Putting on a Big Show Defending by Attacking Attacker Incentives

Torrey opens with a critical look at deception products, which he says generate a lot of hype but little lasting value. He presents his work at Thinkst Canary, where cheap tripwires such as canary tokens alert defenders when an intruder touches them. The core idea is conspicuous deception: openly signalling that an organization uses decoys, so attackers grow cautious and their calculations change. He frames attackers by what they want, mainly money, intelligence, or political aims, and by how hard it is to turn stolen access into that goal.

The middle of the talk covers a freely available canary credit card token. It looks like a real, active card that declines every charge but alerts its owner when someone tries to use it, and a live demo showed a test transaction triggering an alert. The second, earlier-stage prototype is a drop-in MySQL driver called deception DB. It inserts fake rows and generated medical records and images, so a stolen database is padded with bogus data. Torrey acknowledges rough edges, including added friction for database administrators and possible bypasses through SQL injection.

The takeaway is that defenders can lower the value of stolen data and create doubt for attackers at little cost, mostly storage and compute. Practitioners can deploy the free tokens now, place them where stolen payment data might sit, and track their expiry, since these cards last about two years.