4 ms·

What is the best defence against this? Is there some software on hdd/sdd level that can detect file being encrypted?

by trulyme 5y ago

marcosdumay 5y ago
> What is the best defence against this? Backups.
- ericbarrett 5y ago
  Stored offline or at least immutable, e.g. via S3 bucket lifetime policy. Lots of cases of casual backup servers being infected & encrypted as well.
  - marcosdumay 5y ago
    Yeah, for protecting against ransomware, the computers you are backing-up must not have permission to write in your backups, and the place you are writing your backups on must not have the same security flaws as them. Both offline media and well configured S3 can do. Although, I'd personally bet much more on my capacity of configuring a server than S3. Anyway, you can't go wrong with offline. The one thing you can't have is a NAS where your computers directly write the data.
    - ericbarrett 5y ago
      I favor cloud storage here since you can configure write-only storage pools (without delete, or at least with versioning). Whereas "offline" backups must come online for new copies, and that's a window for infection of the hosting file system, barring well-configured snapshots or the like. Also it can be your second location for the "three copies, two locations" rule of thumb, especially if you are an SMB with only one physical space. (The opposite plays here, too. If everything you have is in the cloud, you should keep local backups.)
  - normaler 5y ago
    We are using borg to backup our Servers and each Server has its own user in the backupsystem, that allows to execute only the backup command in append mode, so an infected server can not destroy its backups.
gpm 5y ago
There exist a few products targeted at enterprises that attempt to detect suspicious patterns of encrypting files at the OS and/or backup level and flag that if it happens. I wouldn't describe that as the "best" defense though, it's an "earlier warning system" but not early enough to prevent damage. You've already been hacked, the criminals have already exfiltrated all the data they can, have already installed whatever backdoors they are going to, and have even already started preventing you from accessing some of your own data. (That doesn't mean earlier warning doesn't help, and it's probably worthwhile, but it's a component in a broader last line of defense system that you never want to use in the first place). The best defense is not getting hacked in the first place, and not letting malware spread when you do. If you are a big enough target that the "detect ransomware" solutions are remotely affordable you should hire some experts on this topic, but think about things like good phishing training, good firewalls, good software engineering, keeping everything entirely up to date, and so on and so forth. Backups help (a lot!) but are not the cure all that people like to pretend they are. Apart from all the other damage hackers do apart from deleting things, hackers do attempt to delete backups too, and sometimes they succeed. (Disclaimer: I use to work on one of these products)
birksherty 5y ago
There are few. One is Cryptoprevent, the free version is what I've been using. It blocks rather than detect encryption which some other apps do. https://www.d7xtech.com/cryptoprevent-anti-malware/ https://www.d7xtech.com/cryptoprevent-anti-malware/
staticassertion 5y ago
I'd recommend a few things. 1. File history preservation. We use Dropbox Paper, which preserves file history - if someone were to delete all of our documents we could recover them. This is harder to do for production data, which may take up petabytes of space. Archiving out the data in big chunks can help here (we back up our kafka data to S3, for example, and the exporter will do that in batches). You can also enable object versioning on those S3 buckets or prevent deletion/ mutation of objects. Another good idea is to use a uuid in the key name so that they can't be guessed. 2. Remove all forms of lateral movement. Move to a 'zero trust' system. Ransoming one machine is not worthwhile, attackers need to own a lot of your network if they want to monetize. They usually do this by traversing over as many machines as possible. None of our systems can communicate with each other in corporate environments, and there's no remote execution protocols like SSH in our production environment (between servers). All access is explicitly authenticated and authorized. There's lots of other good defenses but IMO if you do these two things you're in a very good place. I wouldn't recommend "backups" generically. It's hard to do backups well and safely. (1) is technically a backup, but it's how the system works normally, it isn't some separate backup system that never gets tested. Backups are also very expensive, whereas zero trust is cheap.
- chopin 5y ago
  > Backups are also very expensive, whereas zero trust is cheap. Could you elaborate on this? I would have thought that they are at least in the same ball-park. I work at a large software company and we have a lot of internal systems one has access to. You have to harden your AD, you have to be very careful with single-sign on, etc. I'd bet, if I could compromise the machine of one of our employees I could do a lot of lateral movement. You must not only harden the production machine, you need to harden everything in the supply chain for those machines.
  - staticassertion 5y ago
    I'm making a big assumption, which is that the company is young and starting to think about security. I'm not sure what you want me to elaborate on though. Backups have a very literal cost - storage, maintenance, etc. Zero trust is just a paradigm, it's no more expensive than any other approach, it's just an architectural choice. I don't think compromising our machines would be easy, nor do I Think lateral movement would be easy, but there's still more that we can do.

