3 ms·
Entropy is a poor way to detect cryptolockers. For example, many OSes encrypt user data in software (ntfs has "encrypt" built in and is it commonly used). SSD
by dmitrygr 5y ago
Entropy is a poor way to detect cryptolockers. For example, many OSes encrypt user data in software (ntfs has "encrypt" built in and is it commonly used).
SSD firmware is simply NOT the place to do this. This is the same reason we do not implement HTML parsers in the kernel or javascript runtimes in BIOS. Too high level of a concept in too low level of a place
- jdsully 5y agoI see now my original comment was poorly written. I only intended to imply the SSD would be used for reverting encrypted files as part of a rolling snapshot. It would have to work in conjunction with traditional AV software to actually detect an attack. If it were actually used this way its not crazy the AV software would require the specific hardware it was designed for. I don't think we disagree the remapping hardware could be repurposed for assisting the creation of COW snapshots, though obviously the disk space wouldn't come for free.