38 ms·

Cyber Scarecrow

606 points by toby_tw 2y ago

dogben 2y ago
A simple magic is to set system language and locale to Russian.
- deleted 2y ago
  [deleted]
- Etheryte 2y ago
  Yes, but then your system is in Russian which is pretty much the same as having malware.
- Epskampie 2y ago
  Yes very simple! Not a problem whatsoever with that. я не говорю по-русски
- sunaookami 2y ago
  A simple magic is using an operating system that is not full of security holes by an incompetent vendor.
iforgotpassword 2y ago
Narrator: and so the arms race continues. I guess if this gets enough attention, malware will just add more sophisticated checks and not just look at the exe name. But on that note, I wondered the same thing at my last workplace where we'd only run windows in virtual machines. Sometimes these were quite outdated regarding system and browser updates, and some non-tech staff used them to browse random websites. They were never hit by any crypto malware and whatnot, which surprised me a lot at first, but at some point I realized the first thing you do as even a halfway decent malware author is checking whether you run in a virtualized environment.
- fancythat 2y ago
  This works, I can confirm. Majority of malware threat running in a VM as a sign of researcher doing the malware analysis. I am recommending doing this for over 10 years now.
  - mdip 2y ago
    That's where I wonder about a tool like this interfering with legitimate software. For example, I believe the anti-cheat software used by games like Fortnite looks for similar things -- my understanding is that it, too, will refuse to start when it is executing in a VM[0]. As a teenager (90s), I remember several applications/games refusing to start when I'd attached a tracing process to them. They did this to stop exactly what I was doing: trying to figure out how to defeat the software licensing code. I haven't had a need to do that since the turn of the century but I'd put $10 on that still being a thing. So you end up with a "false positive", and like anti-virus software, it results in "denial of service." But does anti-virus's solution of "white list it" apply here? At least with their specific implementation, it's "on or off", but I wonder if it's even possible to alter the application in a way that could "white list a process so it doesn't see the 'malware defeat tricks' this exposes." If not, you'd just have to "turn off protection" when you were using that program. That might not be practical depending on the program. It's also not likely the vendor of that program will care that "an application which pretends it's doing things we don't like" breaks their application unless it represents a lot of their install base. [0] I looked into it a few years ago b/c I run Tumbleweed and it's a game the kids enjoy (I'm not a huge fan but my gaming days have been behind me for a while, now) ... I had hoped to be able to expose my GPU to the VM enough to be able to play it but didn't bother trying after reading others' experiences.
    - fancythat 2y ago
      You are right, some games, especially multiplayer ones will refuse to work in the VM to prevent cheating, but this is, of course, the business decision on their side. You can always construct the software in such a way that when it detects something suspicious on the system it ceases to function: some copy protections looked up for change in the network card hardware id as developers presumed it is highly unlikely someone will change network interface, but that stopped to be common, when people started using on-board interfaces that change with every motherboard change. There is also a difference when using commercial stuff such as vmware instead of qemu or virtualbox as open source is more suitable to be tailored to the specific thing, in this case, cheating. In the end, this approach works well for slowing done malware as there is less risk for normal software to allow working inside of vm in contrast to malware that should be coded to be extra paranoid in order to avoid as many tar pits as possible.
- curtisblaine 2y ago
  > I guess if this gets enough attention, malware will just add more sophisticated checks and not just look at the exe name. But more sophisticated detection means bigger payload (making the malware easier to detect) and more complexity (making the malware harder to make / maintain), so mission accomplished.
  - saagarjha 2y ago
    Not by much. Probably less effort than you're putting in trying to avoid the malware, so it's a net loss.
    - xiphias2 2y ago
      The more scarecrow is installed, the easier it gets for real security researchers to hide from these checks and detect viruses. So actually the dynamic helps security research.
      - saagarjha 2y ago
        That's not how this works.
  - oefrha 2y ago
    “Sophisticated” detection can be as simple as checking rss and pcpu, the bullshit decoy processes probably aren’t wasting a lot of CPU and RAM, otherwise might as well run the real things; if they are, well, just avoid, who cares. So no, it’s not going to meaningfully complicate anything.
    - curtisblaine 2y ago
      Wouldn't that be more fragile though? CPU usage is not constant in time, so if - again - you're not sophisticated enough, you get more false negatives / positives, depending on which side of the heuristic you err.
      - 2y ago
nubinetwork 2y ago
If you're going to go through the effort of faking honeypot/analysis tools, why not just run them?
- deleted 2y ago
  [deleted]
- ok_dad 2y ago
  Costs a lot of cycles to run those for real, and it’s not super common to get infected with anything, so you’re wasting cycles for a small chance at avoiding it. This could be better since, I assume, it doesn’t do a lot of stuff.
  - exe34 2y ago
    can you nice them?
    - JoosToopit 2y ago
      To make them imitate the real activity? To imitate what scarecrow does?
- CyberScarecrow 2y ago
  Author of scarecrow here. The idea is cyber scarecrow is just super easy and light weight for anyone to use. Honeypot tech tends to need some good tech understanding to use (eg the cli), and can be a bit heavyweight for always running in the background of your computer.
scosman 2y ago
Fun concept. If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.
- vmfunction 2y ago
  It is a cat and mouse game. And security by obscurity practice. Not saying it won't work, but if it is open sourced, how long before the malware will catch on? Here is one on github: https://github.com/NavyTitanium/Fake-Sandbox-Artifacts https://github.com/NavyTitanium/Fake-Sandbox-Artifacts
  - xyzzy123 2y ago
    The really fun part is when malware authors add detections for "fake sandbox" and then real sandbox authors get to add those indicators.
    - vmfunction 2y ago
      Look into Windows NT source code that was leaked. The if-else/switch statements in there is just another level of string matching hell. Seems like software development just become "let's jerry rig it to just make it work and forget about it." Pretty sure management (without tech clue) have something to do behaviours like this.
      - 1992spacemovie 2y ago
        > Pretty sure management (without tech clue) have something to do behaviours like this. Always the same bullshit with you people here. Could never possibly someone built a sub-optimal system -- it HAD to be management fucking with our good intentions!
        westmeal 2y ago
tgv 2y ago
Isn't the risk then that they'll first start scanning for "Scarecrow", or is that hidden somehow? Also somewhat surprised the source isn't available. That makes trusting it harder, especially to the people it's aimed at.
- jstanley 2y ago
  Well then you just need to put scarecrow on your honeypot boxes.
- jabroni_salad 2y ago
  ah, so I shall use scarecrow in my analysis machines since the malware will think I'm just pretending to examine it :) If you start down this path you will end up in mindgame hell.
omeid2 2y ago
When is Scarecrow Advanced++ with NextGen Anti-Detection and Cloaking will be released? Jokes aside, this is a temporary fix at best, a waste of resources and impression of safety at worst.
- xarope 2y ago
  Scarecrow Cloud Native AI with Nextgen Quantum Crypto XR ++ (bingo?)
- CyberScarecrow 2y ago
  Author of scarecrow here. Were working on an LLM and a blockchain first ;-) (joke)
- shoo 2y ago
  ssshhhhh, not so loud, they'll hear you and add scarecrows to the checklist of mandatory runtime security requirements for production services
helsinkiandrew 2y ago
I would assume there would be a small intersection of people that would download and install a windows program from an unknown web page and those that are worried about malware. But perhaps I'm wrong
- deno 2y ago
  I know people /plural/ that will happily download cracked antivirus software from a torrent site.
  - pbhjpbhj 2y ago
    Agree, you should get yourself backdoored by a trustworthy company like Sony. /s
  - hobs 2y ago
    That made sense before cryptocurrency, not after.
  - px43 2y ago
    Many torrent sites have stronger reputation vetting than Microsoft code signing certs.
    - astrodust 2y ago
      I mean you can look at the comments and check the vibe.
- CyberScarecrow 2y ago
  Author of cyber scarecrow here. You are right, its a trust thing. Completly understand if people wouldnt want to install it and thats fine. It's the same for any software really. We just havent built up any confidence or trust like a big established company will have.
  - peddling-brink 2y ago
    But why not make it open source? Why not identify who you are as humans? There are ways to establish trust, you aren’t doing any of them.
Dwedit 2y ago
Will this cause actual code signature checks to tell if the EXE running is fake or not?
Copenjin 2y ago
Very nice and well executed idea, but I think that in many cases this could be overestimating the competence of the attacker.
jowea 2y ago
Should make it look like you're Russian too.
xiaodai 2y ago
not surprised if this is the trojan horse
- webprofusion 2y ago
  Next you'll be suggesting that some AV vendors have been known to sponsor development of new viruses and malware.
  - ttyyzz 2y ago
    I also wouldn't download this in 1000 years with no additional information and sourcecode / github etc...
oleg_antonyan 2y ago
To check if your credit card is in scammers' database, please enter card number and cvv
pogue 2y ago
Sounds like a very interesting concept. I'd like to see someone actually test this though. Try running this on a Windows PC with Windows Defender off & just Scarecrow running. You could use the MaleX test kit [1] or a set of malware such as the Zoo collection [2] or something more current. I'd be very interested to see how many malware executables stop half way through their installation after seeing a few bogus registry entries/background programs running. I'm not trying to imply it's worthless, but it needs some actual "real world" test results. [1] https://github.com/Mayachitra-Inc/MaleX https://github.com/Mayachitra-Inc/MaleX [2] https://github.com/ytisf/theZoo https://github.com/ytisf/theZoo
- CyberScarecrow 2y ago
