Ransomware encryption on opened files

Question

I am wondering if ransomware can encrypt currently opened/locked files by an application?

Example: Some application opens files and lock them for manipulation e.g. Database. So I assume that when the system gets infected by ransomware, but database file is already in use, it can't be encrypted until database engine closes all handles to it. Only then, the ransomware can encrypt the database file and during its stealth operations decrypt it when file is again used by the database engine. For the database redologs, I assume that when new log file is created, it gets encrypted by ransomware while it is still available to database engine due to ransomware operations transparency. Only when required percentage of drive is encrypted ransomware deny the file access, so database will loose access to redologs.

I am aware about techniques (example VSS) which allows to read even locked file in parallel, mainly for backup use case, but that's not for altering the file content or metadata.

My assumption is that all such files, from example above, are safe from ransomware until they keep the lock on the file and consequently also databases backups should be safe from ransomware if not done as offline backups.

Is my assumption correct, or are there any programming techniques which overrides the file handle locking mechanism? I haven't found answer on the internet, so I hope to find answer here.

Edit: My question is platform independent. Windows, MacOS, Linux and other Unix brands (e.g. AIX, Solaris...) are in the scope.

Answer 1

The "stealth operations" you speak of not only require the ransomware to be able to modify open files, but to be able to modify the data stream returned to the application (in order to hide until it springs the trap).

Either you are talking about a shared library injection into every running process owned by the current user (which can just use the existing open handle to the file to access it), or you are talking about a rootkit (which intercepts file access at the filesystem driver layer).

What might save you is if the malware hasn't performed privilege escalation and the current user doesn't have file-level access to the database, only a client/server architecture accessing it through system services running as a more/differently privileged user. The mere fact of the file being open is no use at all.

Answer 2

On Windows, you cannot do anything to most (some files are designed for multiple operations to use at once) files in use by another operation. Some ransomware continually scan for unencrypted files, but most don't care.