How can I protect myself from "ransomware" attacks like the one that affected Transmission users?

Question

The downloader for version 2.90 of the Transmission BitTorrent client was infected by a piece of malware called KeRanger, which encrypts files on your computer and demands a one-Bitcoin ransom to unencrypt them.

Putting aside the question of how this made it into the downloader in the first place, how can a typical Mac user protect against this kind of attack? The file came from a trusted source, so the recommendation to not visit malicious sites doesn't apply here.

Is it time to get an anti-virus program for my Mac? Or do I just have to be diligent with Time Machine backups, and be prepared to restore from a backup at any time?

Answer 1

There is no longer such a thing as a "Trusted Source". Probably never was. You are only one exploit away from infection. If the software producers get compromised or the automated scanning for the app stores get bypassed, you will be infected.

Security is often an illusion created by forward motion in patching and upgrading. We've had several fantastic near misses in the last six months in infrastructure maintenance, server maintenance and endpoint maintenance.

The only real protection is multiple versioned backups. And hope you can step back to a preexploit version.

Answer 2

As you've noticed, there is not guarantee against infection any more: while there are effective ways to protect an infrastructure, they are so expensive and have such an impact on productivity that hardly anyone can afford them.

So the best cost-effective defense starts with the standard "use anti-virus and network protection systems, educate your users and be on your guard" and then design an effective recovery system.

That system should start with backups. They should be versionized and be stored on offline media (if they are accessible by your system, they are accessible by the maleware). A good practical solution is to use disk-to-disk-to-tape or disk-to-disk-to-disk (make a backup to a local backup system so that it is convenient to acess these backups when needed and have the system in question make a copy of these backups to an offline media - an external drive that you swap off regularly or a tape system - for safety).

Then there is the recovery plan itself: be prepared to redeploy your infrastructure whenever needed. the simplest and cheapest way is to keep whatever you need to reinstall your environment to a working state available on offline media (including your backup software, the original media for your important software and OS). Then have a plan for how to restore each system individually and as a whole. Don't forget to update that plan as often as necessary (in my personal experience, twice a year seems like a good balance for many small infrastructure but make your decision based on YOUR needs).

If you work in an environment that makes that worthwhile, it is possible to include that redeployment in your actual work procedure: instead of patching/updating a set of servers, you could redeploy them from a central image that you maintain (same goes for user workstations).

Answer 3

In addition the answers above, I would like to suggest using a Virtual Machine.

Examples of such software that runs on Mac include Oracle's VirtualBox, Parallels Desktop and VMWare Fusion - pick any of them (or any of alternative ones) that suits your needs (it's probably worth checking their security as well).

The advantage of using a Virtual Machine is that if by some occurence some malware ends being downloaded and/or installed on "virtual" OS, it affects only such system, leaving the base system safe. At least in theory, since there have been some breaches found in Virtualization software, however such attacks aren't that easy to carry out. So while it doesn't offer 100% safety it offers safety significant enough to consider it. I believe that the malware you mentioned can't move between Virtual Machines/to base OS (at least a quick Google search seems to suggest that).

The way I believe would suit your needs would be to install some Virtual Machine Software, run a virtual OS using it, and use such OS for the purposes of downloading files/programs and using them. For example, you would download the Transmission BT client to your virtual OS and ideally run it from such environment. You could still use your Mac for regular uses, or - if safety is an extreme priority, you could refrain from downloading software to the base OS (OS X in this case) altogether. Like I said, this doesn't guarantee complete safety - but it does offer a certain degree worth considering.

Last note - while the technique above can provide advantage, it should not be treated as a substitute for protecting important data through backups (in example cold storage backups, having ones on multiple separate devices etc.).