What is the best defence against this? Is there some software on hdd/sdd level that can detect file being encrypted?

marcosdumay 5y ago

> What is the best defence against this? Backups.

ericbarrett 5y ago
Stored offline or at least immutable, e.g. via S3 bucket lifetime policy. Lots of cases of casual backup servers being infected & encrypted as well.
- marcosdumay 5y ago
  Yeah, for protecting against ransomware, the computers you are backing-up must not have permission to write in your backups, and the place you are writing your backups on must not have the same security flaws as them. Both offline media and well configured S3 can do. Although, I'd personally bet much more on my capacity of configuring a server than S3. Anyway, you can't go wrong with offline. The one thing you can't have is a NAS where your computers directly write the data.
  - ericbarrett 5y ago
    I favor cloud storage here since you can configure write-only storage pools (without delete, or at least with versioning). Whereas "offline" backups must come online for new copies, and that's a window for infection of the hosting file system, barring well-configured snapshots or the like. Also it can be your second location for the "three copies, two locations" rule of thumb, especially if you are an SMB with only one physical space. (The opposite plays here, too. If everything you have is in the cloud, you should keep local backups.)
- normaler 5y ago
  We are using borg to backup our Servers and each Server has its own user in the backupsystem, that allows to execute only the backup command in append mode, so an infected server can not destroy its backups.

gpm 5y ago

There exist a few products targeted at enterprises that attempt to detect suspicious patterns of encrypting files at the OS and/or backup level and flag that if it happens. I wouldn't describe that as the "best" defense though, it's an "earlier warning system" but not early enough to prevent damage. You've already been hacked, the criminals have already exfiltrated all the data they can, have already installed whatever backdoors they are going to, and have even already started preventing you from accessing some of your own data. (That doesn't mean earlier warning doesn't help, and it's probably worthwhile, but it's a component in a broader last line of defense system that you never want to use in the first place). The best defense is not getting hacked in the first place, and not letting malware spread when you do. If you are a big enough target that the "detect ransomware" solutions are remotely affordable you should hire some experts on this topic, but think about things like good phishing training, good firewalls, good software engineering, keeping everything entirely up to date, and so on and so forth. Backups help (a lot!) but are not the cure all that people like to pretend they are. Apart from all the other damage hackers do apart from deleting things, hackers do attempt to delete backups too, and sometimes they succeed. (Disclaimer: I use to work on one of these products)

birksherty 5y ago

There are few. One is Cryptoprevent, the free version is what I've been using. It blocks rather than detect encryption which some other apps do. https://www.d7xtech.com/cryptoprevent-anti-malware/ https://www.d7xtech.com/cryptoprevent-anti-malware/

staticassertion 5y ago

I'd recommend a few things. 1. File history preservation. We use Dropbox Paper, which preserves file history - if someone were to delete all of our documents we could recover them. This is harder to do for production data, which may take up petabytes of space. Archiving out the data in big chunks can help here (we back up our kafka data to S3, for example, and the exporter will do that in batches). You can also enable object versioning on those S3 buckets or prevent deletion/ mutation of objects. Another good idea is to use a uuid in the key name so that they can't be guessed. 2. Remove all forms of lateral movement. Move to a 'zero trust' system. Ransoming one machine is not worthwhile, attackers need to own a lot of your network if they want to monetize. They usually do this by traversing over as many machines as possible. None of our systems can communicate with each other in corporate environments, and there's no remote execution protocols like SSH in our production environment (between servers). All access is explicitly authenticated and authorized. There's lots of other good defenses but IMO if you do these two things you're in a very good place. I wouldn't recommend "backups" generically. It's hard to do backups well and safely. (1) is technically a backup, but it's how the system works normally, it isn't some separate backup system that never gets tested. Backups are also very expensive, whereas zero trust is cheap.

chopin 5y ago
> Backups are also very expensive, whereas zero trust is cheap. Could you elaborate on this? I would have thought that they are at least in the same ball-park. I work at a large software company and we have a lot of internal systems one has access to. You have to harden your AD, you have to be very careful with single-sign on, etc. I'd bet, if I could compromise the machine of one of our employees I could do a lot of lateral movement. You must not only harden the production machine, you need to harden everything in the supply chain for those machines.
- staticassertion 5y ago
  I'm making a big assumption, which is that the company is young and starting to think about security. I'm not sure what you want me to elaborate on though. Backups have a very literal cost - storage, maintenance, etc. Zero trust is just a paradigm, it's no more expensive than any other approach, it's just an architectural choice. I don't think compromising our machines would be easy, nor do I Think lateral movement would be easy, but there's still more that we can do.