cirven systems / modules / lure

cirven lure

Infostealers grab whatever looks valuable. lure gives them something that looks valuable and is worth nothing except the alarm it raises. You never open the decoys, so any access is a signal with almost no false positives.

usage

$ cirven lure            # the plan; changes nothing
free     ~/.aws/credentials.bak                       aws access key pair
free     ~/.ssh/id_ed25519_old                        ssh private key
free     ~/backup/.env.production                     production database url and api keys
free     ~/.config/solana/id-backup.json              crypto wallet keypair
free     ~/.config/chromium-backup/Default/Login Data browser password store
$ cirven lure plant
$ cirven lure status
[TRIPPED] ~/.aws/credentials.bak     read since planting
$ cirven lure watch --notify
[TRIPPED] ~/.ssh/id_ed25519_old read · 4410 /tmp/.u/upd

tripwires

• status: access times. on a relatime mount the first read moves atime past mtime. offline, no daemon, catches reads that happened while you were away
• watch: inotify reports each open as it happens, and the processes holding the decoy right then are named
• planned, use: decoy tokens that call home when tried elsewhere. needs a callback endpoint: self-hosted, or cirven relay

safety

Existing files are never overwritten: decoys are created with O_EXCL, so not even a symlink race can redirect them. Fresh random values, correct formats, no marker a stealer could filter on: cirven knows its decoys by the hash it recorded. remove deletes only decoys whose hash still matches, and the directories it created for them.

threat model

Stops: unnoticed credential theft by infostealers, poisoned packages and hijacked agents. Does not stop: an attacker who reads only real secrets. Backup and indexing tools also read files: exclude the decoys from them, or they will trip.