21

When ransomware searches the victim's files in scanning step, how can ransomware know the types of files?

It can check the file name (e.g. book.pdf) or file signatures.

What I'm wondering is when I change the extension in my file's name (say, book.pdf --> book.customEX), I think that ransomware should not be able to find my files, so encrypting files also cannot be done.

Can I have some opinions or advice?

|improve this question
  • 28
    I sense an underlying question here: "Can I protect myself by changing the file extentions?" The answer is maybe partly, but it will cause all sorts of annoying side effects. The best protection from ransomware is still to have good backups. – Anders Nov 3 '16 at 13:04
  • 57
    If I wanted to write a Ransomware I'd make the choice of encrypting everything except for the things that I know are needed to boot the system and show my instructions on how to pay me; in particular there is no reason not to encrypt a file inside the user directory, since that surely isn't needed by the system to boot. – Bakuriu Nov 3 '16 at 14:11
  • 18
    Most people have their files in C:\Users\TheirName\Documents or in C:\Users\TheirName\Desktop. So, why not just encrypt every file in those two locations... looking for extensions doesn't make sense if you ask me. – Damon Nov 3 '16 at 14:40
  • 6
    Why would ransomware care about the extension of a file? It just encrypts everything - that's the point of ransomware. The only thing it doesn't encrypt are files which are required to boot the system. – Xaver Kapeller Nov 3 '16 at 15:06
  • 13
    @XaverKapeller and others, whether or not you agree, one of the major ransomware variants, CryptoLocker *does* use a whitelist of file extensions, it certainly does not "encrypt everything". [source]. – Mike Ounsworth Nov 3 '16 at 15:19
77

First off, not all ransomware are created equal: just like any software, some ransomware is well-written, while some are poorly-written. You can get an overview of major ransomware variants on wikipedia/ransomware. Some ransomware - notably CryptoLocker - do use lists of file extensions to decide which files to encrypt, and why not? Users knowledgeable enough to change their file extensions probably have backups and won't pay you anyway. As @usr points out, you can still get a lot of people with simple approaches. That said, some ransomware, like CryptoWall, is very sophisticated, and while I don't know how it works, I can speculate on what's possible.

As you say, files often contain a "file signature" - a short hex code near the start of the file that indicates what type of file it is. Here are two lists of these "magic numbers" from Wikipedia: [1], [2].

The Windows OS itself relies quite heavily on file extensions in the file name and is notoriously brittle if you change it, but that doesn't mean all software needs to be so terrible.

For example, there's a standard Unix utility called file that will look at the magic number and tell you what type of file it is, there's no reason ransomware can't do the same.

enter image description here

|improve this answer
  • 7
    Tangential question: is file a reliable utility for sanitizing files uploaded by users on a website, or is it easily spoofed? – user1717828 Nov 3 '16 at 15:16
  • 14
    @user1717828 good question, I imagine you could hex-edit the magic number in the file and fool it, but then the OS will probably treat it the same way file does so you could argue that a hex-edited pptx actually is a corrupt jpg. Have a look at the man page I link to and you'll see what kinds of checks file is doing. I guess it really depends on what you're trying to sanitize for; any text file with the +x bit set becomes a shell script... – Mike Ounsworth Nov 3 '16 at 15:29
  • 31
    @user1717828, no. Trivial counterexample: if you concatenate a zip file to the end of a JPEG, you get a file that is simultaneously a valid zip archive (the zip format works from the end of the file backwards) and a valid JPEG image (JPEG doesn't care about anything past the end of the image data). – Mark Nov 3 '16 at 20:28
  • 2
    @Mark, there is a neat example of a similar technique that interleaves HTML into the JPEG comment section: lcamtuf.coredump.cx/squirrel – Kevin Nov 4 '16 at 0:06
  • 4
    @fadelm0 This page is a jpeg file with HTML in its comment, HTML is always loosely parsed because of history, so the browser discards any weird binary data. – lolesque Nov 4 '16 at 10:28
6

The malicious program will detect your files by its signatures

There is an example (image.png):

hexdump -C image.png | head

sample output:

