A honey token manager and alert system for AWS.

Last update: Nov 09, 2022

Overview

SpaceSiren

SpaceSiren is a honey token manager and alert system for AWS. With this fully serverless application, you can create and manage honey tokens at scale -- up to 10,000 per SpaceSiren instance -- at close to no cost.¹

How It Works

SpaceSiren provides an API to create no-permission AWS IAM users and access keys for those users.
You sprinkle the access keys wherever you like, for example in proprietary code or private data stores.
If one of those sources gets breached, an attacker is likely to use the stolen key to see what they can do with it.
You will receive an alert that someone attempted to use the key.

Alert Outputs

Email
PagerDuty
Slack
Pushover

Documentation Pages

Requirements

As with any open source project, this one assumes you have the required foundational tools and knowledge, mainly in AWS and Terraform.

Resources

Terraform >= 0.13
AWS CLI
A dedicated AWS account with admin access
A registered domain

Knowledge

Basic Terraform
Basic REST API
Basic AWS CLI, S3, and Route 53
Basic AWS Organizations and IAM Roles for cross-account access
Intermediate DNS (delegating a (sub)domain with NS records)

Contact

If you notice a critical security bug (e.g., one that would grant real access to an AWS account), please responsibly disclose it via email at [email protected].

For standard bugs or feature requests, please open a GitHub issue.

Attributions

Special thanks to:

Atlassian for Project SpaceCrab, the inspiration for this project. If you want to read about why I started SpaceSiren, please see my SpaceCrab critique page.
The wonderful and talented Alia Mancisidor for the artwork.
Anyone who volunteered to test this application for me.

Footnotes

While SpaceSiren was designed to run as cheaply as possible, even for individuals, it will not be entirely free of operating costs. You will incur nominal costs for DynamoDB, Lambda, API Gateway, Route 53, and perhaps CloudTrail, depending on your configuration. You should expect to spend between $1 and $5 per month to run SpaceSiren. Of course, the project's maintainers are not responsible for any actual costs you incur. Please closely monitor your AWS bill while it is in use.

You might also like...

Remote control your Greenbone Vulnerability Manager (GVM)

Greenbone Vulnerability Management Tools The Greenbone Vulnerability Management Tools gvm-tools are a collection of tools that help with remote contro

130 Dec 17, 2022

Encrypted Python Password Manager

PyPassKeep Encrypted Python Password Manager About PyPassKeep (PPK for short) is an encrypted python password manager used to secure your passwords fr

1 Nov 17, 2021

Password-Manager GUI

PASSWORD-MANAGER This repo contains all the project files. Project Description A Tkinter GUI that allows you to store website info like website name,

1 Dec 8, 2021

PassLock is a medium-security password manager that encrypts passwords using Advanced Encryption Standards (AES)

A medium security python password manager that encrypt passwords using Advanced Encryption Standard (AES) PassLock is a password manager and password

44 Nov 18, 2022

🔐 A simple command-line password manager.

PassVault What Is It? It is a command-line password manager, for educational purposes, that stores localy, in AES encryption, your sensitives datas in

5 Aug 15, 2022

This is a Cryptographied Password Manager, a tool for storing Passwords in a Secure way

Cryptographied Password Manager This is a Cryptographied Password Manager, a tool for storing Passwords in a Secure way without using external Service

3 Nov 23, 2022

Providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account.

We are providing DevOps and security teams script to identify cloud workloads that may be vulnerable to the Log4j vulnerability(CVE-2021-44228) in their AWS account. The script enables security teams to identify external-facing AWS assets by running the exploit on them, and thus be able to map them and quickly patch them

13 Jan 4, 2022

Wonk is a tool for combining a set of AWS policy files into smaller compiled policy sets.

140 Dec 16, 2022

Security offerings for AWS Control Tower

Caylent Security Catalyst Reference Architecture Examples This repository contains solutions for Caylent's Security Catalyst. The Security Catalyst is

1 Oct 22, 2021

Comments

Multiple alert email addresses

Allow for more than one destination email address for alerts. Terraform should take a list of email addresses. They will all need to be verified in SES.

opened by khicks 0
Enhancement/Canary Resources scaffolding
Add support for canary resources:

This is the initial scaffolding, that adds an endpoint to monitor activity for given resource ARNs.

Under the current format, it only supports resources in the account where spacesiren is deployed

Will have to look into the best way to monitor arbitrary trails

TODOs:

[ ] Update documentation for the new endpoint
opened by x4v13r64 0

Releases(1.4.0)

1.4.0(Dec 19, 2021)
IMPROVEMENTS:

Update Terraform to version 1.1.2.

Provider dependency upgrades.

