App Review RansomFree by Cybereason

[HarborFront]

I would add to the above that we don't know of any antiransomware product that always works. Only the default/deny solutions can do this, and not every user is ready for such a hardcore solution, for various valid reasons.

So far from what I observed I don't see any AV or AM product stating their limitations. Probably that's due to too large a malware database to specify. Only anti-ransomware products does that like what I have stated previously for BD, Kaspersky, RansomFree, HMPA and SBGuard.

So when an anti-ransom product "fails" the test we have to question are we testing within the product's limitations or outside its limitations. The former would render the product an absolute failure whereas the latter would render the test void since you are testing outside its limitations.

 

[RejZoR]

Really? I haven't tested AVG in a long time but when I last tested it, it wasn't really very good in any aspects of the test - this was over a year ago though..

I've tested the recent AVG Beta, the one with avast! scan engine and IDP called "Software Analyzer". I was only testing behavior blocker (like usual ) and it detected pretty much everything with it only. Which in a way explains why AVG was scoring so well in all recent AV-C tests...

 

[MalwareBlockerYT]

I've tested the recent AVG Beta, the one with avast! scan engine and IDP called "Software Analyzer". I was only testing behavior blocker (like usual ) and it detected pretty much everything with it only. Which in a way explains why AVG was scoring so well in all recent AV-C tests...

Oh yeah the Avast one cool

 

[AtlBo]

Thanks for being thorough and giving the program every chance. Must have been some hours putting the video together, so thanks for all your work. I don't know about RansomFree though. I guess I can say at least that I'm not ready for it, even if it is good enough to install and run. Maybe there will be more from the program in the future.

 

[boredog]

cruel I think you just gave me an idea for my funeral with that jc song. all my boys were into heavy metal until about 5 years ago , now they love original country western. thank you soo much.

 

[RejZoR]

Well, since this also relies on behavior analysis, it'll fall into my testing regime. I've already installed it on my host system and I already see what they are doing. It's a very primitive, but also very clever method. I'm sure ransomware writers will try to bypass it, but still. They place a honeypot on a root of the drive in a folder with randomly generated name so it can't be bypassed just like that, but it starts with characters that get listed before any folders or files with an alphabet name. When ransomware flies through the file/folder indexes and tries to encrypt files in the honeypot, RansomFree jumps on the file initiating it. It probably does other things in the background, but in a nutshell, this is it. Like I've said, primitive, but effective. Sometimes simple solutions are the best.

 

[jamescv7]

The concept of ransomware detection is definitely hard and takes long time to perfect the usual pattern behavior.

RansomFree has a long journey to improve the capabilities, better yet they should implement rollback feature too.

 

[shmu26]

Well, since this also relies on behavior analysis, it'll fall into my testing regime. I've already installed it on my host system and I already see what they are doing. It's a very primitive, but also very clever method. I'm sure ransomware writers will try to bypass it, but still. They place a honeypot on a root of the drive in a folder with randomly generated name so it can't be bypassed just like that, but it starts with characters that get listed before any folders or files with an alphabet name. When ransomware flies through the file/folder indexes and tries to encrypt files in the honeypot, RansomFree jumps on the file initiating it. It probably does other things in the background, but in a nutshell, this is it. Like I've said, primitive, but effective. Sometimes simple solutions are the best.

right. It fails when the ransomware ignores the logical order of files, and instead goes on a search-and-destroy mission for high-value targets, such as a hospital's data base.

 

[RejZoR]

Friendly reminder, don't use copyrighted music in videos, otherwise you'll get them flagged or blocked from embedding.

Yeah, I've tested RansomFree myself and it indeed doesn't protect partitions other than C: one. If ransomware encrypts drives in reverse order it won't block it. It also fails sometimes when C: is protected, but D: isn't, despite blocking the ransomware.

 

[Av Gurus]

What if we copy this random files (Honeypot) to others drive we want to protect (D:, E:, Z:,...), should this program work fine then???

 

[Av Gurus]

New version 2.1.1.0 is out.
UPLOAD.EE - CybereasonRansomFree.msi - Download



Honeypot are now hidden and also on second drive.

 

[shmu26]

New version 2.1.1.0 is out.
No more Honeypot folders.
UPLOAD.EE - CybereasonRansomFree.msi - Download

View attachment 128055

interesting. so how does it work? any info?

 

[Av Gurus]

So, honeypot on booth drive...looks like they fix it...just have to test it...

 

[AtlBo]

What if changes to the types of files protected by the program were sandboxed to be examined once the process has finished running or on a file by file basis? Would this work to protect against all types of ransomware?

Even if the malware started back up the same sandboxing could be started again. Then as was mentioned, some sort of rollback could be put in place. Maybe too some support and standards from standard encryption program developers, developed in conjunction with the security companies, might be a big help with identifying ransomware too. Ready for ransomware to be over personally.

Hope it tests better the second time around.

 

[Av Gurus]

Results are still the same...

 

[Evjl's Rain]

Results are still the same...

View attachment 128071

thank you for your tests. Could you please contact them via their google group support for these bypasses? Hopefully they would be able to make it better

 

[shmu26]

Results are still the same...

View attachment 128071

it looks like they want to increase the chances of catching the ransomware behavior, just in case it starts to encrypt the second drive first. But to actually protect the second drive, well, that will probably require some radical changes.

 

[Av Gurus]

thank you for your tests. Could you please contact them via their google group support for these bypasses? Hopefully they would be able to make it better

I will not.
You can if you want.

 

[Av Gurus]

New Cerber ransomware, both drives encrypted...

 

[shmu26]

I will not.
You can if you want.

I will email them.