  Author of scarecrow here. Sweet idea, thankyou for sharing. What i would really like to do, is have some sort of stats in the app, that shows if it has 'scared' away any malware. But im not sure how to do that, and work out what other processes on the machine have exited because it saw some cyber scarecrow indicators in the systems process listing.
  - pogue 2y ago
    I would assume with a minimalist program like yours, it wouldn't have the capability to detect whether anything malicious was running on the system. That kind of thing would require some more advanced trip wires that would notice when certain things were triggered when they shouldn't have been or a full blown AV detection engine. I suppose it could work like Sysinternals Process Explorer/Autoruns/etc & submit running hashes to Virustotal.com or other databases, but there's always the likelihood of false positives with that. If you search Github for "malware samples" There are loads of them. Vx Underground also has a large collection [1]. So, I would go through there & look for commonalities to try and find what malware often tries to trigger on startup. I'll just end with this example of an interesting form of a trip wire I've seen in use on Windows PCs: ZoneAlarm makes an anti-ransomwear tool I can't think of the name of. It placed hidden files & folders in every directory on the hard drive. It would then monitor if anything tried to access it - as ransomwear would attempt to encrypt it - and force kill all running programs in an attempt to shut down the malware before it could encrypt the entire HDD. [1] https://vx-underground.org/Archive/Collections https://vx-underground.org/Archive/Collections
webprofusion 2y ago
Source code or it didn't happen.
deleted 2y ago
[deleted]
bendews 2y ago
Lol, this website is registered to someone in Iceland, despite the assurance that it is a "security researcher living in the UK". I'm sure the results from this experiment will make a cool blog post about pwning tech savvy folks.
- CyberScarecrow 2y ago
  That could be the hosting, the website is running on PaaS - https://vercel.com https://vercel.com
- razakel 2y ago
  That's the WHOIS privacy service enabled by default on .com domains registered through Namecheap.
  - bendews 2y ago
    Hmm my Namecheap domains keep the location details even with WHOIS privacy enabled. To be fair they are 7+ years old so maybe something has changed in that time?
    - popcalc 2y ago
      You can still apologize by editing your parent comment. Humility is a gift.
    - hluska 2y ago
      So you don’t actually know what you’re doing but still feel fit to rip on op for it? “Lol” indeed…
puppycodes 2y ago
i'm confused about the tradeoff of not running the software that your pretending to be running? Most AV definitly feels like malware itself so maybe thats your point? But it would probably be better to run good software than fake bad software?
- JoosToopit 2y ago
  But there is no good software for defense. They either introduce obstacles while being barely useful or are useful, introduce obstacles for you and are proprietary and thus are malicious by design.
- ale42 2y ago
  Like keeping Process Monitor open all the time? Not very convenient, especially for the average user.
tazjin 2y ago
Cat, meet mouse.
mschuster91 2y ago
As much as I'd love to see something like this everywhere, the problem is it's useless for everyone who loves to play online games or watch DRM-encumbered content, so the majority of the population... because DRM, anticheat and malware all fear the same set of tools/indicators.
- CyberScarecrow 2y ago
  Author of scarecrow here. Very good point, i hadnt thought about that.
  - self_awareness 2y ago
    Solution: temporary "game mode" that disables most protections that can impact DRM, or a custom rule engine that disables protections if some application is detected to be running (e.g. fortnite.exe or something), but this second method should be done manually by the user.
- marcodiego 2y ago
  > everyone who loves to play online games or watch DRM-encumbered content, so the majority of the population... It is sad to hear that. In my view DRM = malware.
mrjin 2y ago
I'm wondering since when software can be scared?
- Wowfunhappy 2y ago
  Software authors can be scared and their timidity can be reflected in the behavior of their software.
swarnie 2y ago
I wonder if you can make malware think your language and keyboard layout is Russian without having to endure the setup, that's been known to deter some nasty stuff.
Retr0id 2y ago
> When hackers install malicious software on a compromised victim, they first check to make sure its safe for them to run. They don't want to get caught and avoid computers that have security analysis [...] tools on them. Game anti-cheat code makes similar checks (arguably it is malware, but that's besides the point). So, running this might put you at risk of getting banned from your favourite game.
mrweasel 2y ago
Get a PTR record for your IP, let it resolve to honeypot087.win.internal.security.example.com, that will make your IP less interesting... To some people
thrdbndndn 2y ago
One of the reference in "How does it work" [1] mentioned that some hackers will not mess with computers with Russian keyboard, so you can add one to reduce your chance of getting hacked. Hilarious aside, it would only work if you don't actually use multiple keyboard -- otherwise an additional one would make switching between multiple keyboards very annoying [*]. It also mentions some other changes like adding RU keywords to your registry. Again, these measures would have many side effects since lots of software actually use these registry entries for legit reasons. So I don't know if this Cyber Scarecrow product would have this problem, since it does modify registry, too. 1: https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick... *: A little rant: as someone who use three virtual keyboards (English, Chinese, Japanese), it is already a pain in ass to switch them since MS does not follow "last used" switching order (like alt+tab). Instead, it just switches in one direction.
- Sebb767 2y ago
  > A little rant: as someone who use three virtual keyboards (English, Chinese, Japanese), it is already a pain in ass to switch them since MS does not follow "last used" switching order (like alt+tab). Instead, it just switches in one direction. Actually, I much prefer this order. Depending on what keyboard I currently use, I know exactly how often to switch instead of having to remember what I used previously. In fact, I don't even like this order when Alt+Tab'ing, it makes switching between more than two windows pretty inconsistent (yes, I know Windows+Number works, too).
  - thrdbndndn 2y ago
    Yeah, I get your point, it's indeed a trade off. Having "last used" order makes quickly switch between two windows very easy, which is something I personally use more. It's easier than pressing alt+tab/shift+alt+tab alternately. To switch to the third window, you can use alt+tab+tab.
- kazinator 2y ago
  > MS does not follow "last used" switching order Furthermore: 1. The Shift+Alt chord is obnoxiously unreliable, sensitive to which key comes down first, or something. 2. Japanese is always comeing up in A mode even though you last had it in あ mode. 3. Bad performance: sllllow language switching at times: you hit some keyboard sequence for changing languages or modes within a language, and nothing happens. This interacts with (2): did we hit an unreliable chord? Or is it just slow to respond?
efilife 2y ago
Genius! Weird nobody invented this before
efilife 2y ago
Ok, but why isn't this open source? If it only creates some processes that don't do anything, there's nothing to hide, really
- tr33house 2y ago
  this +100 I can't just let some random exe run on my machine with nothing but claims from the author. In my head, I'm also wondering why a botnet wouldn't just want to take over such a machine because they know for sure that it's a scarecrow. But security by obscurity is no way to instill trust here
  - rantee 2y ago
    Claims by an unidentified author(s) replying to comments with a 4-hour old HN account.. How did this make it to the front page other than the catchy name?
    - deleted 2y ago
      [deleted]
stefanve 2y ago
I get the idea but the "science" is based on reports it doesn't look like this has been tested with actual malware. Would be interesting to know how well it works Also make it OSS and ask for donations. Not sure what your feature earning model is but is seems easy to replicate and as point out several times right now it asked to blindly thrust you
salzig 2y ago
Next Iteration: malware checks for scarecrow and starts anyways ^^
khaki54 2y ago
Kind of like instead of buying $10k ADT home security system, just buy the sign for $20 and put it in the front yard.
- vntok 2y ago
  Good analogy, except putting up the sign actually works because there isn't any other layer around it... whereas putting up IOCs onto your Microsoft Windows OS will trigger Windows Defender, any SIEM, and generally speaking most security-oriented software worth its salt.
mafriese 2y ago
I don't understand why the software is built how it's built. Why would you want to implement licensing in the future for a software product that only creates fake processes and registry keys from a list: https://pastebin.com/JVZy4U5i https://pastebin.com/JVZy4U5i . The limitation to 3 processes and license dialog make me feel uncomfortable using the software. All the processes are 14.1MB in size (and basically the scarecrow_process.dll - https://www.virustotal.com/gui/file/83ea1c039f031aa2b05a082c63df12398e6db1322219c53ac4447c637c940dae/details https://www.virustotal.com/gui/file/83ea1c039f031aa2b05a082c...). I just don't understand why you create such a complex piece of software if you can just use a Powershell script that does exactly the same using less resources. The science behind it only kinda makes sense. There is some malware that is using techniques to check if there are those processes are running but by no means is this a good way to keep you protected. Most common malware like credential stealers (redline, vidar, blahblah) don't care about that and they are by far the most common type of malware deployed. Even ransomware like Lockbit doesn't care, even if it's attached to a debugger. I think this mostly creates a false sense of security and if you plan to grow a business out of this, it would probably only take hours until there would be an open source option available. Don't get me wrong - I like the idea of creating new ways of defending malware, what I don't like is the way you try to "sell" it.
- kazinator 2y ago
  They know that if this idea catches on, a dozen completely free imitations will crop up, so ... the time to grab whatever cash can be squeezed out of this is now.
  - GordonS 2y ago
    If something like this catches on, attackers will simply start checking the digital signature of the processes, to ensure they are genuine.
    - umvi 2y ago