Source code(tar.gz)
Source code(zip)
1.3.0(Apr 15, 2021)
IMPROVEMENTS:

Update Terraform to version 0.15.

Source code(tar.gz)
Source code(zip)
1.2.1(Aug 23, 2020)
IMPROVEMENTS:

Update AWS provider to 3.3.0.

BUG FIXES:

Lambda logging permissions with the new aws_cloudwatch_log_group ARN format.

Source code(tar.gz)
Source code(zip)
1.2.0(Aug 15, 2020)
FEATURES:

Pushover support. New tfvars are alert_pushover_user_key and alert_pushover_api_key.

Test alert API endpoint: /test-alert.

IMPROVEMENTS:

Remove trimsuffix from Route 53 zone name.

Source code(tar.gz)
Source code(zip)
1.1.0(Aug 14, 2020)
IMPROVEMENTS:

Artwork!

Change directory structure. Terraform code now has its own directory.

If you previously had SpaceSiren set up, delete your functions-pkg/ directory and move the following files/dirs to the terraform/ directory:

.terraform/

terraform-local.tf

terraform.tfvars

Source code(tar.gz)
Source code(zip)
1.0.0(Aug 14, 2020)

Source code(tar.gz)
Source code(zip)

Owner

GitHub Repository

DoSer.py - Simple DoSer in Python

DoSer.py - Simple DoSer in Python What is DoSer? DoSer is basically an HTTP Denial of Service attack that affects threaded servers. It works like this

1 Oct 12, 2021

Tool to decrypt iOS apps using r2frida

r2flutch Yet another tool to decrypt iOS apps using r2frida. Requirements It requires to install Frida on the Jailbroken iOS device: Jailbroken device

146 Jan 03, 2023

HTTP security headers for Flask

Talisman: HTTP security headers for Flask Talisman is a small Flask extension that handles setting HTTP headers that can help protect against a few co

854 Dec 30, 2022

The Easiest Way To Gallery Hacking

The easiest way to HACK A GALLARY, Get every part of your friends' gallery ( 100% Working ) | Tool By John Kener 🇱🇰

34 Nov 30, 2022

SonicWall SMA-100 Unauth RCE Exploit (CVE-2021-20038)

Bad Blood Bad Blood is an exploit for CVE-2021-20038, a stack-based buffer overflow in the httpd binary of SMA-100 series systems using firmware versi

80 Dec 29, 2022

Tool to check if your DNS comply to Polish Ministry of Finance gambling domains restrictions

dns-mf-hazard Tool to check if your DNS comply to Polish Ministry of Finance gambling domains restrictions How to use it? Installation You need python

2 Jan 01, 2022

Credit Card And SK Checker Written In Python

💳 Credit Card Checker (CC Checker) & Mass SK Checker & Generator 💳

53 Dec 31, 2022

Python bindings to LibreSSL library

LibreSSL bindings for Python using CFFI Python3 bindings to LibreSSL using CFFI. It aims to provide interface to the most important bits of LibreSSL o

1 Aug 02, 2022

neo Tool is great one in binary exploitation topic

neo Tool is great one in binary exploitation topic. instead of doing several missions by many tools and windows, you can now automate this in one tool in one session.. Enjoy it

4 Oct 10, 2022

WhPhisher: a Phishing tool With Python

WhPhisher Herramienta para hacer phishing con muchos métodos de túneling -----Como Instalarlo------- pkg install python3 pkg install git git clone htt

80 Jan 02, 2023

MITMSDR for INDIAN ARMY cybersecurity hackthon

There mainly three things here: MITMSDR spectrum Manual reverse shell MITMSDR Installation Clone the project and run the setup file: ./setup One of th

2 Jul 26, 2022

Extendable payload obfuscation and delivery framework

NSGenCS What Is? An extremely simple, yet extensible framework to evade AV with obfuscated payloads under Windows. Installation Requirements Currently

123 Dec 19, 2022

Template for new OSINT command-line tools

OSINT cli tool skeleton Template for new OSINT command-line tools. Press button "Use this template" to generate your own tool repository. See INSTALL.

36 Dec 20, 2022

A secure way of storing your passwords.

StrongBox 🔐 A secure way of storing your passwords. 🔑 Why to use StrongBox? StrongBox makes it possible to have a random generated strong password i

5 Dec 25, 2021

Tenssens framework focused on gathering information from free tools or resources. The intention is to help people find free OSINT resources.

31 Oct 21, 2022

A cross-platform Python module that displays **** for password input. Works on Windows, unlike getpass. Formerly called stdiomask.

PWInput A cross-platform Python module that displays **** for password input. Works on Windows, unlike getpass. Formerly called stdiomask. Installatio

26 Sep 04, 2022