4 ms·

Windows 10 has just what you describe: https://www.bleepingcomputer.com/news/microsoft/how-to-enable-ransomware-protection-in-windows-10/ https://www.bleepingco

by aj3 6y ago

Windows 10 has just what you describe: https://www.bleepingcomputer.com/news/microsoft/how-to-enable-ransomware-protection-in-windows-10/ https://www.bleepingcomputer.com/news/microsoft/how-to-enabl... Of course, bad guys still can 1) create encrypted copy and delete originals instead of modifying files in place; 2) disable protection alongside with A/V and proceed as usual; and my favorite 3) rely on built-in disk encryption mechanisms and simply overwrite encryption keys & salts.

vladvasiliu 6y ago
> Windows 10 has just what you describe [link] I've looked into this, but it feels limited to me. It's all or nothing. I can't have App1 only access Documents and App2 only access Pictures. Once I give any one app access to the "protected folders", it has access to all the protected folders.
- aj3 6y ago
  Yes, it's does not give you SELinux/seccomp level of granularity. But then again, there is a slight chance that users might actually understand what it's for and how to use it, unlike SELinux/seccomp. In practice though, if you're a power user you probably won't run shady binaries, and if you do - nothing will protect you from them as your user is likely a member of administrative group / wheel and you use sudo/su/doas somewhat regularly. While if you're worried about protecting your employees/family members, just making sure they are not part of the same admin groups and enforcing basic Software Restriction Policy / AppLocker / SELinux / RBAC will be enough to protect against 99% threats out there.
  - vladvasiliu 6y ago
    I agree that SELinux is much too complex for "regular people". However, the issue I see with this approach is that the default location for saving pretty much everything on Windows is the Documents folder. So I think most people would just blindly agree to give access to this folder. Most malware comes from apps people wilfully install, so they would probably grant them access to the folders because they would want to use them. The approach I like best is what MacOS does, where you have to approve access to a specific folder. The drawback of the MacOS implementation is that I cannot define specific folders I want protected (say .ssh).
    - aj3 6y ago
      I agree, at least an option to have more granularity would be a good thing. Maybe the upcoming changes to Android/iOS permission models will solve the problem of UI/UX and this will finally become fashionable. However, there is also a question of properly enforcing granular per-process restrictions (without breaking backwards compatibility). It's not a trivial task, there are plenty of corner cases: race conditions, symlinks, alternate data streams, process hollowing... I don't expect any implementation to be full-proof in the first decade.
- jstanley 6y ago
  You should check out Qubes OS. https://www.qubes-os.org/ https://www.qubes-os.org/ All applications run inside a VM, and you set up different VMs for different tasks. The windows are all composited onto one seamless desktop environment, with the colour of the window decorations telling you which VM it's in. You can copy and paste between the VMs with a special keyboard shortcut, and you can manually copy files between them as well, but otherwise they have no access to each other. If you open some ransomware in one VM, it can't touch (or read, or know of the existence of) any of the data in other VMs.
  - gentleman11 6y ago
    How is usability? It’s a very appealing model but it sounds confusing
    - vladvasiliu 6y ago
      That's what I've been wondering too, especially now when more and more applications are starting to use hardware graphics acceleration.
    - aj3 6y ago
      It's great at what it does. Much more useful than I expected, feels more thought out than some commercial alternatives. XEN Virtualization with their custom X-passthrough driver is super fast as well. No hardware acceleration of course, but it didn't feel choppy at all. As long as you have enough RAM (I'd say 16GB at least), it works pretty much like bare metal (even though there are several VMs running in background at all times for network, fw, usb, etc), way faster than Spice, VNC, RDP or Virtualbox (talking about UI not number crunching).
    - jstanley 6y ago
      I used it briefly but found interacting with weird USB devices (mainly Arduino and RTL-SDR) slightly too annoying.
mtgx 6y ago
Yeah, except Windows has built-in exceptions for Microsoft's own apps, including Office, which is infamous for being abused by malware. So almost pointless.
sascha_sl 6y ago
The first thing that happened when I enabled this, is that VMWare Workstation (a signed app that passes smartscreen stuff) was denied access to its data folder in the documents folder. No notification from Windows. Not a good first impression, and I don't really want to learn the file access patterns of all the things I use.
kogepathic 6y ago
> 2) disable protection alongside with A/V and proceed as usual How would the malware do that? I've looked into this and with Windows 10 1903 onward, Tamper Protection is enabled by default. [1] I have yet to find a programmatic method to disable Tamper Protection (which is a prerequisite to disable Defender). I've tried regedit (permission denied), GPO, and all other manner of PowerShell thuggery, but I have not succeeded. In the end, I scripted extracting and editing the registry hive offline (outside the VM) to disable Tamper Protection. Unless the malware has a way to open the Settings app and toggle Tamper Protection in the UI as if they were a user, I can't think of any way they could disable it unless they exploit a known weakness in Defender or a third-party anti-virus program (entirely possible). [1] https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection https://docs.microsoft.com/en-us/windows/security/threat-pro...
- aj3 6y ago
  Tamper protection is really meant for enterprise. Disabling it is exactly as hard as gaining privilege escalation. It is harder to achieve in AD (of course attackers gain lateral movement opportunities instead, but that's a different story), so Tamper protection makes sense there as an additional "security in depth" layer. At home where the logged in user is likely an admin already (even if "protected" by run as / UAC), tamper protection doesn't really add much apart from breaking existing exploit kits and requiring attackers to invest into new ones.
kalleboo 6y ago
That seems like something different - macOS already protects access to stuff like the Documents and Photos folders, etc out of the box (you have to give permission on first run, everyone complained that macOS has turned into Vista). But if you thought the app was good and granted it access and it then goes wild...