      McAfee/Norton/etc. could license signed "scarecrow" versions of their products for use with something like this so that it's impossible for the malware to distinguish a scarecrow version of MacAfee from the real thing (and they would get a cut/kickback). I would pay a small amount for a scarecrow version of AV software if a) it had zero footprint on my system resources, and b) it really did scare away malware that checks for such things. Either way, though, it makes malware more onerous to develop since it has to bundle in public keys in order to verify running processes are correctly signed.
wruza 2y ago
Why does malware “stop” if it sees AV? Sounds as if it wanted to live, which is absurd. A shady concept overall, cause if you occasionally run malware on your pc, it’s already over. Downloading a random exe from a noname site/author to scare malware sounds like another crazy security recipe from your layman tech friend who installs registry cleaners and toggles random settings for “speed up”.
- bux93 2y ago
  Take malware that is part of a botnet. Its initial payload is not necessarily damaging to the host, but is awaiting instructions to e.g. DDOS some future victim. The authors will want the malware to spread as far and wide as it can on e.g. a corporate network. So they need to make a risk assessment; if the malware stays on the current computer, is the risk of detection (over time, as the AV software gets updates) higher than the opportunity to use this host for nefarious purposes later? The list[1] of processes simulated by cyber scarecrow are mostly related to being in a virtual machine though. Utilities like procmon/regmon might indicate the system is being used by a techie. I guess the malware author's assumption is that these machines will be better managed and monitored than the desktop/laptop systems used by office workers. [1] https://pastebin.com/JVZy4U5i https://pastebin.com/JVZy4U5i
  - jeroenhd 2y ago
    Many pieces of malware are encrypted and obfuscated to prevent analysis. Often, they'll detect virtual machines to make it harder for people to analyse the malware. Plenty of malware hides the juicy bits in a second or third stage download that won't trigger if the dropper is loaded inside of a VM (or with a debugger attached, etc.). Similarly, there have also been malware that will deactivate itself when it detects signs of the computer being Russian; Russia doesn't really care about Russian hackers attacking foreign countries (but they'll crack down on malware spreading within Russia, when detected) so for Russian malware authors (and malware authors pretending to be Russian) it's a good idea not to spread to Russian computers. This has the funny side effect of simply adding a Russian keyboard layout being enough to prevent infection from some specific strains of malware. This is less common among the "download trustedsteam.exe to update your whatsapp today" malware and random attack scripts and more likely to happen in targeted attacks at specific targets. This tactic probably won't do anything against the kind of malware that's in pirated games and drive-by downloads (which is probably what most infections are) as I don't think the VM evasion tactics are necessary for those. It may help protect against the kind of malware human rights activists and journalists can face, though. I don't know if I'd trust this particular piece of software to do it, but it'll work in theory. I'm sure malware authors will update their code to detect this software if this approach ever takes off.
makach 2y ago
legit, or best malware install attempt ever? assume all is good if you detect the cyberscarecrow process? how can this have a long-term effect? if you have malware probing your processes to decide if it can run or not you have a very serious problem regardless of whether it decides to run or not, there is an entrance to your systems you don't know about.
sneak 2y ago
> Scarecrow creates registry entries to make it look like security tools are installed on your computer. Best simple anti-malware technique: don’t run Windows.
- forty 2y ago
  Arguably it's the second best, after: don't use computers
forty 2y ago
I guess the indicators used largely overlap with the ones used by anti-cheat software, so you probably want to think twice before using that on your gaming pc :)
- account42 2y ago
  Or you could just choose to not play games that require you to install malware.
  - rvnx 2y ago
    Once you are banned by the anti-cheat because of false positive, this is going to be an easy decision to make
    - forty 2y ago
      Yes in a way the problem is self resolving :)
marcodiego 2y ago
I call BS. How it works says: "When hackers install malicious software on a compromised victim, they first check to make sure its safe for them to run."; Download asks e-mail and name; Does not seems multiplatform and would never install anything like that on my computer in a dream unless it were open source.
- davikr 2y ago
  It's very platform-dependent, because for each one there are different ways in which a virus checks for markers that it's being analysed - for instance, if it's being ran in a VM, it might check registry entries, check for Guest-Host drivers or whatever, on Windows. Still, I wouldn't trust something like this if it asks for PII, isn't open-source and leaves traces around on the disk.
- poincaredisk 2y ago
  I'm a malware researcher and reverse engineer for a living. This is absolutely true, but oversimplified. Focus on >They don't want to get caught and avoid computers that have security analysis or anti-malware tools on them. Malware doesn't want to run in a sandbox environment (or in general when observed), because doing malicious things in the AV sandbox is a straight way to get blocked, and leaks C2 servers and other IoCs immediately. That's why most malware families[1] at least try to check if the machine they're running on is a sandbox/researcher pc/virtual machine. I assume this is what this tool does. We joke at work that the easiest thing to do to make your windows immune to malware is to create a fake service and call it VBoxSVC. [1] except, usually, ransomware, because ransomware is very straightforward and doesn't care about stealth anyway.
SamuelAdams 2y ago
Another simple trick is to add the Russian or Ukraine virtual keyboard to your OS. I’m curious if this tool does this as well. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
- SXX 2y ago
  Except now its bad idea. Like some malwzre from either country can decide to format your drives just for fun.
dns_snek 2y ago
While this is a really interesting idea, and assuming that it's actually completely safe, the irony is that it looks exactly what I would expect a trojan to look like - somewhat vague promises of security that could be interpreted as snake oil, conveniently packaged as an EXE with scant information about who's behind it, what it does, and no way to verify any of it. No offense to the authors :)
mdip 2y ago
Outside of the authorship/open-source fears[0], this is one of the more interesting ideas to surface in anti-virus. Facing reality: anti-malware tooling is inadequate -- so inadequate, I haven't found a reason to purchase it for the one Windows machine I still have. People say "Defender works well enough, now!" and I think that's a pretty adequate way of describing it in that anti-malware has an impossible job and that is evident by every vendor's failure to succeed at it. So why pay for it? It's always a cat-and-mouse game. This is an interesting approach, though, because it could shift the balance a little bit. Anti-malware's biggest problem is successfully identifying a threat while minimally interfering with the performance of an application. A mess of techniques are used to optimize this but when a file has to be scanned, it's expensive. It'd be interesting to see if it'd be possible to eliminate some variants of malware from on-demand scanning "if this tool defeats the malware as effectively", pushing scanning for those variants to an asynchronous process that allows the executable to run while it is being scanned. I can see a lot of the problems with this kind of optimization[1]: it turns a "layer in the onion" into a replacement for an existing function which has more unknowns as far as attacks are concerned. Creating the environmental components required to "trick the malware" may be more expensive than just scanning. White-list scenarios may not be possible: I suspect anti-cheat services and potentially legitimate commercial software might be affected, as well[2] ... getting them to white-list a tool like this won't be easy unless the installed base is substantial. I suspect that "hiding the artifacts this tool creates to trick malware" from a white-listed processes might be impossible. For at least a brief moment, this might be a useful tool in preventing infections from unknown threats. Brief, because -- by the author's own admissions (FAQ) -- it will devolve into a cat-and-mouse game if the tool is popular enough. There's another cat-and-mouse game, though. If this technique isn't resource intensive while offering protection somewhere in line with what it would take to implement, all of the anti-virus vendors will implement it -- including Microsoft. And they will be seen by customers as far better equipped to play "cat" or at least "the choice you won't get fired over." And that's where it makes a whole lot of sense to open-source the product. It's a clever idea with a lot of unknowns and a very low likelihood of being a business. Unless it's being integrated into a larger security suite (same business challenges, but you have something of "a full product" as far as your customers are concerned), it's only value (outside of purely altruistic ones) would be either "popping the tool on the author's related business's website" to bring people to a related business/service or as a way to promote the author's skill set (for consulting/resume reasons). I'm not arrogant enough to say there's no way to make money from it, I just can't see it -- at least, not one that would make enough money to offset the cost of the "cat and mouse" game. [0] Which, yeah, "I wouldn't run it on my computer" but I give the authors enough of the benefit of the doubt that "it's new" [1] Not the least of which being that I do not author AV software so I have nothing to tell me that any of my assumptions about on-demand scanning are correct. [2] It used to be a common practice to make reverse engineering more difficult.
dncornholio 2y ago
This software pings home. Also uses .NET which is complete overkill for such a simple app. Would not recommend installing. It's someone's hobby project that runs as administrator.
- neonsunset 2y ago
  What would you use instead?
  - dncornholio 2y ago
    I don't know, just not this. Wouldn't be hard to make it yourself though.
marcodiego 2y ago
https://xkcd.com/272/ https://xkcd.com/272/
sim7c00 2y ago
"Fake Processes. Scarecrow will create a number of background processes that don't do anything, but look like security research tools. Fake registry entries. Scarecrow creates registry entries to make it look like security tools are installed on your computer." I'd be interested to see this tested, there's tons of good malware repos out there like vx-underground's collections that can be used to test it. If you dont wanna share the source, somewhat logical. Perhaps run a test versus gigabytes of malware samples and let us know which ones actually query these process names / values you create and disable themselves as a result??
