{"id":31623,"date":"2026-10-07T12:08:18","date_gmt":"2026-10-07T10:08:18","guid":{"rendered":"https:\/\/www.cheops-technology.ch\/deceiving-those-who-come-to-deceive-you-honeytokens-and-padded-cells\/"},"modified":"2026-10-07T17:34:39","modified_gmt":"2026-10-07T15:34:39","slug":"deceiving-those-who-come-to-deceive-you-honeytokens-and-padded-cells","status":"publish","type":"post","link":"https:\/\/www.cheops-technology.ch\/en\/deceiving-those-who-come-to-deceive-you-honeytokens-and-padded-cells\/","title":{"rendered":"Deceiving those who come to deceive you: Honeytokens and padded cells"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\tDECEPTION TECHNOLOGY \u00b7 WEB APPLICATION FIREWALL TACTICAL RESPONSE<\/span>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tTo counter the surge in IDORs and data exfiltration, there is a tactical response: inject fake data into your application, detect it passing through the WAF, and confine the attacker within a clone riddled with decoys. All without a six-figure license fee. <\/em>\n\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

\u00ab \u5175\u8005\uff0c\u8a6d\u9053\u4e5f \u00bb<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

\"All warfare is based on deception.\"<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\tSun Tzu, L'Art de la guerre<\/span>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

1. Facing threats: data breaches are becoming the norm<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Data leaks are no longer the exception; they are the background noise of the web. IDOR<\/strong> (Insecure Direct Object Reference) vulnerabilities, where an identifier is manipulated to access someone else’s data, rank among the most common and easiest to exploit; often, all it takes is incrementing an integer in a request. Added to this are automated exfiltration, mass scraping, and API enumeration. The common thread among all these attacks is that they cause data to leave the system<\/strong> when it never should have.<\/p>

The knee-jerk response is budgetary: buying increasingly expensive WAFs, stacking up signatures, and multiplying rules. Yet, detection based on potentially anomalous behavior inevitably generates false positives, as legitimate usage can sometimes mimic such patterns. We are shifting the problem, not solving it.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

2. Tactical Response : regaining the initiative<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Tactical Response<\/strong> flips the script. Instead of simply erecting walls, we set traps and prepare the terrain so that, when the attacker strikes, they find themselves at a disadvantage. We accept the possibility, or even the reality, of an ongoing intrusion, and we design the environment to reliably detect and smoothly neutralize it.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\"The supreme art is to subdue the enemy without fighting.\" The goal is not to be impregnable. The aim is to ensure that a successful attack yields nothing and backfires on its perpetrator.<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The centerpiece is the honeytoken<\/strong>: a decoy record (such as an account, IBAN, or email address) that is never generated by any business process and never accessed by any legitimate user. Its sole function is to be seen. If it appears in transit, there is no innocent explanation.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

3. Application security cannot be bought for millions.<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

A multi-million-euro WAF doesn’t know your application; it simply applies generic rules. You, however, know which endpoints expose objects, which identifiers are enumerable, and which responses contain sensitive data. That intimate knowledge is worth more than any commercial signature.<\/p>

Intelligent security means placing the right detection in the right spot: instead of inspecting thousands of incoming attack patterns, you monitor a handful of values \u200b\u200bthat must never leave the system<\/strong>. It is a detection method with a zero false-positive rate, because it relies not on heuristics but on a hard fact: “this specific string is passing through the WAF.”<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Secure intelligently, not more heavily. Application awareness is the best sensor.<\/h6>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

4. The principle in a single image<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

A legitimate user never encounters a honeytoken; they access the actual production environment. An attacker who is enumerating or exfiltrating data, however, eventually triggers one and, without realizing it<\/strong>, is immediately diverted to a clone populated with fake data.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Schematic diagram \u2013 Padded Cell by Deception Technology<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
Honeytoken in transit = proof of exfiltration -> seamless switch to the decoy clone<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t
\r\n\t \t
    \r\n\t \t\t\t \t\t\t
  • \r\n\t \t\t\t\t\r\n\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t<\/i>\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tLegitimate path: the user never interacts with a honeytoken and accesses the actual production site.<\/span>\r\n\t\t\t\t\t\t\t\t \t\t\t<\/li>\r\n\t \t\t\t \t<\/ul>\r\n\t <\/div>\r\n\t \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t
    \r\n\t \t
      \r\n\t \t\t\t \t\t\t
    • \r\n\t \t\t\t\t\r\n\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t<\/i>\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\tConfined path: as soon as a honeytoken is released, the source is silently switched to the clone.<\/span>\r\n\t\t\t\t\t\t\t\t \t\t\t<\/li>\r\n\t \t\t\t \t<\/ul>\r\n\t <\/div>\r\n\t \t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t

