News: 1619690405

I don't know if this would help me, but I have an NFS server on my home network, and I used to be able to move files to and from it at will, as it just appeared as another directory on my filesystem. I've now changed it so I have to use scp to get files to it -- I can still read them. My logic was if they try to encrypt my machine, then they would not be able to rewrite the files on the NFS server.

I don't know how secure this is, but as it makes my life that little bit harder, it would for them too. And hopefully I would only have to rebuild my laptop, with my backups (that run every week) safely stored on my NFS server. Of course, because I use a key to access the NFS server maybe they would too, so I maybe no better off.

But this sort of thing is definitely a worry.

BTW, directory not folder. Never folder -- that was a Microsoft attempt in the 1990s to try to steal Unix's language. I have never given in!

Macs, 1984.

Alternately...

Put a software restriction/AppLocker policy in place on your box with a default level of "disallowed". Then allow programs to run from %program files%, or a subdirectory. Select the "don't apply to admin accounts" option.

Hey presto, if you receive (and run) an bit of malware then it now can't actually execute even if you run it, and would just harmlessly pops a message saying "Sorry Dave, I can't do that". This applies to locker malware, and also to trojans you might run from a USB stick or CD.

If you actually do want to install something that you've downloaded, then you just right click and select "run as admin" and it'll work as normal. This is perfectly secure and doesn't require you to then do anything else. It also uses built in tools available free of charge on every windows computer on the face of the planet.

Would you achieve the same results if you were logged in as a regular (non-admin) user?

If you allow any program to run as the admin then you'd have to run as a regular user to get any benefit.

Not a bad idea, but...

They are wise to this sort of thing and they have started exfiltrating the data from the network, before it is encrypted. Don't pay the ransom? They will blackmail you with the threat of publishing you confidential information online.

So, you might manage to keep your data from being encrypted, but it might be exposed to the world and his dog, if you don't pay up...

.... is software on my NAS that keeps each version of a file for a set (config) amount of time, and if all storage space fills up then it stops accepting updates.

That way if a member of the family gets an infection then it should be relatively easy to recover. As a previous poster noted, just rebuild the infected machine, and set the NAS data back to the unencrypted copy.

Btrfs/ZFS can both do that pretty simply using snapshots; you'd just have to script a rotation of them. Alternatively, using cp -al/rsync there are ways to take snapshots within a filesystem, just make sure you don't have access to the backups from other systems on the network (i.e. don't share via NFS/SMB). I have a USB HD I take snapshots to in this way, means I have versioned backups.

Don't know about BTRFS but ZFS snapshots can be sent to another server where only root can access them and where root can only log in from the console.

Shirly they could have called themselves Ransomware Task Force Mitigation or some such.

On a more serious note, it is good to see steps being taken to combat these scumbags.

I know the greybeards amongst us will get that one.

For millenials we'd have to backronym to JFGI before they get that one.

JFDDGI?

"For millenials we'd have to backronym to JFGI before they get that one."

You believe that people aged 40 to 20 have never purchased something like a set of speakers or a small appliance that contains a paper manual? Why?

If they need Ransomware to support their Human Trafficking department, why do they bother with trafficking? Unless they just want people writing ransomware reports to have some nice hook lines.

Exactly, it's the same old spiel trotted out, crime x supports (worse) crime y, so don't do x. It used to be video piracy supporting whatever, now it's ransomware.

On a tangent, why do investment fund people bother selling unit trusts to the public? If they are so good at it, why don't they just invest their own money and keep ALL the profits? Something stinks there too.

that can come up with recommendations about: not paying ransoms; chasing down the crooks; international cooperation; ... All of this is needed, but there is almost nothing about coming up with technical recommendations.

On page 47 Action 4.3.1: there is a bit about " Unencrypted shadow copies of data ", which I assume means backups. This has got to be the best way of recovery: a clean wipe of compromised machines; reinstall the OS; retrieve data from backups. Large organisations should have the manpower to work out how to do this, smaller ones could benefit from HOWTOs that they can follow. Thus if/when attacked you point two fingers at the crooks (== 1 finger for you in the USA). If the crooks don't make as much money they will be less inclined to carry out attacks.