etrvic 2y ago
I decided to use Bitdefender a few months ago becouse i suspected my Mac had malware. I was right, there was a adware in the firefox files so it did it’s job. But, my experience with the antivirus was horrible. When i first opened the app there were popus everywhere advertising for their other products, and the overall ui didn’t look trustworthy. I am no security expert, so I’m asking: is this the best way to deal with malware?
- andrei-akopian 2y ago
  Not get it in the first place. Not an expert myself, but I think cleaning up and reinstalling your whole OS once in a while probably deals with malware.
poopcat 2y ago
That is a very fun logo.
999900000999 2y ago
Neat. But this literally comes off as probably being malware itself. If your going to ship something like this, it needs to be open source preferably with a GitHub pipeline so I can see the full build process. You also run into the elephant repellent problem. The best defense to malware will always be regular backups and a willingness to wipe your computer if things go wrong.
- bglazer 2y ago
  elephant repellent problem? What is that? This is literally the first occurrence of that string on the internet.
  - jkingsman 2y ago
    Better known as the Elephant Repellant Fallacy — a claim that a preventative is working when, in fact, the thing it prevents rarely or never happens anyway. "Hey you better buy my elephant repellant so you don't get attacked!" 'Okay.' ... "So were you attacked?" 'No, I live in San Francisco and there are no wild elephants." "Well, I guess the repellant is working!"
    - dlivingston 2y ago
      Also known as the Anti-Tiger Rock: https://youtu.be/xSVqLHghLpw?si=fRraLZJ9q_rDR-UV https://youtu.be/xSVqLHghLpw?si=fRraLZJ9q_rDR-UV
    - burnished 2y ago
      I know this as 'Moms cooking drove the vampires away'
  - cootsnuck 2y ago
    https://chatgpt.com/share/16f27556-5766-4728-8245-9909d1803773 https://chatgpt.com/share/16f27556-5766-4728-8245-9909d18037... We need a chatGPT version of LMGTFY...
mdip 2y ago
Setting aside the concerns with this specific implementation and thinking more of "the idea" I think the biggest concern is this sort of application causing legitimate software to fail to run[0] and how one would "white-list" an application from seeing these "fake artifacts designed to trick malware." The problem is "the fake components" would have to be prevented from being detected by legitimate software and the only way I can think to do that would be to execute everything in a sandbox that is capable of: (a) hiding some contained running processes (the fake ones) from the rest of the OS while (b) while allowing the process that "sees the fake stuff" to be seen by everything else "like any old process." Applying ACLs (and restricting white-listed processes) might work in some cases; might equally just be seen as a permissions problem and result in a nonsensical error (because the developers never imagined someone would change the permissions on an obvious key), or it might be that the "trick" employed is "Adding a Russian Keyboard" which can be very disruptive to the user "if they use more than one input language" or "is one of those places where a program may read from there never expecting to encounter an error." A lot of this seems like it would require use of containerization -- docker/docker-like -- for Windows apps. I'm familiar with a few offerings here and there, but I've worked with none of them and I run Linux more than Windows these days. So my questions really boil down to: Where's Windows containerization at? Would it be possible to run an application in a docker or docker-like container with a Windows kernel which can have its environment controlled in a manner that is more transparent to the application running within the container? Is there any other approach which would allow for "non-white-listed applications" to run containerized and "see the Scarecrow artifacts", while allowing the white-listed applications[1] to run outside of the container in a manner that hides some of the processes within the container. Can it do all of that in a manner that would work if the same "check" were repeated immediately after confirming an Elevation dialog[2]? from the white-listed application in a manner that couldn't be defeated by repeating the same "check" after presenting an elevation dialog? Again, that's assuming "this is a brilliant idea" -- and there's some evidence that as a concept, at least, it would help (ignoring this particular implementation of the idea), but it still suffers from its success, so the extent that it helps/is adopted equates to how long any of these techniques aren't defeated. And just from the sense I get of the complexities required to "implement this in a manner that legitimate won't fail, too", I suspect it will be easier to defeat a tool like this than it will be to protect against its defeat. In other words, the attacker is a healthy young cat chasing a tired old mouse. [0] Anti-cheat being the most obvious, but those are often indistinguishable from malware. I'd encountered plenty of games/apps in the 90s that refused to run when I ran software to trace aspects of their memory interaction. I had some weird accounting app that somehow figured out when my own code (well, code I mostly borrowed from other implementations) was used for the same purpose. [1] The assumption being that "a legitimate application which does these kinds of checks" is also likely to refuse to run within a container unless it's impossible to detect the container as reliably as everything else (and vendors are completely tolerant of false positives if the affected customers don't represent enough in terms of profit, or the solution is "don't run that unusual security software when you run ours"). [2] I've seen it enough with Easy Anti-cheat that I just click "Yes" like a drone. There was at least one occasion when it popped up after I had installed some developer tooling but not had a game update come down between launches. Because it was a huge install, it may just have been that the game detectedI have no idea why this happens -- on a few occasions, I had no update applied between loads but had installed other software so it could have been "to fix something that software broke" but it could also have been "to re-evaluate the environment as an administrator because something changed enough on the system to warrant a re-check that it is still compliant with the rules"
MrVandemar 2y ago
No Linux version? :-)
richwater 2y ago
Anyone who downloads this is a moron.
flerchin 2y ago
Krebs said that some malware checks for a cyrillic keyboard to try and geo target outside of the country of operation. This seems to be the same type of thing. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
- vntok 2y ago
  Other malware check for a cyrillic keyboard to try and geo target inside of the country of opération.
m3kw9 2y ago
Does it really work? Let’s see some stats
moi2388 2y ago
“It’s a trust thing” Yeah. That won’t work for anything security related, I’m afraid.
mistercheph 2y ago
More likely than not this is malware
TurkishPoptart 2y ago
I've heard one thing that motivates malware to ignore your computer is having a Russian keyboard installed. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...
s1mplicissimus 2y ago
Hahaha it's such a lovely idea! Turning the opponents detection against them, I very much dig it! Here's a caveat though: Attackers will at some point notice scarecrows and simply work around them. Now suuure, if you have a better lock than your neighbours, that decreases your chances of getting broken into, but in the end this is a classic "security by obscurity" measure. So if your time and computer/data is valuable, I would rather invest in other security measures (firewall, awareness training, backups etc.)
checjsout 2y ago
I wonder if it would trick the compliance department into thinking my computer is safe and leave it alone.
no-dr-onboard 2y ago
Fun concept, but this is security by obscurity. Other heuristics: - providing fake manifests to hardware drivers commonly associated with virtual machines - active process inspector handles - presence of any software signed by hexrays (the ini file is usually enough)
- bhelkey 2y ago
  > Fun concept, but this is security by obscurity. Malware uses signals to determine if they are running in a VM. If we can degrade those signals, they will have to play a cat and mouse game trying to avoid VMs. The less clear it is if a process is running in a VM, the easier time security researchers will have testing exploits found in the wild.
usrbinbash 2y ago
Many of the most dangerous threat actors simply don't care about getting caught. They are operated, financed and protected by nation states, and/or operate from geopolitical locations where law enforcement is lacking.
russdill 2y ago
Wow, never ever install this if you plan to play games with cheat detection
annoyingnoob 2y ago
Anyone run this through VirusTotal?
otikik 2y ago
Heh. The arms race continues.
mistercheph 2y ago
How I pwned hacker news (2024)
eigenvalue 2y ago
I really don't get why this would be a 71mb installer that takes up 113mb when installed. If they are literally just fake processes running that have the right names, why couldn't this be a 100kb installer?
nsbk 2y ago
This may very well be the greatest British deception since the WWII carrot propaganda. But for malware. Nice!
lbotos 2y ago
"It's early days, were only in Alpha." -> It's early days, we're only in Alpha.
verandaguy 2y ago
This is a really cool concept! Even if it's difficult to trust it as-is (for reasons stated ad nauseam in other comments), this might put gas on the fire of a so-far small area of malware research, which will be good for the community at large. It's obviously an arms race when it comes to malware, but this could be a significant step forward on the defensive side, forcing malware developers to evolve their TTPs.
Andaith 2y ago
I heard you could do something very similar but with installing the Russian Keyboard layout and having it available as an option. A lot of malware from Russia won't run on computers with a Russian keyboard layout, because they only get in trouble with the law if the malware impacts Russian users.
zb3 2y ago
Jia Tan is back :D
slimebot80 2y ago
So immediately I am wondering what is the list of processes names are? Lots of people on HN could easily spin up their own fake processes if they knew the names?
maronato 2y ago
It asks for our names and emails, provides an opaque exe and no source code, asks to be run as admin, pings home, doesn’t say who you are or how many of you there are, and justifies it all with “trust me bro”. People, this is malware. Please don’t fall for it. I don’t think it’s wise to leave this on the front page. I hope dang agrees and takes it down.

