67

Recently, my employer blocked access to Gmail, Yahoo Mail, etc., because an employee downloaded an email attachment which contained ransomware and got their disk encrypted.

QUESTION : How does ransomware get the root/admin permissions to encrypt your disk? Presumably, the person who downloaded it had to have entered the admin/root password at some point.

  • 3
    Usability vs Security. My system restricts all non admin folders (basically everything in the user folder) with a white-list of programs that are allowed access. This should block most ransomware, but it causes usability problems (having to white-list programs). Most users will gladly sacrifice a little security for usability. – AstroDan Dec 7 '16 at 14:49
  • 36
    Related: xkcd.com/1200 – CodesInChaos Dec 7 '16 at 20:50
  • 10
    @AstroDan Once again affirm what we already know: Security that comes at the expense of usability comes at the expense of security. – Williham Totland Dec 7 '16 at 21:14
  • 31
    Usually it doesn't encrypt your disk. It just encrypts all your important documents that you already have permission to access. – user253751 Dec 7 '16 at 22:54
  • With the little information included in this post, it sounds like your employer is overreacting. You name gmail and yahoo mail, two services which remove most malware. It seems much more likely that the user got that malware elsewhere, like using Outlook to check both Yahoo and a home ISP mail server. And who is to call the user on doing that because the evidence is gone. Instead of targeting the specific email program used on that computer, your employer appears to be painting with a very wide brush. Sounds like a hardware error: the nut between the chair and the keyboard. – SDsolar Dec 10 '16 at 21:10
113

Ransomware doesn't get root/admin permissions, because it does not need to.

It does not encrypt the disk or files protected by the operating system (executables, configuration, credentials), it encrypts files created and stored by the users (data); and all it requires to do so, is the same level of access as the users themselves.

Just like a user would create a password-protected zip and delete the original file, so does ransomware (except, it keeps the password in secret and makes sure the original file is really inaccessible).

That's the whole reason why ransomware is so successful, it encrypts what is the most valuable for users and companies: their work.

  • 4
    "it keeps the password in secret" I either vaguely remember or imagine that they use public/private key pairs, so that the "password" isn't even stored on the user's machine. Is that correct? – jpmc26 Dec 7 '16 at 22:56
  • 4
    @jpmc26 But strictly speaking file encryption is usually preformed using symmetric encryption, and then the key is encrypted with an asymmetric one. – techraf Dec 7 '16 at 23:13
  • 32
    or they just corrupt the data permanently, and after you pay the extortion fees you find out you've not just been held at ransom but then scammed out of your money as well. – jwenting Dec 8 '16 at 8:19
  • 22
    @jwenting They make very good money of extortion fees. If they wouldn't be reliable (strange as it sounds), they would cut off their source of income. – techraf Dec 8 '16 at 13:18
  • 10
    @jwenting The idea of trust is weirdly important, some ransomware hackers even provide a type of 'customer support' to help people make the payments, as strange as that sounds. engadget.com/2016/09/09/… – Jezzamon Dec 8 '16 at 23:38
15

While techraf has the correct answer (that it only encrypts user-space files), I wanted to add that if it did want to do stuff to other parts of your disk, it would do so the same way as some other malware... via exploit.

Malware authors can find flaws in operating system design that allow mundane programs to get to places they shouldn't. Buffer overflows, IPC flaws, poor encapsulation, and simple mistakes can make it possible for programs to get into places they shouldn't. This is why it's important to patch your machine regularly, and keep those Windows Updates current. Even anti-virus software won't help if the operating system it depends on has a flaw that allows a virus in behind it.

This is why it's important not to use Windows XP any more (and Windows 7 after next year)... these flaws are no longer fixed as they are discovered. Security add-on products like anti-virus don't help protect against these problems, as they themselves are merely guest processes in the operating system that depend on it's functioning low-level security in order to do their jobs.

  • Upvote, but I would add that there still can be a place for WinXP. Microsoft took the last version and added all the service packs, then released it to be used for free. I have taken that, loaded only the two programs I need, and given the system its own NAT router. I would never use it as a general PC. I wouldn't run any computer in the wild without NAT and a decent antivirus/firewall - those get regular updates, no matter which OS. The key is right-sizing your equipment, knowing the risk/benefit tradeoffs. My WinXP machine is a Latitude D610 which would otherwise be useless.. – SDsolar Dec 10 '16 at 21:28
  • The free version is only licensed for use in a virtual machine. If you're running it on bare hardware, you may be in violation of that license. – Joel Coehoorn Dec 10 '16 at 21:48
  • You did not provide a reference so I can't fact check. While I know it runs in a virtual machine, I see no prohibition to running it on old hardware. It is the Professional version with all service packs. It sure has helped me because that old laptop is right-sized for satellite reception (Firefox with Flash and updates) and ZaraStudio, also free. It makes for a very nice small CSN radio station (csnradio.com/listen). As for Windows XP Pro for free, here is where you can get it: softlay.net/operating-system/… – SDsolar Dec 11 '16 at 20:03
0

No not really, the malware or ransomware can actually do it's work without gaining admin privileges just as an ordinary user.

Apart from that, the malware or ransomware uses known exploits like that of the NSA exploits which got leaked by the Shadow Brokers group, likewise we have examples - the WannaCry malware which took the world by surprise with a huge number of infected computers actually exploited the Eternalblue exploit which makes use of a vulberability in the Windows SMB Relay. Now the ransomware went on to encrypt the user's valuable files.

Rooting or gaining admin privileges part

So, more often ransomware mainly target known exploits, so yes even I can develop a malware which can target unpatched Windows systems and further if I want gain root access to perform something more malicious. For an example, my friend and fellow researcher SandboxEscaper disclosed an alpc LPE bug in Windows earlier this week, we can actually implement it in the malware to gain Local Privilege Escalation after making an user download an executable or malware we develop and perform more malicious actions on the system. But rooting or gaining admin privileges isn't always required.

Bottom line : Ransomware uses specific known exploits and to target a specific level of damage might as well chain Remote bugs with LPE to widen its impact but, this isn't usual since it can encrypt files with normal user privileges

Not the answer you're looking for? Browse other questions tagged or ask your own question.