5 ms·
It seems to me that the way to solve the encryption ransomware problem is to impose an immutable file system at the OS level + undo for X time and to ask for pe
by pgt 6y ago
It seems to me that the way to solve the encryption ransomware problem is to impose an immutable file system at the OS level + undo for X time and to ask for permission to write files outside a regular folder, just like microphone or screen share access.
- joshvm 6y agoThe problem is that people will often grant that kind of access, particularly to pirate software. For example modification of hosts files (to prevent phoning home) is generally something that lives in /etc which requires sudo to edit. OS X will refuse to run most unsigned software anwyay, unless you explicitly allow it. Though that could (should) be in parallel with some kind of sandboxing.
- aj3 6y agoThere are two problems with that approach: 1) while this might stop ransomware as we know it, it does not fix the underlying problem, e.g. usually all the important files are in the "regular folder" anyway, so even if adversaries wouldn't be able to delete them, they still can steal them 2) privescs are cheap and abundant, which makes all localhost-based protection mechanisms trivial to bypass