Cyber Scarecrow

606 points by toby_tw 2y ago

dogben 2y ago

A simple magic is to set system language and locale to Russian.

deleted 2y ago
[deleted]
Etheryte 2y ago
Yes, but then your system is in Russian which is pretty much the same as having malware.
Epskampie 2y ago
Yes very simple! Not a problem whatsoever with that. я не говорю по-русски
sunaookami 2y ago
A simple magic is using an operating system that is not full of security holes by an incompetent vendor.

iforgotpassword 2y ago

Narrator: and so the arms race continues. I guess if this gets enough attention, malware will just add more sophisticated checks and not just look at the exe name. But on that note, I wondered the same thing at my last workplace where we'd only run windows in virtual machines. Sometimes these were quite outdated regarding system and browser updates, and some non-tech staff used them to browse random websites. They were never hit by any crypto malware and whatnot, which surprised me a lot at first, but at some point I realized the first thing you do as even a halfway decent malware author is checking whether you run in a virtualized environment.

fancythat 2y ago
This works, I can confirm. Majority of malware threat running in a VM as a sign of researcher doing the malware analysis. I am recommending doing this for over 10 years now.
- mdip 2y ago
  That's where I wonder about a tool like this interfering with legitimate software. For example, I believe the anti-cheat software used by games like Fortnite looks for similar things -- my understanding is that it, too, will refuse to start when it is executing in a VM[0]. As a teenager (90s), I remember several applications/games refusing to start when I'd attached a tracing process to them. They did this to stop exactly what I was doing: trying to figure out how to defeat the software licensing code. I haven't had a need to do that since the turn of the century but I'd put $10 on that still being a thing. So you end up with a "false positive", and like anti-virus software, it results in "denial of service." But does anti-virus's solution of "white list it" apply here? At least with their specific implementation, it's "on or off", but I wonder if it's even possible to alter the application in a way that could "white list a process so it doesn't see the 'malware defeat tricks' this exposes." If not, you'd just have to "turn off protection" when you were using that program. That might not be practical depending on the program. It's also not likely the vendor of that program will care that "an application which pretends it's doing things we don't like" breaks their application unless it represents a lot of their install base. [0] I looked into it a few years ago b/c I run Tumbleweed and it's a game the kids enjoy (I'm not a huge fan but my gaming days have been behind me for a while, now) ... I had hoped to be able to expose my GPU to the VM enough to be able to play it but didn't bother trying after reading others' experiences.
  - fancythat 2y ago
    You are right, some games, especially multiplayer ones will refuse to work in the VM to prevent cheating, but this is, of course, the business decision on their side. You can always construct the software in such a way that when it detects something suspicious on the system it ceases to function: some copy protections looked up for change in the network card hardware id as developers presumed it is highly unlikely someone will change network interface, but that stopped to be common, when people started using on-board interfaces that change with every motherboard change. There is also a difference when using commercial stuff such as vmware instead of qemu or virtualbox as open source is more suitable to be tailored to the specific thing, in this case, cheating. In the end, this approach works well for slowing done malware as there is less risk for normal software to allow working inside of vm in contrast to malware that should be coded to be extra paranoid in order to avoid as many tar pits as possible.
curtisblaine 2y ago
> I guess if this gets enough attention, malware will just add more sophisticated checks and not just look at the exe name. But more sophisticated detection means bigger payload (making the malware easier to detect) and more complexity (making the malware harder to make / maintain), so mission accomplished.
- saagarjha 2y ago
  Not by much. Probably less effort than you're putting in trying to avoid the malware, so it's a net loss.
  - xiphias2 2y ago
    The more scarecrow is installed, the easier it gets for real security researchers to hide from these checks and detect viruses. So actually the dynamic helps security research.
    - saagarjha 2y ago
      That's not how this works.
- oefrha 2y ago
  “Sophisticated” detection can be as simple as checking rss and pcpu, the bullshit decoy processes probably aren’t wasting a lot of CPU and RAM, otherwise might as well run the real things; if they are, well, just avoid, who cares. So no, it’s not going to meaningfully complicate anything.
  - curtisblaine 2y ago
    Wouldn't that be more fragile though? CPU usage is not constant in time, so if - again - you're not sophisticated enough, you get more false negatives / positives, depending on which side of the heuristic you err.
    - 2y ago

nubinetwork 2y ago

If you're going to go through the effort of faking honeypot/analysis tools, why not just run them?

deleted 2y ago
[deleted]
ok_dad 2y ago
Costs a lot of cycles to run those for real, and it’s not super common to get infected with anything, so you’re wasting cycles for a small chance at avoiding it. This could be better since, I assume, it doesn’t do a lot of stuff.
- exe34 2y ago
  can you nice them?
  - JoosToopit 2y ago
    To make them imitate the real activity? To imitate what scarecrow does?
CyberScarecrow 2y ago
Author of scarecrow here. The idea is cyber scarecrow is just super easy and light weight for anyone to use. Honeypot tech tends to need some good tech understanding to use (eg the cli), and can be a bit heavyweight for always running in the background of your computer.

scosman 2y ago

Fun concept. If the creators read this, I suggest some ways of building trust. There’s no “about us”, no GitHub link, etc. It’s a random webpage that wants my personal details, and sends me a “exe”. The overlap of people who understand what this tool does, and people who would run that “exe” is pretty small.

vmfunction 2y ago
It is a cat and mouse game. And security by obscurity practice. Not saying it won't work, but if it is open sourced, how long before the malware will catch on? Here is one on github: https://github.com/NavyTitanium/Fake-Sandbox-Artifacts https://github.com/NavyTitanium/Fake-Sandbox-Artifacts
- xyzzy123 2y ago
  The really fun part is when malware authors add detections for "fake sandbox" and then real sandbox authors get to add those indicators.
  - vmfunction 2y ago
    Look into Windows NT source code that was leaked. The if-else/switch statements in there is just another level of string matching hell. Seems like software development just become "let's jerry rig it to just make it work and forget about it." Pretty sure management (without tech clue) have something to do behaviours like this.
    - 1992spacemovie 2y ago
      > Pretty sure management (without tech clue) have something to do behaviours like this. Always the same bullshit with you people here. Could never possibly someone built a sub-optimal system -- it HAD to be management fucking with our good intentions!
      - westmeal 2y ago

tgv 2y ago

Isn't the risk then that they'll first start scanning for "Scarecrow", or is that hidden somehow? Also somewhat surprised the source isn't available. That makes trusting it harder, especially to the people it's aimed at.

jstanley 2y ago
Well then you just need to put scarecrow on your honeypot boxes.
jabroni_salad 2y ago
ah, so I shall use scarecrow in my analysis machines since the malware will think I'm just pretending to examine it :) If you start down this path you will end up in mindgame hell.

omeid2 2y ago

When is Scarecrow Advanced++ with NextGen Anti-Detection and Cloaking will be released? Jokes aside, this is a temporary fix at best, a waste of resources and impression of safety at worst.

xarope 2y ago
Scarecrow Cloud Native AI with Nextgen Quantum Crypto XR ++ (bingo?)
CyberScarecrow 2y ago
Author of scarecrow here. Were working on an LLM and a blockchain first ;-) (joke)
shoo 2y ago
ssshhhhh, not so loud, they'll hear you and add scarecrows to the checklist of mandatory runtime security requirements for production services

helsinkiandrew 2y ago

I would assume there would be a small intersection of people that would download and install a windows program from an unknown web page and those that are worried about malware. But perhaps I'm wrong

deno 2y ago
I know people /plural/ that will happily download cracked antivirus software from a torrent site.
- pbhjpbhj 2y ago
  Agree, you should get yourself backdoored by a trustworthy company like Sony. /s
- hobs 2y ago
  That made sense before cryptocurrency, not after.
- px43 2y ago
  Many torrent sites have stronger reputation vetting than Microsoft code signing certs.
  - astrodust 2y ago
    I mean you can look at the comments and check the vibe.
CyberScarecrow 2y ago
Author of cyber scarecrow here. You are right, its a trust thing. Completly understand if people wouldnt want to install it and thats fine. It's the same for any software really. We just havent built up any confidence or trust like a big established company will have.
- peddling-brink 2y ago
  But why not make it open source? Why not identify who you are as humans? There are ways to establish trust, you aren’t doing any of them.

Dwedit 2y ago

Will this cause actual code signature checks to tell if the EXE running is fake or not?

