Could this idea against ransomwares be possible?

[Dirk41]

Furthermore some ransomware already ask you to be allowed ( UAC pop up ) but some of them encrypt even if you click no.

 

[DardiM]

A good method is to save all your working / personal data on a external HDD. When you want to run files that are not 100 % sure, just power off the HDD, before. All my important data are on complete bitlocked partition, UAC at MAX under minimum user access.

 

[Dirk41]

Yes I already use external hds disconnected from PC

 

[BoraMurdar]

And there is Petya family, which doesn't encrypt files but writes its own bootloader in MBR and encrypts master file table...

 

[hjlbx]

All that is needed is to hollow a trusted process that has unrestricted access to the file system - like explorer.exe or svchost.exe.

 

[Dirk41]

And there is Petya family, which doesn't encrypt files but writes its own bootloader in MBR and encrypts master file table...

For that already exist a Cisco tool

 

[NekoHr]

Basically you would just need to change the formatting or the filesystem. Like Linux does. But it would not solve the problem, as malware creators could easily create ransomware that checks first bytes in order to detect a "file type" (now not existing one) and chose what to encrypt, instead of Windows method. It could bring more problems that it would solve. Simple solution, don't give a file a root or admin privileges.

No need to do even that just encrypt files without extension or folders.

 

[_CyberGhosT_]

All that is needed is to hollow a trusted process that has unrestricted access to the file system - like explorer.exe or svchost.exe.

Thats it I'm adding these to the blocked process list too, roflmao. Boom goes the dynamite

 

[BoraMurdar]

For that already exist a Cisco tool

You mean a decrypter?

 

[Dirk41]

You mean a decrypter?

This Testing MBRFilter against Ransomware that modify the Master Boot Record

Anyway for petya a decryptor exist if I remember well

 

[BoraMurdar]

This Testing MBRFilter against Ransomware that modify the Master Boot Record

Anyway for petya a decryptor exist if I remember well

Thanks for the article, I didn't about know this

 

[hjlbx]

No need to do even that just encrypt files without extension or folders.

Encrypt *

 

[Wave]

Until they create new SSD that encrypts itself and every software that tries to write on it or use a file on it, must explicit ask to the user to accept decryption. This decryption should be really fast, that's why i point out "a new SSD". Of course, this decryption should have no passwords. I know it sounds really complicated and seems like the Windows Administration Alerts, but i know somebody could figure out this and invent some kind of encryption that gives us this security and it's easy to use as well. Like an alert that describes what the file is trying to do on the disk and asks for permission, if accepted a quick decryption is made. Do i make myself clear?

This will never happen, it would be far too messy for implementation. Just use a folder locker/hider to protect important documents and use backups... I don't understand why people can't just do this?

Spoiler

The closest you will find to doing this is software which encrypts your documents and requires a pop-up to enter a password to allow programs to access the files. In this case, it would work like most file restriction/hide software already works, just with the added encryption functionality.

Basically a feature for folder/file access restriction, but on a specific drive with the encryption functionality.

Let's say you have some important work documents or a folder containing personal photo's from the past 10 years... Back these up on an external removable device and/or use a folder locker/hider to protect these documents.

Now let's say you become infected with ransomware... It won't be able to find these protected documents (and if it does it won't be able to access them properly to write to them for the encryption process unless it was sophisticated enough to bypass the protection mechanisms of the protection software which is rare because most ransomware (if not none) bother doing things like this it seems)... And as long as you had a backup in the first place it wouldn't even matter, as you can use the backup to get your documents back after cleaning the system!

In fact, you can make a whole system image backup: Acronis | Backup, Data Protection & Recovery Software, Best free backup software for Windows 10, Windows 8.1, Windows 8, Windows 7, etc - EaseUS Todo Backup Free

Not to mention that the backup will be useful in non-ransomware cases... for example a virus infection, where your files become infected and once executed they start executing the virus code to infect other files... Then you use the backup and same scenario as with ransomware, you get your original files back!

So this entire thread about changing extensions and doing this and that is kind of pointless... (I mean it was a good conversation), but the best things you can do is conceal evidence of the protected documents AND use a backup!

Forget the documents concealment/protection idea, just use a backup. Easy to do and more reliable.

 

[Wave]

Furthermore some ransomware already ask you to be allowed ( UAC pop up ) but some of them encrypt even if you click no.

If the ransomware process is running with standard rights it can still access some locations and encrypt the files stored there, however it won't be able to access protected directories by default (such as Program Files folder).

(and if UAC is disabled altogether then you played yourself...).

However since ransomware is quite demanding in the malware development market (or I would assume so at least), it wouldn't be a surprise to see a new ransomware variant utilising a zero-day UAC exploit (or a past one which hasn't become patched yet).

 

[Dirk41]

Everybody knows backups are the best defence .
But it's nice to talk about these things , they help you understand how malwares work . Even Just out of curiousity
Anyway maybe not everybody can backup every second( look at some config ,not everybody perform daily backups ) : maybe you are out of home , with your laptop and you can't backup until you come home , and so you have to find another way to protect untill evening .


And you said an interesting thing: so hide a folder ( click dx -> proprieties ? ) it's enough to prevent the ransom to find them?

Thank you

 

[Dirk41]

If the ransomware process is running with standard rights it can still access some locations and encrypt the files stored there, however it won't be able to access protected directories by default (such as Program Files folder).

(and if UAC is disabled altogether then you played yourself...).

However since ransomware is quite demanding in the malware development market (or I would assume so at least), it wouldn't be a surprise to see a new ransomware variant utilising a zero-day UAC exploit (or a past one which hasn't become patched yet).

UAC exploit : so anti exploit like emet MBAE etc could help in those cases ?

 

[Wave]

UAC exploit : so anti exploit like emet MBAE etc could help in those cases ?

It really depends on how the Anti-Exploit software and the exploit itself works.

 

[DardiM]

...
maybe you are out of home , with your laptop and you can't backup until you come home , and so you have to find another way to protect untill evening.
...

Imagine a drive with 2 partitions C: and D:
=> Configuration Panel / Computer Management / Disk Management : remove the letter D (the one with files to protect)
=> a malware using a Loop to find drives letters and files inside will only retrieve "C:" and folders / files inside"

 

[Dirk41]

Interesting , so way I never heard this kind of suggestions ? And it's easy to have the letter back ?

Anyway maybe I read about some ransomware who encrypt also NAS and not mapped units. I don't know if it would be the same case

 

[DardiM]

...
I And it's easy to have the letter back ?
...
e

To get the letter back :
Configuration Panel / Computer Management / Disk Management and add a letter to the part concerned.

It is only a personal tip, who can help against the most part of ransomware I see.

I think evoluted/elaborated malware ( if they are granted the rights because of bad secured account / exploits, etc) could find a way to bypass it