5 ms·
From the OS point of view it should be pretty obvious when massive number of files are suddenly being re-written. Maybe the OS could put a dialog up, along the
by 21 11y ago
From the OS point of view it should be pretty obvious when massive number of files are suddenly being re-written.
Maybe the OS could put a dialog up, along the line "Excuse me, I've noticed that a large number of files are being modified/deleted. This could be an active attack going on. Do you know about this, is this something that you are trying to do?"
Of course, malware will fight back by maybe encrypting only the file-system index (like some recent one does), or by slowly encrypting files over a period.
But still, changing large number of user files should be noticeable.
- dave2000 11y agoOr versioning. File's been corrupted? Cool, just use an earlier version.
- gruez 11y agoSurely there is a limited number of versions that are kept. What if the ransomware does a bunch of repeated writes to push out the good version?
- dave2000 11y agoI'd like a warning. Or software to track the number of changes to a file in a given period. My mp3 and jpegs will rarely change so they could be locked in some way. There are a number of approaches which could be taken. The file system/os should provide the user with enough functionality to defeat the attacker.
- Sanddancer 11y agoGetting rid of the old versions is part of the process a lot of malware takes. With Windows, for example, one of the first things it does is try to latch onto any admin request so that it can delete any disk snapshots that may exist on the system. Versioning's pretty awesome, but unfortunately the people who do these attacks have already come across versioned filesystems enough to make them work their way around it.
- dave2000 11y agoSure, but I'd like a filesystem/os where that's not possible; where I have the control to prevent such an activity. I have music, videos, and photos which should hardly every change. So it would be good to be able to make those read only, and in the rare event I want to tweak the photos, or edit the mp3 tags, I'd allow, say, one change per file in the next n mins. I'd like there to be an original version of each file which is never deleted, so i'd have version 1,2,3,4,5 normally, and if something tries to trash it then i'd have version 1,203,204,205,206 where something has tried (but failed) to overwrite the original one by changing it 200 times or whatever. I'm not saying that the answer is to use an existing versioned os; I'm saying that filesystems/oses need to keep up with the demands users are making on this. Ransomware is a newer problem than viruses, users deleting files by mistake and power failure during writes; it's going to need a bit of thought and development to solve, but it seems obvious to me that this is solvable, and it should be easier to solve than, say, spam or ddos because it's somewhere where the OS should have complete control over what's being stored. At some point, the ransomware is attempting to remove the current version of something, and it's not beyond the wit of man to detect and prevent this.
- userbinator 11y agoIt's unfortunate that SSDs and the disappearance of HDD activity indicator lights has made it harder to notice things like this. Massive filesystem activity 10 years ago would be immediately recognisable from all the drive noise, the slowdown, and a solid indicator light. Now it's maybe a barely perceptible slowdown.
- unclebucknasty 11y agoGood point. I remember specifically discovering a drive-by download this way back in 2004-ish. Hard drive started going crazy on my desktop when I visited an A/V review website that otherwise seemed benign enough.
- erxvc 11y agoGigabit internet will have the same problem. It will be very fast to download all hard disks data.
- Strom 11y agoThe malware would just disable this warning. This is the same cat & mouse game that antiviruses are already playing.