Copenjin 2y ago

Very nice and well executed idea, but I think that in many cases this could be overestimating the competence of the attacker.

jowea 2y ago

Should make it look like you're Russian too.

xiaodai 2y ago

not surprised if this is the trojan horse

webprofusion 2y ago
Next you'll be suggesting that some AV vendors have been known to sponsor development of new viruses and malware.
- ttyyzz 2y ago
  I also wouldn't download this in 1000 years with no additional information and sourcecode / github etc...

oleg_antonyan 2y ago

To check if your credit card is in scammers' database, please enter card number and cvv

pogue 2y ago

Sounds like a very interesting concept. I'd like to see someone actually test this though. Try running this on a Windows PC with Windows Defender off & just Scarecrow running. You could use the MaleX test kit [1] or a set of malware such as the Zoo collection [2] or something more current. I'd be very interested to see how many malware executables stop half way through their installation after seeing a few bogus registry entries/background programs running. I'm not trying to imply it's worthless, but it needs some actual "real world" test results. [1] https://github.com/Mayachitra-Inc/MaleX https://github.com/Mayachitra-Inc/MaleX [2] https://github.com/ytisf/theZoo https://github.com/ytisf/theZoo

CyberScarecrow 2y ago
Author of scarecrow here. Sweet idea, thankyou for sharing. What i would really like to do, is have some sort of stats in the app, that shows if it has 'scared' away any malware. But im not sure how to do that, and work out what other processes on the machine have exited because it saw some cyber scarecrow indicators in the systems process listing.
- pogue 2y ago
  I would assume with a minimalist program like yours, it wouldn't have the capability to detect whether anything malicious was running on the system. That kind of thing would require some more advanced trip wires that would notice when certain things were triggered when they shouldn't have been or a full blown AV detection engine. I suppose it could work like Sysinternals Process Explorer/Autoruns/etc & submit running hashes to Virustotal.com or other databases, but there's always the likelihood of false positives with that. If you search Github for "malware samples" There are loads of them. Vx Underground also has a large collection [1]. So, I would go through there & look for commonalities to try and find what malware often tries to trigger on startup. I'll just end with this example of an interesting form of a trip wire I've seen in use on Windows PCs: ZoneAlarm makes an anti-ransomwear tool I can't think of the name of. It placed hidden files & folders in every directory on the hard drive. It would then monitor if anything tried to access it - as ransomwear would attempt to encrypt it - and force kill all running programs in an attempt to shut down the malware before it could encrypt the entire HDD. [1] https://vx-underground.org/Archive/Collections https://vx-underground.org/Archive/Collections

webprofusion 2y ago

Source code or it didn't happen.

deleted 2y ago

[deleted]

bendews 2y ago

Lol, this website is registered to someone in Iceland, despite the assurance that it is a "security researcher living in the UK". I'm sure the results from this experiment will make a cool blog post about pwning tech savvy folks.

CyberScarecrow 2y ago
That could be the hosting, the website is running on PaaS - https://vercel.com https://vercel.com
razakel 2y ago
That's the WHOIS privacy service enabled by default on .com domains registered through Namecheap.
- bendews 2y ago
  Hmm my Namecheap domains keep the location details even with WHOIS privacy enabled. To be fair they are 7+ years old so maybe something has changed in that time?
  - popcalc 2y ago
    You can still apologize by editing your parent comment. Humility is a gift.
  - hluska 2y ago
    So you don’t actually know what you’re doing but still feel fit to rip on op for it? “Lol” indeed…

puppycodes 2y ago

i'm confused about the tradeoff of not running the software that your pretending to be running? Most AV definitly feels like malware itself so maybe thats your point? But it would probably be better to run good software than fake bad software?

JoosToopit 2y ago
But there is no good software for defense. They either introduce obstacles while being barely useful or are useful, introduce obstacles for you and are proprietary and thus are malicious by design.
ale42 2y ago
Like keeping Process Monitor open all the time? Not very convenient, especially for the average user.

tazjin 2y ago

Cat, meet mouse.

mschuster91 2y ago

As much as I'd love to see something like this everywhere, the problem is it's useless for everyone who loves to play online games or watch DRM-encumbered content, so the majority of the population... because DRM, anticheat and malware all fear the same set of tools/indicators.

CyberScarecrow 2y ago
Author of scarecrow here. Very good point, i hadnt thought about that.
- self_awareness 2y ago
  Solution: temporary "game mode" that disables most protections that can impact DRM, or a custom rule engine that disables protections if some application is detected to be running (e.g. fortnite.exe or something), but this second method should be done manually by the user.
marcodiego 2y ago
> everyone who loves to play online games or watch DRM-encumbered content, so the majority of the population... It is sad to hear that. In my view DRM = malware.

mrjin 2y ago

I'm wondering since when software can be scared?

Wowfunhappy 2y ago
Software authors can be scared and their timidity can be reflected in the behavior of their software.

swarnie 2y ago

I wonder if you can make malware think your language and keyboard layout is Russian without having to endure the setup, that's been known to deter some nasty stuff.

Retr0id 2y ago

> When hackers install malicious software on a compromised victim, they first check to make sure its safe for them to run. They don't want to get caught and avoid computers that have security analysis [...] tools on them. Game anti-cheat code makes similar checks (arguably it is malware, but that's besides the point). So, running this might put you at risk of getting banned from your favourite game.

mrweasel 2y ago

Get a PTR record for your IP, let it resolve to honeypot087.win.internal.security.example.com, that will make your IP less interesting... To some people

thrdbndndn 2y ago

One of the reference in "How does it work" [1] mentioned that some hackers will not mess with computers with Russian keyboard, so you can add one to reduce your chance of getting hacked. Hilarious aside, it would only work if you don't actually use multiple keyboard -- otherwise an additional one would make switching between multiple keyboards very annoying [*]. It also mentions some other changes like adding RU keywords to your registry. Again, these measures would have many side effects since lots of software actually use these registry entries for legit reasons. So I don't know if this Cyber Scarecrow product would have this problem, since it does modify registry, too. 1: https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick... *: A little rant: as someone who use three virtual keyboards (English, Chinese, Japanese), it is already a pain in ass to switch them since MS does not follow "last used" switching order (like alt+tab). Instead, it just switches in one direction.

Sebb767 2y ago
> A little rant: as someone who use three virtual keyboards (English, Chinese, Japanese), it is already a pain in ass to switch them since MS does not follow "last used" switching order (like alt+tab). Instead, it just switches in one direction. Actually, I much prefer this order. Depending on what keyboard I currently use, I know exactly how often to switch instead of having to remember what I used previously. In fact, I don't even like this order when Alt+Tab'ing, it makes switching between more than two windows pretty inconsistent (yes, I know Windows+Number works, too).
- thrdbndndn 2y ago
  Yeah, I get your point, it's indeed a trade off. Having "last used" order makes quickly switch between two windows very easy, which is something I personally use more. It's easier than pressing alt+tab/shift+alt+tab alternately. To switch to the third window, you can use alt+tab+tab.
kazinator 2y ago
> MS does not follow "last used" switching order Furthermore: 1. The Shift+Alt chord is obnoxiously unreliable, sensitive to which key comes down first, or something. 2. Japanese is always comeing up in A mode even though you last had it in あ mode. 3. Bad performance: sllllow language switching at times: you hit some keyboard sequence for changing languages or modes within a language, and nothing happens. This interacts with (2): did we hit an unreliable chord? Or is it just slow to respond?

efilife 2y ago

Genius! Weird nobody invented this before

efilife 2y ago

Ok, but why isn't this open source? If it only creates some processes that don't do anything, there's nothing to hide, really

tr33house 2y ago
this +100 I can't just let some random exe run on my machine with nothing but claims from the author. In my head, I'm also wondering why a botnet wouldn't just want to take over such a machine because they know for sure that it's a scarecrow. But security by obscurity is no way to instill trust here
- rantee 2y ago
  Claims by an unidentified author(s) replying to comments with a 4-hour old HN account.. How did this make it to the front page other than the catchy name?
  - deleted 2y ago
    [deleted]

stefanve 2y ago

I get the idea but the "science" is based on reports it doesn't look like this has been tested with actual malware. Would be interesting to know how well it works Also make it OSS and ask for donations. Not sure what your feature earning model is but is seems easy to replicate and as point out several times right now it asked to blindly thrust you

salzig 2y ago

Next Iteration: malware checks for scarecrow and starts anyways ^^

khaki54 2y ago

Kind of like instead of buying $10k ADT home security system, just buy the sign for $20 and put it in the front yard.

vntok 2y ago
Good analogy, except putting up the sign actually works because there isn't any other layer around it... whereas putting up IOCs onto your Microsoft Windows OS will trigger Windows Defender, any SIEM, and generally speaking most security-oriented software worth its salt.

mafriese 2y ago

I don't understand why the software is built how it's built. Why would you want to implement licensing in the future for a software product that only creates fake processes and registry keys from a list: https://pastebin.com/JVZy4U5i https://pastebin.com/JVZy4U5i . The limitation to 3 processes and license dialog make me feel uncomfortable using the software. All the processes are 14.1MB in size (and basically the scarecrow_process.dll - https://www.virustotal.com/gui/file/83ea1c039f031aa2b05a082c63df12398e6db1322219c53ac4447c637c940dae/details https://www.virustotal.com/gui/file/83ea1c039f031aa2b05a082c...). I just don't understand why you create such a complex piece of software if you can just use a Powershell script that does exactly the same using less resources. The science behind it only kinda makes sense. There is some malware that is using techniques to check if there are those processes are running but by no means is this a good way to keep you protected. Most common malware like credential stealers (redline, vidar, blahblah) don't care about that and they are by far the most common type of malware deployed. Even ransomware like Lockbit doesn't care, even if it's attached to a debugger. I think this mostly creates a false sense of security and if you plan to grow a business out of this, it would probably only take hours until there would be an open source option available. Don't get me wrong - I like the idea of creating new ways of defending malware, what I don't like is the way you try to "sell" it.

