4 ms·
Sure, but it could be use configurable. For the actual problem of a cryptolocker it's pretty easy to detect the entropy change. You'd really only need to see
by jdsully 5y ago
Sure, but it could be use configurable. For the actual problem of a cryptolocker it's pretty easy to detect the entropy change. You'd really only need to see the diffs a few files to decide something bad was happening.
In any case users don't expect snapshots to be free.
- dmitrygr 5y agoEntropy is a poor way to detect cryptolockers. For example, many OSes encrypt user data in software (ntfs has "encrypt" built in and is it commonly used). SSD firmware is simply NOT the place to do this. This is the same reason we do not implement HTML parsers in the kernel or javascript runtimes in BIOS. Too high level of a concept in too low level of a place
- jdsully 5y agoI see now my original comment was poorly written. I only intended to imply the SSD would be used for reverting encrypted files as part of a rolling snapshot. It would have to work in conjunction with traditional AV software to actually detect an attack. If it were actually used this way its not crazy the AV software would require the specific hardware it was designed for. I don't think we disagree the remapping hardware could be repurposed for assisting the creation of COW snapshots, though obviously the disk space wouldn't come for free.