4 ms·

what happens the day after tomorrow: ransomware adapts, but all your great software doesn't, you sit and curse again because system is broken.

• EvanAnderson 3y ago
  Malware might adapt, but “low and slow” isn’t viable for their business model. They need the “shock and awe” of everything being encrypted all at once. A low-and-slow attack would need to transparently encrypt files over a long period, and pulling out they key material all at once. Something like Windows EFS could probably be leveraged to do that kind of attack, but stock EFS would show up in the UI. A malicious EFS replacement that hides in the filesystem filter stack would definitely do it. That would be a ton more work and would probably be easier to detect (and have tons of compatibility issues, I’m sure).
• II2II 3y ago
  My initial thought: figure out what constitutes a high value file, then target those. It is probably safe to state that virtually everyone is swamped in low value files, things like web browser caches, that any rate limit that doesn't affect the legitimate use of the computer would also allow ransomware to encrypt all of the user's data. As an example, there are currently 195 open files in my home directory. (Okay, this is Linux, but I suspect Windows is similar.) It is quite easy to trim my home directory down to about 2000 potential high value files with simple criteria I came up with off the top of my head, based on directory names or file types, without ever opening a file. Someone who knew more about the behavior of users and software could trim more. Not only is the level of protection questionable, the possibility of breaking existing software is real, and file access on Windows seems to be slow to begin with.