3 ms·

a technique where modifications to data on a disk drive exceeding x storage measurement units per time unit triggers an alarm You don't clarify what "modificat

a technique where modifications to data on a disk drive exceeding x storage measurement units per time unit triggers an alarm You don't clarify what "modifications to data on a disk drive" means here so I'm going to assume it's "change existing files/directories/symlinks etc and create new ones". I don't think it'd work because a) it would give you a false positive when installing legit software, for example and b) let's assume you want to develop some sort of signalling system where "OK, this software package is legit" to a running OS service (using digital signatures or something like that) - then you'd have to worry about if that signaling/messaging can't be forged by the ransomware as well and you'd invariably need Digital Rights Management (DRM) "always on-line" system to control it. Do you want to avoid "always on-line"? OK, now you have to worry about Root Certificate management on your box which means you'd have to come up with a way to renew them or deprecate such hardware at some point. And trust that those certificates can't be tampered with by hostile actors (nation states, common crackers, etc) as well. If ransomware starts to change (encrypt and delete) gigabytes of data within minutes, would it not make sense that your operating system pauses the process, shows a popup question and asks you if process X is supposed to be doing what it is currently doing? How would the OS know if such process is encrypting? Assume the ransomware uses an in-house encryption interface that doesn't depend on the OS's native interfaces, for instance. The deletion can be detected probably through some sort of inotify(7)-alike subsystem, but there's always a chance of racing conditions, etc. Hm, one could reverse them or undelete them, but I don't see it working across all OSes people care about. I don't know. The dialog part may make sense, but how is a clueless user - remember that not all users are as technical as we are - meant to understand any of that? What if the ransomware uses a filename to disguise itself as a legit OS service or similar?

dt3ft 6y ago
Here is a hospital scenario (I worked at one): 400+ users only use e-mail, browser and a local clinical information system or two. They never generate gigabytes of local data and never modify local data other than dragging an email attachment (or scanning a paper lab result) and dropping it into a clinical IS from time to time. How is it possible that ransomware can wreck this (windows computer) and hundreds like it? Hundreds of similar hospital scenarios are happening all over the world as we speak. The issue here is that clinical IS will not be accessible because 400+ machines are refusing to boot into windows. Should Microsoft be working on a windows version for healthcare, where execution of unsigned application is simply not allowed? The best we could do is "this application was downloaded from the internet, are you sure you want to allow it to run?"
- throwaway29303 6y ago
  I feel like the most logical explanation, given what you wrote, is lack of software updates and/or lack or lax procedures on behalf of system users (f.e. people opening up attachments they shouldn't, etc). Microsoft could do that, but hospitals would shell out way more money for a niche feature. Remember that once you specialize something it becomes expensive. Should a fix come to light it has to be as general as possible. The fix should solve a problem experienced by everyone if it is to be adopted en masse and cheap. Personally, I'd change / reinforce users' behaviours such as not opening attachments from e-mails they do not know (or have a good anti-virus scan their attachments OR have their SMTP server helper do that), maintain a strict software update policy and so on. The usual procedures. Quite frankly, I don't believe this is what a good percentage of people, companies, etc do.

dt3ft 6y ago

Here is a hospital scenario (I worked at one): 400+ users only use e-mail, browser and a local clinical information system or two. They never generate gigabytes of local data and never modify local data other than dragging an email attachment (or scanning a paper lab result) and dropping it into a clinical IS from time to time. How is it possible that ransomware can wreck this (windows computer) and hundreds like it? Hundreds of similar hospital scenarios are happening all over the world as we speak. The issue here is that clinical IS will not be accessible because 400+ machines are refusing to boot into windows. Should Microsoft be working on a windows version for healthcare, where execution of unsigned application is simply not allowed? The best we could do is "this application was downloaded from the internet, are you sure you want to allow it to run?"

throwaway29303 6y ago
I feel like the most logical explanation, given what you wrote, is lack of software updates and/or lack or lax procedures on behalf of system users (f.e. people opening up attachments they shouldn't, etc). Microsoft could do that, but hospitals would shell out way more money for a niche feature. Remember that once you specialize something it becomes expensive. Should a fix come to light it has to be as general as possible. The fix should solve a problem experienced by everyone if it is to be adopted en masse and cheap. Personally, I'd change / reinforce users' behaviours such as not opening attachments from e-mails they do not know (or have a good anti-virus scan their attachments OR have their SMTP server helper do that), maintain a strict software update policy and so on. The usual procedures. Quite frankly, I don't believe this is what a good percentage of people, companies, etc do.