by aj3 6y ago

vladvasiliu 6y ago

> Windows 10 has just what you describe [link] I've looked into this, but it feels limited to me. It's all or nothing. I can't have App1 only access Documents and App2 only access Pictures. Once I give any one app access to the "protected folders", it has access to all the protected folders.

aj3 6y ago
Yes, it's does not give you SELinux/seccomp level of granularity. But then again, there is a slight chance that users might actually understand what it's for and how to use it, unlike SELinux/seccomp. In practice though, if you're a power user you probably won't run shady binaries, and if you do - nothing will protect you from them as your user is likely a member of administrative group / wheel and you use sudo/su/doas somewhat regularly. While if you're worried about protecting your employees/family members, just making sure they are not part of the same admin groups and enforcing basic Software Restriction Policy / AppLocker / SELinux / RBAC will be enough to protect against 99% threats out there.
- vladvasiliu 6y ago
  I agree that SELinux is much too complex for "regular people". However, the issue I see with this approach is that the default location for saving pretty much everything on Windows is the Documents folder. So I think most people would just blindly agree to give access to this folder. Most malware comes from apps people wilfully install, so they would probably grant them access to the folders because they would want to use them. The approach I like best is what MacOS does, where you have to approve access to a specific folder. The drawback of the MacOS implementation is that I cannot define specific folders I want protected (say .ssh).
  - aj3 6y ago
    I agree, at least an option to have more granularity would be a good thing. Maybe the upcoming changes to Android/iOS permission models will solve the problem of UI/UX and this will finally become fashionable. However, there is also a question of properly enforcing granular per-process restrictions (without breaking backwards compatibility). It's not a trivial task, there are plenty of corner cases: race conditions, symlinks, alternate data streams, process hollowing... I don't expect any implementation to be full-proof in the first decade.
jstanley 6y ago
You should check out Qubes OS. https://www.qubes-os.org/ https://www.qubes-os.org/ All applications run inside a VM, and you set up different VMs for different tasks. The windows are all composited onto one seamless desktop environment, with the colour of the window decorations telling you which VM it's in. You can copy and paste between the VMs with a special keyboard shortcut, and you can manually copy files between them as well, but otherwise they have no access to each other. If you open some ransomware in one VM, it can't touch (or read, or know of the existence of) any of the data in other VMs.
- gentleman11 6y ago
  How is usability? It’s a very appealing model but it sounds confusing
  - vladvasiliu 6y ago
    That's what I've been wondering too, especially now when more and more applications are starting to use hardware graphics acceleration.
  - aj3 6y ago
    It's great at what it does. Much more useful than I expected, feels more thought out than some commercial alternatives. XEN Virtualization with their custom X-passthrough driver is super fast as well. No hardware acceleration of course, but it didn't feel choppy at all. As long as you have enough RAM (I'd say 16GB at least), it works pretty much like bare metal (even though there are several VMs running in background at all times for network, fw, usb, etc), way faster than Spice, VNC, RDP or Virtualbox (talking about UI not number crunching).
  - jstanley 6y ago
    I used it briefly but found interacting with weird USB devices (mainly Arduino and RTL-SDR) slightly too annoying.

mtgx 6y ago

Yeah, except Windows has built-in exceptions for Microsoft's own apps, including Office, which is infamous for being abused by malware. So almost pointless.

sascha_sl 6y ago

The first thing that happened when I enabled this, is that VMWare Workstation (a signed app that passes smartscreen stuff) was denied access to its data folder in the documents folder. No notification from Windows. Not a good first impression, and I don't really want to learn the file access patterns of all the things I use.

kogepathic 6y ago

> 2) disable protection alongside with A/V and proceed as usual How would the malware do that? I've looked into this and with Windows 10 1903 onward, Tamper Protection is enabled by default. [1] I have yet to find a programmatic method to disable Tamper Protection (which is a prerequisite to disable Defender). I've tried regedit (permission denied), GPO, and all other manner of PowerShell thuggery, but I have not succeeded. In the end, I scripted extracting and editing the registry hive offline (outside the VM) to disable Tamper Protection. Unless the malware has a way to open the Settings app and toggle Tamper Protection in the UI as if they were a user, I can't think of any way they could disable it unless they exploit a known weakness in Defender or a third-party anti-virus program (entirely possible). [1] https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection https://docs.microsoft.com/en-us/windows/security/threat-pro...

aj3 6y ago
Tamper protection is really meant for enterprise. Disabling it is exactly as hard as gaining privilege escalation. It is harder to achieve in AD (of course attackers gain lateral movement opportunities instead, but that's a different story), so Tamper protection makes sense there as an additional "security in depth" layer. At home where the logged in user is likely an admin already (even if "protected" by run as / UAC), tamper protection doesn't really add much apart from breaking existing exploit kits and requiring attackers to invest into new ones.

kalleboo 6y ago

That seems like something different - macOS already protects access to stuff like the Documents and Photos folders, etc out of the box (you have to give permission on first run, everyone complained that macOS has turned into Vista). But if you thought the app was good and granted it access and it then goes wild...