kazinator 2y ago
They know that if this idea catches on, a dozen completely free imitations will crop up, so ... the time to grab whatever cash can be squeezed out of this is now.
- GordonS 2y ago
  If something like this catches on, attackers will simply start checking the digital signature of the processes, to ensure they are genuine.
  - umvi 2y ago
    McAfee/Norton/etc. could license signed "scarecrow" versions of their products for use with something like this so that it's impossible for the malware to distinguish a scarecrow version of MacAfee from the real thing (and they would get a cut/kickback). I would pay a small amount for a scarecrow version of AV software if a) it had zero footprint on my system resources, and b) it really did scare away malware that checks for such things. Either way, though, it makes malware more onerous to develop since it has to bundle in public keys in order to verify running processes are correctly signed.

wruza 2y ago

Why does malware “stop” if it sees AV? Sounds as if it wanted to live, which is absurd. A shady concept overall, cause if you occasionally run malware on your pc, it’s already over. Downloading a random exe from a noname site/author to scare malware sounds like another crazy security recipe from your layman tech friend who installs registry cleaners and toggles random settings for “speed up”.

bux93 2y ago
Take malware that is part of a botnet. Its initial payload is not necessarily damaging to the host, but is awaiting instructions to e.g. DDOS some future victim. The authors will want the malware to spread as far and wide as it can on e.g. a corporate network. So they need to make a risk assessment; if the malware stays on the current computer, is the risk of detection (over time, as the AV software gets updates) higher than the opportunity to use this host for nefarious purposes later? The list[1] of processes simulated by cyber scarecrow are mostly related to being in a virtual machine though. Utilities like procmon/regmon might indicate the system is being used by a techie. I guess the malware author's assumption is that these machines will be better managed and monitored than the desktop/laptop systems used by office workers. [1] https://pastebin.com/JVZy4U5i https://pastebin.com/JVZy4U5i
- jeroenhd 2y ago
  Many pieces of malware are encrypted and obfuscated to prevent analysis. Often, they'll detect virtual machines to make it harder for people to analyse the malware. Plenty of malware hides the juicy bits in a second or third stage download that won't trigger if the dropper is loaded inside of a VM (or with a debugger attached, etc.). Similarly, there have also been malware that will deactivate itself when it detects signs of the computer being Russian; Russia doesn't really care about Russian hackers attacking foreign countries (but they'll crack down on malware spreading within Russia, when detected) so for Russian malware authors (and malware authors pretending to be Russian) it's a good idea not to spread to Russian computers. This has the funny side effect of simply adding a Russian keyboard layout being enough to prevent infection from some specific strains of malware. This is less common among the "download trustedsteam.exe to update your whatsapp today" malware and random attack scripts and more likely to happen in targeted attacks at specific targets. This tactic probably won't do anything against the kind of malware that's in pirated games and drive-by downloads (which is probably what most infections are) as I don't think the VM evasion tactics are necessary for those. It may help protect against the kind of malware human rights activists and journalists can face, though. I don't know if I'd trust this particular piece of software to do it, but it'll work in theory. I'm sure malware authors will update their code to detect this software if this approach ever takes off.

makach 2y ago

legit, or best malware install attempt ever? assume all is good if you detect the cyberscarecrow process? how can this have a long-term effect? if you have malware probing your processes to decide if it can run or not you have a very serious problem regardless of whether it decides to run or not, there is an entrance to your systems you don't know about.

sneak 2y ago

> Scarecrow creates registry entries to make it look like security tools are installed on your computer. Best simple anti-malware technique: don’t run Windows.

forty 2y ago
Arguably it's the second best, after: don't use computers

forty 2y ago

I guess the indicators used largely overlap with the ones used by anti-cheat software, so you probably want to think twice before using that on your gaming pc :)

account42 2y ago
Or you could just choose to not play games that require you to install malware.
- rvnx 2y ago
  Once you are banned by the anti-cheat because of false positive, this is going to be an easy decision to make
  - forty 2y ago
    Yes in a way the problem is self resolving :)

marcodiego 2y ago

I call BS. How it works says: "When hackers install malicious software on a compromised victim, they first check to make sure its safe for them to run."; Download asks e-mail and name; Does not seems multiplatform and would never install anything like that on my computer in a dream unless it were open source.

davikr 2y ago
It's very platform-dependent, because for each one there are different ways in which a virus checks for markers that it's being analysed - for instance, if it's being ran in a VM, it might check registry entries, check for Guest-Host drivers or whatever, on Windows. Still, I wouldn't trust something like this if it asks for PII, isn't open-source and leaves traces around on the disk.
poincaredisk 2y ago
I'm a malware researcher and reverse engineer for a living. This is absolutely true, but oversimplified. Focus on >They don't want to get caught and avoid computers that have security analysis or anti-malware tools on them. Malware doesn't want to run in a sandbox environment (or in general when observed), because doing malicious things in the AV sandbox is a straight way to get blocked, and leaks C2 servers and other IoCs immediately. That's why most malware families[1] at least try to check if the machine they're running on is a sandbox/researcher pc/virtual machine. I assume this is what this tool does. We joke at work that the easiest thing to do to make your windows immune to malware is to create a fake service and call it VBoxSVC. [1] except, usually, ransomware, because ransomware is very straightforward and doesn't care about stealth anyway.

SamuelAdams 2y ago

Another simple trick is to add the Russian or Ukraine virtual keyboard to your OS. I’m curious if this tool does this as well. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

SXX 2y ago
Except now its bad idea. Like some malwzre from either country can decide to format your drives just for fun.

dns_snek 2y ago

While this is a really interesting idea, and assuming that it's actually completely safe, the irony is that it looks exactly what I would expect a trojan to look like - somewhat vague promises of security that could be interpreted as snake oil, conveniently packaged as an EXE with scant information about who's behind it, what it does, and no way to verify any of it. No offense to the authors :)

mdip 2y ago

Outside of the authorship/open-source fears[0], this is one of the more interesting ideas to surface in anti-virus. Facing reality: anti-malware tooling is inadequate -- so inadequate, I haven't found a reason to purchase it for the one Windows machine I still have. People say "Defender works well enough, now!" and I think that's a pretty adequate way of describing it in that anti-malware has an impossible job and that is evident by every vendor's failure to succeed at it. So why pay for it? It's always a cat-and-mouse game. This is an interesting approach, though, because it could shift the balance a little bit. Anti-malware's biggest problem is successfully identifying a threat while minimally interfering with the performance of an application. A mess of techniques are used to optimize this but when a file has to be scanned, it's expensive. It'd be interesting to see if it'd be possible to eliminate some variants of malware from on-demand scanning "if this tool defeats the malware as effectively", pushing scanning for those variants to an asynchronous process that allows the executable to run while it is being scanned. I can see a lot of the problems with this kind of optimization[1]: it turns a "layer in the onion" into a replacement for an existing function which has more unknowns as far as attacks are concerned. Creating the environmental components required to "trick the malware" may be more expensive than just scanning. White-list scenarios may not be possible: I suspect anti-cheat services and potentially legitimate commercial software might be affected, as well[2] ... getting them to white-list a tool like this won't be easy unless the installed base is substantial. I suspect that "hiding the artifacts this tool creates to trick malware" from a white-listed processes might be impossible. For at least a brief moment, this might be a useful tool in preventing infections from unknown threats. Brief, because -- by the author's own admissions (FAQ) -- it will devolve into a cat-and-mouse game if the tool is popular enough. There's another cat-and-mouse game, though. If this technique isn't resource intensive while offering protection somewhere in line with what it would take to implement, all of the anti-virus vendors will implement it -- including Microsoft. And they will be seen by customers as far better equipped to play "cat" or at least "the choice you won't get fired over." And that's where it makes a whole lot of sense to open-source the product. It's a clever idea with a lot of unknowns and a very low likelihood of being a business. Unless it's being integrated into a larger security suite (same business challenges, but you have something of "a full product" as far as your customers are concerned), it's only value (outside of purely altruistic ones) would be either "popping the tool on the author's related business's website" to bring people to a related business/service or as a way to promote the author's skill set (for consulting/resume reasons). I'm not arrogant enough to say there's no way to make money from it, I just can't see it -- at least, not one that would make enough money to offset the cost of the "cat and mouse" game. [0] Which, yeah, "I wouldn't run it on my computer" but I give the authors enough of the benefit of the doubt that "it's new" [1] Not the least of which being that I do not author AV software so I have nothing to tell me that any of my assumptions about on-demand scanning are correct. [2] It used to be a common practice to make reverse engineering more difficult.

dncornholio 2y ago

This software pings home. Also uses .NET which is complete overkill for such a simple app. Would not recommend installing. It's someone's hobby project that runs as administrator.

neonsunset 2y ago
What would you use instead?
- dncornholio 2y ago
  I don't know, just not this. Wouldn't be hard to make it yourself though.

marcodiego 2y ago

https://xkcd.com/272/ https://xkcd.com/272/

sim7c00 2y ago

"Fake Processes. Scarecrow will create a number of background processes that don't do anything, but look like security research tools. Fake registry entries. Scarecrow creates registry entries to make it look like security tools are installed on your computer." I'd be interested to see this tested, there's tons of good malware repos out there like vx-underground's collections that can be used to test it. If you dont wanna share the source, somewhat logical. Perhaps run a test versus gigabytes of malware samples and let us know which ones actually query these process names / values you create and disable themselves as a result??

etrvic 2y ago

I decided to use Bitdefender a few months ago becouse i suspected my Mac had malware. I was right, there was a adware in the firefox files so it did it’s job. But, my experience with the antivirus was horrible. When i first opened the app there were popus everywhere advertising for their other products, and the overall ui didn’t look trustworthy. I am no security expert, so I’m asking: is this the best way to deal with malware?

andrei-akopian 2y ago
Not get it in the first place. Not an expert myself, but I think cleaning up and reinstalling your whole OS once in a while probably deals with malware.

poopcat 2y ago

That is a very fun logo.

