Is someone have a generic list of files that payment walls encrypt? I want to build software to protect only those kind of files.

I know that this changes from time to time. Let me know if the list below misses anything:

doc, docx, xls, xlsx, ppt, ppts, pdf, jpg, jpeg, png, psd, ai, txt

In other words: Is there a list of important filetypes by popularity that should be backed up?

  • 1
    Welcome to Information Security. I'm not sure if this is what you're looking for...
    – Jedi
    Aug 3 '16 at 19:38
  • Thank you. Exactly. You can post it as an answer. No? Aug 3 '16 at 19:43
  • 2
    There are countless of different ransomwares and new variants show up almost daily. Creating a complete list is impossible and it would be outdated the moment it is posted. Just get a proper backup solution which mirrors your whole filesystem. That allows full recovery from ransomware and also a myriad of other disaster scenarios.
    – Philipp
    Aug 3 '16 at 19:52
  • For instance, a recent variant seeks out video game save files, and those file types can be anything, even custom file types.
    – schroeder
    Aug 3 '16 at 21:08

Allow me to be merciful and give you an actual explanation of why your software would be completely ineffectual.

Ransomware can and (according to Murphy's law) will encrypt any file that the malware has access to. Software running on a compromised computer to protect files would be useless since the attacker would have access to the computer anyway, and even if they didn't have read/write access because of your program, they could simply kill the task and go on jacking up your data.

Additionally, protecting only certain file-types is even more absurd. First of all, although you might be able to obfuscate document files (security through obscurity, oh my!) to hide from a static attack (i.e. amateurish program that encrypts all files ending in .docx), any legitimate threat will sail right by software-implemented protection/obfuscation. Not to mention the difficulties your program would have in verifying that a .docx file is actually a .docx file and so on so forth for every filetype.

Instead, here's the real solution: lock down your environment with proven techniques like firewalls, OS updates, and physical security, and protect every single file, because white-listing what files you want to be secure when you expect a hacker has compromised every other file on the system is absurd.


Not the answer you're looking for? Browse other questions tagged or ask your own question.