1

Some time ago I read an article that mentioned that it is possible for some ransomware to change the magic numbers of a file (that makes sense). However, the authors claimed that their method was better, because they calculated the entropy value of the file header and used that to distinguish between encrypted and benign files. However, the magic numbers are, as far as I know, part of the file header (so if they claim that ransomware can change the magic numbers, then it can also change the file header, right? So, why is this not a potential problem in their study?

In another study, this was mentioned:

However, since the header portion is only 8 bytes in size, the reliability of the data is not high. An intelligent ransomware can bypass the detection technique by not changing the 8-byte pattern.

They also state:

The trailer format section can most clearly distinguish between the normal encryption formats and ransomware-infected formats. The entropy value of 164 bytes of ASCII code was analyzed. The highest value of the entropy value of the normal file trailer format is lower than the smallest value of the trailer format entropy value of the ransomware infected file.

But in this case I wonder why the ransomware encrypts both the header and the trailer? I mean... it makes more sense to leave it intact (then the malicious software will not be detected), since it only contains metadata (the user cannot recover the file based on that metadata, so why would you encrypt it)?

Improve this question
2

1 Answer 1

Reset to default
0

...why the ransomware encrypts both the header and the trailer?...

Why not? What advantage would it have to not encrypting header and trailer vs. simply encrypting everything - like ransomware traditionally does. Specifically singling out header and footer only makes it more complex. Note that some newer ransomware encrypt only some parts to speed up encryption and/or confuse detection heuristics - but this does also not specifically spare headers and footers.

If there would be a significant disadvantage of encrypting header and footer, like some important security product detecting the malware based on this feature, then ransomware would surely adapt to avoid such detection. There is no technical reason which would make encrypting header and footer unavoidable.

Improve this answer
9
  • Thank you Steffen for your response. "Why not?" Because in that case defence mechanisms that analyse the header/trailer of a file cannot detect malicious behaviour... Perhaps I should rephrase my question. What if a ransomware author knew I was using header/trailer analysis (to detect encryption)? Would he then choose not to encrypt the header/trailer (to remain undetected), or is that not an option for some reason?
    – Moooz
    Commented Oct 2, 2022 at 20:47
  • 1
    @Moooz: that would be a significantly different question and thus should be asked as a new one. Don't make your question a moving target, especially if answers already exist.
    – Steffen Ullrich
    Commented Oct 2, 2022 at 21:08
  • "especially if answers already exist" I couldn't find them, and I read a lot of papers, so if you know where to find the answers, please let me know.
    – Moooz
    Commented Oct 2, 2022 at 21:15
  • 1
    @Moooz: You might noticed that I've answered your original question. Even if you did not accept the answer - it is still an answer and changing the question would not be the expected action since the answer would no longer fit the question. But to answer "Would he then choose not to encrypt the header/trailer (to remain undetected), or is that not an option for some reason?" - attackers adapt and there is no significant technical obstacle to encrypt header and footer - it is just simpler to encrypt everything.
    – Steffen Ullrich
    Commented Oct 2, 2022 at 21:24
  • 1
    Well, you have answered my question with "Why not?" Congratulations, what a brilliant answer. It's easier to encrypt the whole file, than just the body.. yeah no shit... Anyway, thanks for your "help". You asked for the link, did you read the paper? No, obviously not, because in such a case your response would be much better than such a general, meaningless answer.
    – Moooz
    Commented Oct 2, 2022 at 21:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .