The worst of all deceptions is self-deception
Goal: Redirect attackers attempting to leverage identity federation protocols to a controlled environment.
Approach: Manipulating identity federation responses to misdirect authentication flows.
Modify identity federation responses, such as SAML assertions or OAuth tokens, to redirect attackers to a fake identity provider (IdP) or a honeypot environment.
Goal: Confuse and misdirect attackers by deploying deceptive beacons.
Approach: Emitting misleading signals to divert attackers.
Deploy beacons that mimic the network traffic of vulnerable or compromised systems. These beacons can lead attackers towards honeypots, decoy networks, or even trigger automated responses.
Goal: Redirect attackers attempting to authenticate to a deceptive environment.
Approach: Manipulating IdP responses to redirect authentication flows.
When an attacker attempts to authenticate through an IdP (e.g., OAuth, SAML), manipulate the response to redirect them to a fake login portal or a controlled environment.
Goal: Redirect attacker traffic to a controlled environment by providing deceptive DNS responses.
Approach: Manipulating DNS resolution to redirect traffic.
This element intercepts DNS requests for known malicious domains and returns a deceptive IP address, leading attackers to a honeypot or sinkhole.