF Buffer Overflow para SLmail5.5 32 bits con un par de utilidades para que puedas hacer el tuyo REQUISITOS PARA QUE FUNCIONE: Desa

15 Jul 30, 2022

🍯 16 honeypots in a single pypi package (DNS, HTTP Proxy, HTTP, HTTPS, SSH, POP3, IMAP, STMP, VNC, SMB, SOCKS5, Redis, TELNET, Postgres & MySQL)

Easy to setup customizable honeypots for monitoring network traffic, bots activities and username\password credentials. The current available honeypot

259 Dec 31, 2022