Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 712388">What you say is 100% factual <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Shadow Defender is great but if you get infected then it&#039;s game over. Even if your data isn&#039;t changed after a reboot, data could still be ex-filtrated too! People forget this all the time... The best way is to not get infected in the first place... Just don&#039;t run the damn download unless you&#039;re sure it&#039;s clean, don&#039;t click that damn e-mail if it isn&#039;t expected... Ignore that click-bait title on the advertisement!Lock down the system or use a good AV with good dynamic capabilities and focus on cyber-security research/learning and always keep your guard up...If you&#039;re in an MMA match would you put your arms down and leave your chin and hips vulnerable? NO! So don&#039;t let your guard down on a PC connected to the internet because you&#039;ll get the equivalent of an IRL MMA match knock-out when you find out all your files have been encrypted.All these folder protection utilities will never be full-proof just like everything else in this world. Like Andy said about trusted processes, it&#039;s a real flaw. Controlled Folder Access in Windows Defender? Well explorer.exe is standard rights so it is going to be a walk in the park to hijack a thread with NtSetContextThread and get that shell-code executed. Once you&#039;re in, well... explorer.exe is granted access to touch those documents, game over!There&#039;s so many ways to do one thing in Windows and other OS environment&#039;s, but Windows was never originally designed to be secure. When the win2k kernel was introduced, it was about usability and it was something people hadn&#039;t experienced yet. Only the recent years Microsoft have tried to focus on security more but it&#039;s too late because many critical components were insecure by default, and it takes an enormous amount of work to improve security without ruining functionality or spending huge amounts of resources without causing compatibility issues with previous software for previous OS versions.IMO focus on file encryption detection approaches for ransomware prevention, store sensitive documents on external storage not left plugged into the machine and always have a backup available.</blockquote>

[QUOTE="Deleted member 65228, post: 712388"] What you say is 100% factual :) Shadow Defender is great but if you get infected then it's game over. Even if your data isn't changed after a reboot, data could still be ex-filtrated too! People forget this all the time... The best way is to not get infected in the first place... Just don't run the damn download unless you're sure it's clean, don't click that damn e-mail if it isn't expected... Ignore that click-bait title on the advertisement! Lock down the system or use a good AV with good dynamic capabilities and focus on cyber-security research/learning and always keep your guard up... If you're in an MMA match would you put your arms down and leave your chin and hips vulnerable? NO! So don't let your guard down on a PC connected to the internet because you'll get the equivalent of an IRL MMA match knock-out when you find out all your files have been encrypted. All these folder protection utilities will never be full-proof just like everything else in this world. Like Andy said about trusted processes, it's a real flaw. Controlled Folder Access in Windows Defender? Well explorer.exe is standard rights so it is going to be a walk in the park to hijack a thread with NtSetContextThread and get that shell-code executed. Once you're in, well... explorer.exe is granted access to touch those documents, game over! There's so many ways to do one thing in Windows and other OS environment's, but Windows was never originally designed to be secure. When the win2k kernel was introduced, it was about usability and it was something people hadn't experienced yet. Only the recent years Microsoft have tried to focus on security more but it's too late because many critical components were insecure by default, and it takes an enormous amount of work to improve security without ruining functionality or spending huge amounts of resources without causing compatibility issues with previous software for previous OS versions. IMO focus on file encryption detection approaches for ransomware prevention, store sensitive documents on external storage not left plugged into the machine and always have a backup available. [/QUOTE]

Verification