Wipe/reinstall/restore-backups should take about a very busy day if you are well prepared. You will lose 1 day's work assuming daily backups, incremental 1 hourly backups work well when there are many small files (eg word processor documents), not databases but there are ways of handling these.

Yes: this will cost to setup & do and occasionally test, but prob cheaper than 21 days downtime, 287 days to fully recover & $312k average ransom (page 7).

Also: no mention of using more robust software, eg Linux with SELinux (Yes: SELinux does need better documentation & HOWTOs).

A shadow copy is not a backup, per se. It is a copy of the state of the hard drive, before an event took place. VSS can be included in a backup strategy. but it isn't a complete strategy in and of itself. It is designed to keep a backup copy "in place" on the original hard drive/partition (or to a shadow drive/partition).

Some malware already got wise to that and started encrypting that as well.

The latest drops down to the Hypervisor level and encrypts the whole server landscape's virtual drives, from the outside, so no VSS to get back to.

A lot of companies are wise to this and do recover from backups. The ransom has to be set right, to be just less than recovering everything yourself. The other thing is, what do you have to nuke?

The servers that were affected? Fine, but are you 100% sure the other servers are free of malware? What about your PCs and other client devices? For such an attack, if it isn't nipped in the bud, you pretty much have to re-image every PC and rebuild all the servers and restore the data.

Oh, and how long has the malware been on the system? An hour? A week? A month? So, you can recover the data, but you'd still need to really rebuild each server individually, to be sure.

You can take this as far as you want. In some cases, throw away the hard drives/SSDs and replace them with new ones. Not sure if they tampered with the BIOS/EFI? Better install new motherboards, while you are at it...

Even if you are lucky and catch it early and can clean or rebuild the 1 or two servers that were affected, the latest scheme is to exfiltrate the data they are encrypting. If you don't pay up, your plans, confidential emails and documents etc. will be posted online for the world to see...

Even if I paid to get the data recovered, that would only be the start of the process. You can never trust the infected machines again, so you would be rebuilding or replacing them anyway, just copying the recovered data to the new machines, instead of restoring from backups...

The report seems very reactive: for businesses, do this if you get knobbled.

Instead it should be proactive - businesses, change your software and operating systems.

Users should be siloed so when they execute the malware, they only can encrypt their own files. And - copies of them, to boot.

I wonder which operating systems can support that?

We cannot change, at least, not yet. Excel, Word & Outlook, not to mention Access, are way too engrained in our IT environment to allow for upsetting the boat.

Ironically, all the big names are doing their damndest to make change possible. Once everything is in The Cloud (TM), it'll be a cinch to ditch Windows and go for a more secure Linux environment.

So support The Cloud (TM) and we'll be able to kill Windows at some point in an undetermined future.

Why can't the OS trigger an alert when it sees multiple files being updated/written in quick succession under the control of a single process? Suspend the process until the user confirms the action. Have the ability to whitelist certain processes like backup software to avoid false positives.

Then I guess the malware would either spawn lots of file encryption processes to avoid the same one being spotted doing it, or inject itself into explorer.exe or some other vital bit of windows and let that take the blame.

and users would be conditioned to click 'OK' anyway.

Or, for that matter, a bunch of files of the same type (especially Office files) being written in quick succession, regardless of process. The user is unlikely to be able to edit 20 Excel files in under 10 seconds, so freeze everything if it happens.

For that matter, seems like a backup server could detect this as well, in much the same way.

That's what "Ransomwhere?" for the mac does, but further uses the heuristic of blocking processes that are writing encypted files.

https://objective-see.com/products/ransomwhere.html

There are multiple products that do exactly that. The one we use locks the account out that takes the action. Lots of great products came out to keep ransomware mute in the last 3 years.

...tax breaks for organizations as an incentive for adopting secure IT practices...

Oh yeah, that ought to work. Maybe make it even easier and just pass a law that gives ALL these companies tax money? Then when they inevitably don't do it the money they get will be there in fewer steps! God, it's like they don't even realize the farce they live in day to day.