999900000999 2y ago

Neat. But this literally comes off as probably being malware itself. If your going to ship something like this, it needs to be open source preferably with a GitHub pipeline so I can see the full build process. You also run into the elephant repellent problem. The best defense to malware will always be regular backups and a willingness to wipe your computer if things go wrong.

bglazer 2y ago
elephant repellent problem? What is that? This is literally the first occurrence of that string on the internet.
- jkingsman 2y ago
  Better known as the Elephant Repellant Fallacy — a claim that a preventative is working when, in fact, the thing it prevents rarely or never happens anyway. "Hey you better buy my elephant repellant so you don't get attacked!" 'Okay.' ... "So were you attacked?" 'No, I live in San Francisco and there are no wild elephants." "Well, I guess the repellant is working!"
  - dlivingston 2y ago
    Also known as the Anti-Tiger Rock: https://youtu.be/xSVqLHghLpw?si=fRraLZJ9q_rDR-UV https://youtu.be/xSVqLHghLpw?si=fRraLZJ9q_rDR-UV
  - burnished 2y ago
    I know this as 'Moms cooking drove the vampires away'
- cootsnuck 2y ago
  https://chatgpt.com/share/16f27556-5766-4728-8245-9909d1803773 https://chatgpt.com/share/16f27556-5766-4728-8245-9909d18037... We need a chatGPT version of LMGTFY...

mdip 2y ago

Setting aside the concerns with this specific implementation and thinking more of "the idea" I think the biggest concern is this sort of application causing legitimate software to fail to run[0] and how one would "white-list" an application from seeing these "fake artifacts designed to trick malware." The problem is "the fake components" would have to be prevented from being detected by legitimate software and the only way I can think to do that would be to execute everything in a sandbox that is capable of: (a) hiding some contained running processes (the fake ones) from the rest of the OS while (b) while allowing the process that "sees the fake stuff" to be seen by everything else "like any old process." Applying ACLs (and restricting white-listed processes) might work in some cases; might equally just be seen as a permissions problem and result in a nonsensical error (because the developers never imagined someone would change the permissions on an obvious key), or it might be that the "trick" employed is "Adding a Russian Keyboard" which can be very disruptive to the user "if they use more than one input language" or "is one of those places where a program may read from there never expecting to encounter an error." A lot of this seems like it would require use of containerization -- docker/docker-like -- for Windows apps. I'm familiar with a few offerings here and there, but I've worked with none of them and I run Linux more than Windows these days. So my questions really boil down to: Where's Windows containerization at? Would it be possible to run an application in a docker or docker-like container with a Windows kernel which can have its environment controlled in a manner that is more transparent to the application running within the container? Is there any other approach which would allow for "non-white-listed applications" to run containerized and "see the Scarecrow artifacts", while allowing the white-listed applications[1] to run outside of the container in a manner that hides some of the processes within the container. Can it do all of that in a manner that would work if the same "check" were repeated immediately after confirming an Elevation dialog[2]? from the white-listed application in a manner that couldn't be defeated by repeating the same "check" after presenting an elevation dialog? Again, that's assuming "this is a brilliant idea" -- and there's some evidence that as a concept, at least, it would help (ignoring this particular implementation of the idea), but it still suffers from its success, so the extent that it helps/is adopted equates to how long any of these techniques aren't defeated. And just from the sense I get of the complexities required to "implement this in a manner that legitimate won't fail, too", I suspect it will be easier to defeat a tool like this than it will be to protect against its defeat. In other words, the attacker is a healthy young cat chasing a tired old mouse. [0] Anti-cheat being the most obvious, but those are often indistinguishable from malware. I'd encountered plenty of games/apps in the 90s that refused to run when I ran software to trace aspects of their memory interaction. I had some weird accounting app that somehow figured out when my own code (well, code I mostly borrowed from other implementations) was used for the same purpose. [1] The assumption being that "a legitimate application which does these kinds of checks" is also likely to refuse to run within a container unless it's impossible to detect the container as reliably as everything else (and vendors are completely tolerant of false positives if the affected customers don't represent enough in terms of profit, or the solution is "don't run that unusual security software when you run ours"). [2] I've seen it enough with Easy Anti-cheat that I just click "Yes" like a drone. There was at least one occasion when it popped up after I had installed some developer tooling but not had a game update come down between launches. Because it was a huge install, it may just have been that the game detectedI have no idea why this happens -- on a few occasions, I had no update applied between loads but had installed other software so it could have been "to fix something that software broke" but it could also have been "to re-evaluate the environment as an administrator because something changed enough on the system to warrant a re-check that it is still compliant with the rules"

MrVandemar 2y ago

No Linux version? :-)

richwater 2y ago

Anyone who downloads this is a moron.

flerchin 2y ago

Krebs said that some malware checks for a cyrillic keyboard to try and geo target outside of the country of operation. This seems to be the same type of thing. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

vntok 2y ago
Other malware check for a cyrillic keyboard to try and geo target inside of the country of opération.

m3kw9 2y ago

Does it really work? Let’s see some stats

moi2388 2y ago

“It’s a trust thing” Yeah. That won’t work for anything security related, I’m afraid.

mistercheph 2y ago

More likely than not this is malware

TurkishPoptart 2y ago

I've heard one thing that motivates malware to ignore your computer is having a Russian keyboard installed. https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...

s1mplicissimus 2y ago

Hahaha it's such a lovely idea! Turning the opponents detection against them, I very much dig it! Here's a caveat though: Attackers will at some point notice scarecrows and simply work around them. Now suuure, if you have a better lock than your neighbours, that decreases your chances of getting broken into, but in the end this is a classic "security by obscurity" measure. So if your time and computer/data is valuable, I would rather invest in other security measures (firewall, awareness training, backups etc.)

checjsout 2y ago

I wonder if it would trick the compliance department into thinking my computer is safe and leave it alone.

no-dr-onboard 2y ago

Fun concept, but this is security by obscurity. Other heuristics: - providing fake manifests to hardware drivers commonly associated with virtual machines - active process inspector handles - presence of any software signed by hexrays (the ini file is usually enough)

bhelkey 2y ago
> Fun concept, but this is security by obscurity. Malware uses signals to determine if they are running in a VM. If we can degrade those signals, they will have to play a cat and mouse game trying to avoid VMs. The less clear it is if a process is running in a VM, the easier time security researchers will have testing exploits found in the wild.

usrbinbash 2y ago

Many of the most dangerous threat actors simply don't care about getting caught. They are operated, financed and protected by nation states, and/or operate from geopolitical locations where law enforcement is lacking.

russdill 2y ago

Wow, never ever install this if you plan to play games with cheat detection

annoyingnoob 2y ago

Anyone run this through VirusTotal?

otikik 2y ago

Heh. The arms race continues.

mistercheph 2y ago

How I pwned hacker news (2024)

eigenvalue 2y ago

I really don't get why this would be a 71mb installer that takes up 113mb when installed. If they are literally just fake processes running that have the right names, why couldn't this be a 100kb installer?

nsbk 2y ago

This may very well be the greatest British deception since the WWII carrot propaganda. But for malware. Nice!

lbotos 2y ago

"It's early days, were only in Alpha." -> It's early days, we're only in Alpha.

verandaguy 2y ago

This is a really cool concept! Even if it's difficult to trust it as-is (for reasons stated ad nauseam in other comments), this might put gas on the fire of a so-far small area of malware research, which will be good for the community at large. It's obviously an arms race when it comes to malware, but this could be a significant step forward on the defensive side, forcing malware developers to evolve their TTPs.

Andaith 2y ago

I heard you could do something very similar but with installing the Russian Keyboard layout and having it available as an option. A lot of malware from Russia won't run on computers with a Russian keyboard layout, because they only get in trouble with the law if the malware impacts Russian users.

zb3 2y ago

Jia Tan is back :D

slimebot80 2y ago

So immediately I am wondering what is the list of processes names are? Lots of people on HN could easily spin up their own fake processes if they knew the names?

maronato 2y ago

It asks for our names and emails, provides an opaque exe and no source code, asks to be run as admin, pings home, doesn’t say who you are or how many of you there are, and justifies it all with “trust me bro”. People, this is malware. Please don’t fall for it. I don’t think it’s wise to leave this on the front page. I hope dang agrees and takes it down.