1

This is related to RansomWhere? which is a OS X specific defense developed by a former NSA employee. The premise is that it will "generically" stop ransomware from encrypting files on the OS.

Scope

RansomWhere? only monitors all users' home directories (i.e. anything under ~, for all users) for encrypted files. Thus if the ransomware encrypts files outside these directories, RansomWhere? may fail to detect and block it.

It is allowed to run and install as it is signed by Apple and trusts:

Trust

RansomWhere? explicitly trusts binaries signed by Apple proper (though not ones signed with an Apple developer ID). As such, if ransomware abuses an signed Apple binary (or process, perhaps via injection), RansomWhere? would not detect this. Moreover, the tool inherently trusts applications that are already present on the system when it is installed. Thus is ransomware is already present on the system (before RansomWhere? is installed), it may not be detected.

Now this is fine and likely good as the premise is:

Let's try to generically thwart OS X ransomware via math!

Now the question is: "Could a similar application be developed for Windows?"

It seems that there is application/process whitelisting done where a baseline is established during the installation. But there is the rather significant addition of being able to trust signed installs, is that doable on Windows?

  • 2
    I even doubt that the mechanism works good enough (i.e. "generic") on Mac OS X, see reddit.com/r/netsec/comments/4fo059/… – Steffen Ullrich Apr 21 '16 at 7:14
  • Yes, well the application is not open source - which it could as well have been - so there is only Apple to vouch for the functionality and feasibility. My thought was in part that it is a great conceptual model, but whether it actually works well enough and is possible to do on other OS variants where there is no enforced signature on applications, remains to be seen. – RLFP Apr 21 '16 at 7:41
1

Already done - it's currently in beta.

Have a look at: Malwarebytes Anti Ransomware Beta.

Former times it was called CryptoMonitor developed by EasySync Solutions, owned by Nathan Scott. Nathan was recently hired to bring up the Anti Ransomware tool for Malwarebytes.

  • 2
    Unfortunately I cannot find any deeper details about how this works so it is hard to compare if this is really the same idea. Do you have more information? – Steffen Ullrich Apr 21 '16 at 7:23
  • The details on whether this is actually the same approach is not clear. It is however a good indicator that they do not use signatures, but it is not verifiable that this is the same strategy. – RLFP Apr 21 '16 at 7:37
  • Of Course MB is not telling how their product is working in detail. But to get a better Feeling just have a look at the CryptoMonitor tool (e.g. bleepingcomputer.com/forums/t/572146/…) There you can find some indications about how it can work (I expect MB has adopted the tool - so some functionality is still in place) – Danny. Apr 21 '16 at 7:56
  • @Danny: from the link to CryptoMonitor it looks more like the use of Honeydocs (which ransomware likes to access) called "Entrapment Protection" and some vague specified heuristics to detect suspicious processes "Count Protection". Only the latter feature has some overlap with RansomWhere, i.e. both tools share some ideas (trusted processes, I/O anomalies) but not all. – Steffen Ullrich Apr 21 '16 at 9:19
0

Of course it's possible and already in development as @Danny pointed out and you can assume that some big vendors will follow.

But in fact this is nothing more than another behavior driven anti virus solution. It's the same game as it is with any other protection solution:

It's being developed and deployed, some attacks will be mitigated, the attackers will have a look at the application to circumvent the protection and everything starts from the beginning.

In fact every software, especially such a complex and high privileged one like anti virus protection, will increase the attack surface. There were many cases in the past (for more sources have a search in the web) where the protection solution had vulnerabilities.

  • Yes, the behaviour driven approach is expected. The linked projects do not mention anything like the implied whitelisting with a baseline - as far as I can see. That was one of the things I was considering to be an actual strength in the RansomWhere concept. Then again I may have misunderstood the ideas behind the general concept. – RLFP Apr 21 '16 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.