Democratizing Deception Technology for anyone.
Source Reddit BlueTeam
Discussion
HoneyWire is an open-source deception technology platform designed to deploy high-fidelity network canaries on Linux hosts. It uses a decentralized architecture with a central Hub that enforces security policies and validates all inputs, including untrusted manifests and local deployment requests. The system employs Docker containers with strict least-privilege configurations and sandboxing to reduce attack surfaces. Several threat scenarios are analyzed, including supply chain compromise, local component manipulation, privilege escalation attempts, and Hub compromise. Some mitigations are implemented, such as schema validation, image digest pinning, capability allowlisting, and rate limiting. However, certain gaps remain, including lack of cryptographic manifest signature verification and signed deployment artifact enforcement. The platform accepts some risks related to local host compromise and bootstrap credential exposure. Overall, HoneyWire emphasizes strict verification and boundary enforcement to minimize trust assumptions in its security model.
r/blueteamsec (opens in a new tab)u/AndReicscs0 points0 comments
I wanted to run high-fidelity network canaries in my network, but I couldn’t justify enterprise pricing (like Thinkst), and I wasn’t a fan of managing custom orchestration across all my VMs to make available OSS solutions work.
I needed a low-friction alternative to OpenCanary, so I ended up building one myself. Over the last 3 months I have been working on HoneyWire, an Open-Source deception Canary builder platform, it allows you to turn any linux box into a high-fidelity canary in under 60s.
I'm sharing this here because i think that Deception technology shouldn't be gate-kept for businesses who have the budget to buy and employees to run existing solutions. It should just be a standard, accessible alarm system for any network. I sleep better at night knowing my "virtual home" is full of tripwires ready to trip as soon as someone who shouldn't is looking and poking around is doing so, and i bet a lot of blue teamers and business owners would too.
I'd love to hear your thoughts on the project, and especially on the ThreatModel!