00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
00000010  00 00 02 4a 00 00 00 bc  08 06 00 00 00 87 77 81  |...J..........w.|
00000020  b4 00 00 00 01 73 52 47  42 00 ae ce 1c e9 00 00  |.....sRGB.......|
00000030  00 04 67 41 4d 41 00 00  b1 8f 0b fc 61 05 00 00  |..gAMA......a...|
00000040  00 09 70 48 59 73 00 00  0e c4 00 00 0e c4 01 95  |..pHYs..........|
00000050  2b 0e 1b 00 00 24 b1 49  44 41 54 78 5e ed 96 8d  |+....$.IDATx^...|
00000060  ae 5d 29 08 85 fb fe 2f  dd 09 e9 30 e3 a5 8a 88  |.])..../...0....|
00000070  20 e8 e6 4b 48 7b e4 6f  01 bb 49 7f fd 2e 8a a2  | ..KH{.o..I.....|
00000080  28 8a a2 28 ba d4 7f 94  8a a2 28 8a a2 28 06 d4  |(..(......(..(..|
00000090  7f 94 8a a2 28 8a a2 28  06 d4 7f 94 8a a2 28 8a  |....(..(......(.|

I will change my image.png to your custom extension customEX then i will get the hexdump

Again i will run hexdump -C image.customEX | head

There is the output:

00000000  89 50 4e 47 0d 0a 1a 0a  00 00 00 0d 49 48 44 52  |.PNG........IHDR|
00000010  00 00 02 4a 00 00 00 bc  08 06 00 00 00 87 77 81  |...J..........w.|
00000020  b4 00 00 00 01 73 52 47  42 00 ae ce 1c e9 00 00  |.....sRGB.......|
00000030  00 04 67 41 4d 41 00 00  b1 8f 0b fc 61 05 00 00  |..gAMA......a...|
00000040  00 09 70 48 59 73 00 00  0e c4 00 00 0e c4 01 95  |..pHYs..........|
00000050  2b 0e 1b 00 00 24 b1 49  44 41 54 78 5e ed 96 8d  |+....$.IDATx^...|
00000060  ae 5d 29 08 85 fb fe 2f  dd 09 e9 30 e3 a5 8a 88  |.])..../...0....|
00000070  20 e8 e6 4b 48 7b e4 6f  01 bb 49 7f fd 2e 8a a2  | ..KH{.o..I.....|
00000080  28 8a a2 28 ba d4 7f 94  8a a2 28 8a a2 28 06 d4  |(..(......(..(..|
00000090  7f 94 8a a2 28 8a a2 28  06 d4 7f 94 8a a2 28 8a  |....(..(......(.|

As you can see the signature of the file keep unchanged and can be verified from the List_of_file_signatures

89 50 4E 47 
0D 0A 1A 0A

Can I have some opinions or advice?

You need to create a secure backups of your data on a regular basis ( external hdd ...) and physically disconnect the device from your PC.

|improve this answer
  • So, magic numbers? Do you have a reference saying that ransomware does indeed check magic numbers and not just file extension? – schroeder♦ Nov 4 '16 at 18:59
  • yes @schroeder, security.stackexchange.com/questions/124261/… – jmingov Nov 4 '16 at 19:44
  • 1
    @jmingov there is a single reference to a subtype that does this. But the one answer also states that 'most look at extensions', which seems to be a counter argument and not a reference supporting this as an answer ... – schroeder♦ Nov 4 '16 at 19:57
3

The ransomware I have removed typically looks for common file extensions. When they find a match they run their encryption script and move to the next file.

They could also look at the file's header but grabbing extensions is probably damaging enough.

|improve this answer
-2

Ransomware, unless very poorly written, will distinguish boot files from non boot files. This recognition, however, is based on default settings, which could cause a problem for someone like me who has a bootloader/boot sector that they wrote. The ransomware may encrypt these files as it can't recognize them. But, encrypting regular boot files may be a good idea. The ransomware may replace the bootloader with one that mimics the Windows or Grub/Grub2 bootloader, but with the ability to read these encrypted boot files. That way, the computer could be made to not boot until the price was paid.

Ransomware will probably check the magic number.

|improve this answer
  • 6
    In fact most of them use file extensions. They are written to be fast and target the stupid. – Joshua Nov 3 '16 at 22:56
  • Cryptolocker uses file extensions: en.wikipedia.org/wiki/Ransomware#CryptoLocker – schroeder♦ Nov 3 '16 at 23:13
  • Interesting answer nonetheless, can you give sources for your answer? – Mike Ounsworth Nov 4 '16 at 1:18
  • I have yet to see one that does this. It also sounds like it's way more trouble to make than it is worth. Not to mention there would be no way to pay the ransom as there would be 0 access to the ransomers website. – Cc Dd Nov 11 '16 at 2:05
-2

Hard drive failure is a much more common type of ransomware. Back up the files and have an off site back up. A clean instal runs so much nicer anyway.

|improve this answer
  • 1
    This does not answer the question (and I'm not sure that your initial assertion is true). – schroeder♦ Nov 5 '16 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.