3 ms·

Or versioning. File's been corrupted? Cool, just use an earlier version.

by dave2000 11y ago

gruez 11y ago
Surely there is a limited number of versions that are kept. What if the ransomware does a bunch of repeated writes to push out the good version?
- dave2000 11y ago
  I'd like a warning. Or software to track the number of changes to a file in a given period. My mp3 and jpegs will rarely change so they could be locked in some way. There are a number of approaches which could be taken. The file system/os should provide the user with enough functionality to defeat the attacker.
Sanddancer 11y ago
Getting rid of the old versions is part of the process a lot of malware takes. With Windows, for example, one of the first things it does is try to latch onto any admin request so that it can delete any disk snapshots that may exist on the system. Versioning's pretty awesome, but unfortunately the people who do these attacks have already come across versioned filesystems enough to make them work their way around it.
- dave2000 11y ago
  Sure, but I'd like a filesystem/os where that's not possible; where I have the control to prevent such an activity. I have music, videos, and photos which should hardly every change. So it would be good to be able to make those read only, and in the rare event I want to tweak the photos, or edit the mp3 tags, I'd allow, say, one change per file in the next n mins. I'd like there to be an original version of each file which is never deleted, so i'd have version 1,2,3,4,5 normally, and if something tries to trash it then i'd have version 1,203,204,205,206 where something has tried (but failed) to overwrite the original one by changing it 200 times or whatever. I'm not saying that the answer is to use an existing versioned os; I'm saying that filesystems/oses need to keep up with the demands users are making on this. Ransomware is a newer problem than viruses, users deleting files by mistake and power failure during writes; it's going to need a bit of thought and development to solve, but it seems obvious to me that this is solvable, and it should be easier to solve than, say, spam or ddos because it's somewhere where the OS should have complete control over what's being stored. At some point, the ransomware is attempting to remove the current version of something, and it's not beyond the wit of man to detect and prevent this.

Or versioning. File's been corrupted? Cool, just use an earlier version.

gruez 11y ago

Surely there is a limited number of versions that are kept. What if the ransomware does a bunch of repeated writes to push out the good version?

dave2000 11y ago
I'd like a warning. Or software to track the number of changes to a file in a given period. My mp3 and jpegs will rarely change so they could be locked in some way. There are a number of approaches which could be taken. The file system/os should provide the user with enough functionality to defeat the attacker.

Sanddancer 11y ago

Getting rid of the old versions is part of the process a lot of malware takes. With Windows, for example, one of the first things it does is try to latch onto any admin request so that it can delete any disk snapshots that may exist on the system. Versioning's pretty awesome, but unfortunately the people who do these attacks have already come across versioned filesystems enough to make them work their way around it.

dave2000 11y ago
Sure, but I'd like a filesystem/os where that's not possible; where I have the control to prevent such an activity. I have music, videos, and photos which should hardly every change. So it would be good to be able to make those read only, and in the rare event I want to tweak the photos, or edit the mp3 tags, I'd allow, say, one change per file in the next n mins. I'd like there to be an original version of each file which is never deleted, so i'd have version 1,2,3,4,5 normally, and if something tries to trash it then i'd have version 1,203,204,205,206 where something has tried (but failed) to overwrite the original one by changing it 200 times or whatever. I'm not saying that the answer is to use an existing versioned os; I'm saying that filesystems/oses need to keep up with the demands users are making on this. Ransomware is a newer problem than viruses, users deleting files by mistake and power failure during writes; it's going to need a bit of thought and development to solve, but it seems obvious to me that this is solvable, and it should be easier to solve than, say, spam or ddos because it's somewhere where the OS should have complete control over what's being stored. At some point, the ransomware is attempting to remove the current version of something, and it's not beyond the wit of man to detect and prevent this.