App Review SecureMyBit vs Cerber 3 Ransomware

[JM Safe]

Thanks to LabZero for making this video review (test).
Please note that this video was made only for testing, SecureMyBit doesn't provide a specific anti-ransomware feature. The test was made with a Cerber Ransomware 3 sample.
Unfortunately LabZero is now guest for personal issues
Thank you for all your efforts!



LabZero tested SecureMyBit against this type of ransomware and that's not sure that SecureMyBit works also against other types of ransomware.
Please note that it seems Cerber 3 doesn't encrypt .txt files. Test executed under VirtualBox (Windows 7 Home x32), and on host system: Windows 10 Pro x64.

Thanks for watching!

 

[Der.Reisende]

Great share @JM Security, also big thanks to @LabZero for doing this review! SecureMyBit seems to do a pretty good job, unless it's extension is on the list of Ransomware I guess.
One thing: Am I the only one having issues with the resolution of that vid? I tried all resolutions, the only useable but blurry is 720p?

 

[JM Safe]

Great share @JM Security, also big thanks to @LabZero for doing this review! SecureMyBit seems to do a pretty good job, unless it's extension is on the list of Ransomware I guess.
One thing: Am I the only one having issues with the resolution of that vid? I tried all resolutions, the only useable but blurry is 720p?

Yes, the maximum resolution is 720p.

 

[Der.Reisende]

Yes, the maximum resolution is 720p.

Jup, but it is very blurry, I've been watching many vids on less than 1080p? 27' might just be to huge Sorry for complaining.
Here's a screenshot.

Spoiler: 720p_this_video

Spoiler: 720p_CS_video

 

[JM Safe]

Jup, but it is very blurry, I've been watching many vids on less than 1080p? 27' might just be to huge Sorry for complaining.
Here's a screenshot.

Spoiler: 720p_this_video

View attachment 121053

Spoiler: 720p_CS_video

View attachment 121054

Sorry for the quality, maybe it depends on the software used by LabZero to record the video.

 

[Der.Reisende]

Sorry for the quality, maybe it depends on the software used by LabZero to record the video.

Don't mind, it's a great vid, not intended to complain, just took note

 

[DardiM]

Thanks for the share

 

[frogboy]

A very nice outcome my friend @JM Security i am pleased.

 

[Wave]

Nice work on your project, the video is well-done!

I have an idea for your project: when you encrypt files, assign each encrypted file with a different randomly generated custom extension (for example, minimum 5 characters long including some sort of ID number and use of random characters). This way it would be extremely tricky (if not then impossible) for any ransomware sample to specifically single out on a file scan or target files which have been encrypted by your tool! (it would only have to guess if the file is encrypted altogether, via Entropy for example, as opposed to being able to know if it was SMB or not).

It's just an idea. As long as you don't inject any bytes into the encrypted files which can be used as an identification of SMB encryption (or any specific guaranteed file-name modifications to encrypted files which is recursive in your product - e.g. if you made every encrypted file have the filename "SMB_<rest of the file name>" then it could be used as an identifier) it could work out well and nicely if implemented correctly.

 

[DardiM]

Nice work on your project, the video is well-done!

I have an idea for your project: when you encrypt files, assign each encrypted file with a different randomly generated custom extension (for example, minimum 5 characters long including some sort of ID number and use of random characters). This way it would be extremely tricky (if not then impossible) for any ransomware sample to specifically single out on a file scan or target files which have been encrypted by your tool! (it would only have to guess if the file is encrypted altogether, via Entropy for example, as opposed to being able to know if it was SMB or not).

It's just an idea. As long as you don't inject any bytes into the encrypted files which can be used as an identification of SMB encryption (or any specific guaranteed file-name modifications to encrypted files which is recursive in your product - e.g. if you made every encrypted file have the filename "SMB_<rest of the file name>" then it could be used as an identifier) it could work out well and nicely if implemented correctly.

"ID number"
To encrypt the file, a password is needed. Then to decrypt the file, same password is needed : an obfuscated (I like this word) extension based on it (not directly using the password, but based on it) => an extension with special char codes is interesting

Edited:
Haha : no extension ! (the real extension hidden in the name parts)
=> the way a lot of ransomware works, very annoying method

 

[Wave]

"ID number"
To encrypt the file, a password is needed. Then to decrypt the file, same password is needed : an obfuscated (I like this word) extension based on it (not directly the password, but based on it) => an extension with special char codes is interesting

Nice improvement on my suggestion, you helped improve my thinking on the situation too

Honestly though, this software isn't even that bad IMO, I personally like it. What I want to see implemented in the future (even in the long future) is additional focus against ransomware: e.g. options to backup/copy across files to special directories which are "locked" from external access and also hidden (to prevent external programs from finding the folder/files within the folder during enumeration attempts, etc).

This software has a lot of potential to be just more than a file encryption tool. But it depends on what the developer wants at the end of the day. Hopefully @JM Security will take the Anti-Ransomware path

 

[JM Safe]

Hey guys thank you very much for all your replies and suggestions! I really appreciate it!
Your suggestions are really useful and also interesting to continue the development.

 

[Maziar Ansari]

Great . thank you very much .

 

[tim one]

Nice video and very interesting software, thanks for sharing