      5. Preparing your application<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t

      5.1 - Plant honeytokens\u2026 at random intervals<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Step one: inject decoy records into the production database, interspersed with real ones. The key to remaining inconspicuous is to avoid grouping them<\/strong> together. Honeytokens assigned consecutive IDs (98, 99, 100) or clustered at the end of the table would immediately stand out to an observant attacker. Instead, they are distributed at random intervals<\/strong> across the ID range, a few decoys scattered among genuine accounts at unpredictable positions.<\/p>

      To put it concretely, let’s imagine a classic table users<\/code>, with the columns name<\/code>, first name<\/code>, email<\/code>, address<\/code>, IBAN<\/code>, phone<\/code>. Most of the lines correspond to real customers. But at certain randomly selected positions, IDs 1428, 3961, 7044…, we slip in an entirely fictitious record<\/strong>:<\/p>
      id<\/th>name<\/th>firstname<\/th>email<\/th>address<\/th>IBAN<\/th><\/tr><\/thead>
      1427<\/td>(real entry)<\/em><\/td>\u2026<\/td>\u2026<\/td>\u2026<\/td>\u2026<\/td><\/tr>
      1428<\/strong><\/td>Mickael<\/strong><\/td>Culline<\/strong><\/td>m.culline@love.me<\/a><\/strong><\/td>12 rue des Lilas, Papamica<\/strong><\/td>CH76 9999 0000 1234 5678 9012 345<\/strong><\/td><\/tr>
      1429<\/td>\u00a0(real entry)<\/em><\/td>\u2026<\/td>\u2026<\/td>\u2026<\/td>\u2026<\/td><\/tr><\/tbody><\/table>

      This “Mickael Culline” does not exist. It is not the masked data of a real person; it is a completely fabricated identity<\/strong>, seemingly consistent (plausible name, valid IBAN format) but not linked to any actual individual. It serves only one purpose: to act as bait.<\/p>

      The key point is that each decoy carries at least one unique and unlikely value<\/strong>, such as an IBAN from a range reserved for this purpose or a dedicated email domain (e.g., @\u2026decoy), that would never<\/strong> appear in a legitimate response. It is precisely this value that the WAF monitors in outbound traffic. Finally, the fact that a record is a decoy remains strictly internal<\/strong> information (a database flag that is never exposed); from the attacker’s perspective, there is nothing to distinguish “Mickael Culline” from a real customer.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t

      5.2 - Build the decoy clone (padded cell)<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Step two: deploy an exact replica<\/strong> of the application. Same code, same interface, same API schemas, but backed by a completely fake database<\/strong>. No real data must be accessible within it. Think of it as a padded cell: the attacker finds exactly what they expect, except that everything is fabricated. The illusion must be flawless; otherwise, the trap becomes obvious and is blown.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t
      \n\t\t\t\t\t

      5.3 - Automated deployment via CI\/CD<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Production and the clone share the same application artifact; only the database differs. The CI\/CD pipeline builds the image once and then deploys it twice: once with real seed data (plus honeytokens) and once with entirely fictitious seed data. This keeps both versions perfectly synchronized\u2014any code update reaches both production and the decoy simultaneously, ensuring the illusion remains unbroken.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

      \n\t\t\t\t\t\t
      \n\t\t\t\t\t
      \n\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t

      6. Deployment architecture<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t
      Target architecture<\/h5>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t
      Pipeline CI\/CD -> Prod + clone leurre jumeau, un seul WAF frontal, observation SOC<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t\t
      \n\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t

      7. Configure your WAF (ModSecurity)<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      The entire containment mechanism relies on just two ModSecurity rules<\/strong> running on your existing Apache server. The first detects a honeytoken in the response body and flags the source; the second redirects flagged sources to the clone.<\/p>

      Step 1. Prepare your WAF.<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

      \n\t\t\t\t\t\n
      \n\n
      \n
      \n
      \n <\/span>\n <\/span>\n <\/span>\n <\/div>\n \n
      \n \n <\/div>\n <\/div>\n\n
      \n \n
      \n