Amber-Freeze · a Northstar tool · v0.1.0
The moment a honeytoken trips, freeze the evidence before it walks away.
An alert tells you something happened. Amber-Freeze catches the process while it's still there — SIGSTOPs the whole tree (not just the one PID), pulls real memory and real resolved sockets straight out of /proc, and Ed25519-signs the bundle so nobody can quietly edit the evidence afterward, including you.
The actual problem
By the time you SSH in to look, the evidence is already gone.
A honeytoken trip tells you someone's there right now. What most setups do next is either nothing, or a manual, slow, easy-to-get-wrong scramble to capture what the process was doing before it forks, exits, or gets killed.
- The usual approach
- Manual capture, one PID at a time. By the time a human is at a terminal, the attacker's process has usually forked a child, opened new connections, or exited. A hand-run capture on the one PID you know about misses everything that happened around it.
- The other usual approach
- A capture tool that fakes it. An earlier version of this exact idea claimed to dump "memory state and open network sockets" but actually only read
cmdline/environand counted file descriptors — no memory, no real socket resolution, one PID only. This product exists specifically because that gap got found and wasn't acceptable.
How it works
Freeze, capture, and sign — in that order, automatically.
Three things happen the instant it's triggered.
- 01 · The whole tree, confirmed stopped
- Walks all of
/procto find every live descendant of the target PID,SIGSTOPs each one, and confirmsstate == 'T'before moving on — not just the parent, and not just "sent the signal and hoped." - 02 · Real memory, real sockets
- Reads actual bytes from
/proc/pid/memper region in/proc/pid/maps, each region hashed with real SHA-256 — and cross-references/proc/pid/fdagainst/proc/net/{tcp,tcp6,udp,udp6}for real resolved protocol/address/port/state, not a file-descriptor count. - 03 · Ed25519-signed, tamper-evident
- The finished bundle is signed. A single edited field afterward — yours or anyone else's — makes verification fail. Evidence you can hand over and prove wasn't touched after capture.
Try it
Sign something. Then try to fake it.
Generates a real ECDSA P-256 keypair in your browser via Web Crypto, signs your text with the private key, and verifies it against the public key — the same primitive the real evidence bundle uses. Change one character after signing and verify will fail, live.
Under the hood
One escrow call, a complete forensic bundle.
ProcessStateEscrow orchestrates the whole pass — freeze, capture, hash, sign — with real measured timing per phase, not an asserted number.
- Whole process tree discovery and freeze, not one PID
- Real memory region capture, SHA-256 per region, capped by a byte budget you set
- Real socket resolution — protocol, local/remote address:port, state — not an fd count
release()andterminate()— a frozen process isn't stuck frozen with no next step- Honest degradation: a process that exits mid-freeze, or one you lack privilege to read, is recorded in
redacted— never silently skipped - Zero network calls anywhere in this module — the bundle is signed locally with a key you hold
Pricing
One price. No per-seat fees, no per-environment fees.
Unlimited use across your whole organization — every host, every honeytoken, every trip.
Flat. Unlimited hosts and seats within your org. Same pricing model as Bait-Mask. One license, issued directly by us. Renews annually. No usage metering, no feature gates. Covers full process-tree freeze, capture, and signing, unlimited hosts within your org, and direct email support from the person who built it.
A real, time-boxed license — not a crippled demo build. Every feature works exactly as it will after you pay. Self-serve: tell us your org name, we issue the license same day.
Card checkout: clicking "Get it" opens Stripe's own hosted checkout page, and you're invited as a GitHub collaborator automatically on payment.
Founding customer discount: the first 10 organizations to license Amber-Freeze get 40% off the first year ($1,800) — enter code FOUNDING40 at checkout (there's a promo-code field on Stripe's own checkout page). Same policy as Bait-Mask, for the same reason: v0.1.0 has no independent audit yet (see below), and the discount reflects that honestly.
Trust & release state
Real, and pre-release. Both true at once.
dup2(sockfd, 0/1/2) reverse-shell payload produces — collapsed onto a single fd number in the signed bundle instead of each being reported correctly. Fixed, with a regression test added; see the changelog entry for the full writeup. What hasn't happened: no independent third-party audit, and no compliance certification (SOC2, ISO 27001, or similar). What won't happen: a Windows version — /proc and SIGSTOP don't exist there, and there's no fallback, on purpose. All of this is why the founding-customer pricing above is discounted rather than full price.Don't just get an alert. Get evidence that survives the next ten minutes.
No sales call needed to get started.