4 ms·
About prevention there is something more that I am not sure has been mentioned, some tools are taking a new, broader approach to the problem, which is to consta
by mikemoka 10y ago
About prevention there is something more that I am not sure has been mentioned, some tools are taking a new, broader approach to the problem, which is to constantly monitor for encrypted files and stop the associated processes, this way often limiting the loss to a few files, these are the links:
Criptostalker
https://github.com/unixist/cryptostalker https://github.com/unixist/cryptostalker
Ransomwhere (macOS)
https://objective-see.com/products/ransomwhere.html https://objective-see.com/products/ransomwhere.html
Some theoretical information on this approach:
http://www.cise.ufl.edu/~traynor/papers/scaife-icdcs16.pdf http://www.cise.ufl.edu/~traynor/papers/scaife-icdcs16.pdf
- Houshalter 10y agoIn principle it's super easy to detect, encrypted files look like random data and it's unlikely users would be replacing every file with random data on purpose. Its a never ending war though. If you got enough users to do this, the hackers would then switch to encryption that mimics what normal files look like to fool the detector.
- noja 10y agoMost users never start writing to all the files on their disk, why can't a rate limiter and warning kick in if that happens?
- fastball 10y agoHighly recommend Ransomwhere for MacOS users. It has actually stopped a ransomware attack on one of my work machines.