How can ransomware know file types?

Question

When ransomware searches the victim's files in scanning step, how can ransomware know the types of files?

It can check the file name (e.g. book.pdf) or file signatures.

What I'm wondering is when I change the extension in my file's name (say, book.pdf --> book.customEX), I think that ransomware should not be able to find my files, so encrypting files also cannot be done.

Can I have some opinions or advice?

Answer 1

First off, not all ransomware are created equal: just like any software, some ransomware is well-written, while some are poorly-written. You can get an overview of major ransomware variants on wikipedia/ransomware. Some ransomware - notably CryptoLocker - do use lists of file extensions to decide which files to encrypt, and why not? Users knowledgeable enough to change their file extensions probably have backups and won't pay you anyway. As @usr points out, you can still get a lot of people with simple approaches. That said, some ransomware, like CryptoWall, is very sophisticated, and while I don't know how it works, I can speculate on what's possible.

---

As you say, files often contain a "file signature" - a short hex code near the start of the file that indicates what type of file it is. Here are two lists of these "magic numbers" from Wikipedia: [1], [2].

The Windows OS itself relies quite heavily on file extensions in the file name and is notoriously brittle if you change it, but that doesn't mean all software needs to be so terrible.

For example, there's a standard Unix utility called file that will look at the magic number and tell you what type of file it is, there's no reason ransomware can't do the same.

Answer 2

The malicious program will detect your files by its signatures

There is an example (image.png):

hexdump -C image.png | head

sample output:

00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
00000010  00 00 02 4a 00 00 00 bc  08 06 00 00 00 87 77 81  |...J..........w.|
00000020  b4 00 00 00 01 73 52 47  42 00 ae ce 1c e9 00 00  |.....sRGB.......|
00000030  00 04 67 41 4d 41 00 00  b1 8f 0b fc 61 05 00 00  |..gAMA......a...|
00000040  00 09 70 48 59 73 00 00  0e c4 00 00 0e c4 01 95  |..pHYs..........|
00000050  2b 0e 1b 00 00 24 b1 49  44 41 54 78 5e ed 96 8d  |+....$.IDATx^...|
00000060  ae 5d 29 08 85 fb fe 2f  dd 09 e9 30 e3 a5 8a 88  |.])..../...0....|
00000070  20 e8 e6 4b 48 7b e4 6f  01 bb 49 7f fd 2e 8a a2  | ..KH{.o..I.....|
00000080  28 8a a2 28 ba d4 7f 94  8a a2 28 8a a2 28 06 d4  |(..(......(..(..|
00000090  7f 94 8a a2 28 8a a2 28  06 d4 7f 94 8a a2 28 8a  |....(..(......(.|

I will change my image.png to your custom extension customEX then i will get the hexdump

Again i will run hexdump -C image.customEX | head

There is the output:

00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
00000010  00 00 02 4a 00 00 00 bc  08 06 00 00 00 87 77 81  |...J..........w.|
00000020  b4 00 00 00 01 73 52 47  42 00 ae ce 1c e9 00 00  |.....sRGB.......|
00000030  00 04 67 41 4d 41 00 00  b1 8f 0b fc 61 05 00 00  |..gAMA......a...|
00000040  00 09 70 48 59 73 00 00  0e c4 00 00 0e c4 01 95  |..pHYs..........|
00000050  2b 0e 1b 00 00 24 b1 49  44 41 54 78 5e ed 96 8d  |+....$.IDATx^...|
00000060  ae 5d 29 08 85 fb fe 2f  dd 09 e9 30 e3 a5 8a 88  |.])..../...0....|
00000070  20 e8 e6 4b 48 7b e4 6f  01 bb 49 7f fd 2e 8a a2  | ..KH{.o..I.....|
00000080  28 8a a2 28 ba d4 7f 94  8a a2 28 8a a2 28 06 d4  |(..(......(..(..|
00000090  7f 94 8a a2 28 8a a2 28  06 d4 7f 94 8a a2 28 8a  |....(..(......(.|

As you can see the signature of the file keep unchanged and can be verified from the List_of_file_signatures

89 50 4E 47 
0D 0A 1A 0A

Can I have some opinions or advice?

You need to create a secure backups of your data on a regular basis ( external hdd ...) and physically disconnect the device from your PC.

Answer 3

The ransomware I have removed typically looks for common file extensions. When they find a match they run their encryption script and move to the next file.

They could also look at the file's header but grabbing extensions is probably damaging enough.

Answer 4

Ransomware, unless very poorly written, will distinguish boot files from non boot files. This recognition, however, is based on default settings, which could cause a problem for someone like me who has a bootloader/boot sector that they wrote. The ransomware may encrypt these files as it can't recognize them. But, encrypting regular boot files may be a good idea. The ransomware may replace the bootloader with one that mimics the Windows or Grub/Grub2 bootloader, but with the ability to read these encrypted boot files. That way, the computer could be made to not boot until the price was paid.

Ransomware will probably check the magic number.

Answer 5

Hard drive failure is a much more common type of ransomware. Back up the files and have an off site back up. A clean instal runs so much nicer anyway.