4

Today I was infected by CoinVault, a new malware similar to CryptoLocker I believe. Before today I was unaware of this entire type of malware. Fortunately I was protected by offline backups, but I have been thinking very hard about how to prevent this kind of thing from happening again, and am not sure I am satisfied with what I've come up with.

Regular backups are obviously very important, but I do not see this as the end all solution. Even offline backups are online for the backup process, which means you haven't removed the potential for infection of these backups, only minimized it to a short timeframe. If your system is vulnerable to cryptolockers, so then is your offline backup.

So how to be sure your system is not vulnerable? I've seen it suggested here to configure policies that disallow exe's from running in %AppData% or %Temp%. But how do we know malware couldn't start from another location? Are these the only places malware can inject itself from a browser? Further, the policy configuration mentioned is not available in home versions of Win7. Can UAC help here, or does it only work for installed applications and not simple executable files? Ideally I'd like to have no exe on my system able to run unless I've whitelisted it... is this possible on Win7 home versions?

My current protection plan is:

  • put UAC to most safe setting (currently on most risky)
  • change my normal user to non-admin privs

Not sure if those two things alone would have helped me here, but I'd like to lock down all arbitrary exe's as well if I can, which is the one area I'm struggling with.

  • 3
    I don't think standard user privileges would help you here -- that locks down the operating system, but your account should have read/write access on your data, which is all it needs to encrypt it. – cpast Jan 2 '15 at 6:28
  • @cpast good point. It also needs to launch some executable code to perform the encryption, which is the part I'm a little uncertain how to prevent. – Dave Johnson Jan 2 '15 at 6:31
  • If you still can't find an answer take a look here http://www.faronics.com/en-uk/products/anti-executable/standard/ This company is well known personally I have not tried this program they offer free 30 day trial to see if it fits your needs. They are most known for one of there products called deep-freeze. Council library's use this program here in Australia to help stop virus's. That is why I say the company is well known. – Tim Jonas Jan 2 '15 at 6:53
  • 2
    Deep freeze also only protect your OS and the frozen data. Since your day-to-day data would not be frozen, for example you wouldnt freeze your current assessment report you are currently Writing on, since then you cant continue Writing on it without it being resetted all the time. – sebastian nielsen Jan 2 '15 at 8:16
  • I can't provide this as an answer because you use an Home version of Win7, but microsoft now includes the AppLocker solution with allows you to white/blacklist every executable files, scripts, dlls, etc. But you need at least win7 ProUultimate or Win8 to use it. (more details thewindowsclub.com/windows-8-applocker-step-by-step-guide) We use it in my company, it's very effective :) – meepmeep Jan 2 '15 at 9:38
6

To protect against this, you need some sort of versioned online backup. Where all Changes are saved as a difference over the old backup, and you can Always rollback to any date/time.

Basically, your versioned backup should work that regardless of what you do on the backup, its copy-on-write and you will Always be able to revert.

This can either be as a incremential file-based backup on a backup server or NAS, but you can also do this on block level with LVM/snapshots on a backup server, such as you store differential snapshots over the filesystem so you can Always recover any of these snapshots prior in time.

The important thing to consider, is that the incremential versioning system MUST be implemented on server-side. Eg, present a shared drive to the client computer. Anytime a file is written to this shared drive, the SERVER (that is inaccessible to the virus) checks if that file already exists, and writes a incremental diff file on the server drive for this file if it already exist.

Thus anything the virus does to the shared drive will Always be saved as a incremential diff.

Only allowing "trusted" software to execute is basically impossible on both Windows and Linux, since a OS has LOTS of executeable code that is executed part of the operating system. In all these executeable code, theres Always entry Points where modules can be connected and executed, and closing off all these entry Points are basically impossible. One example of entry Point is registrering a executeable DLL from regsvr32.exe . Only way you can do is restricting executeable software from modifying certain files, but that also means you have to prevent yourself from modifying that file too, since anything you can do, the virus can do too. The only way you can completly lock out untrusted code is by using a microcontroller, and thats EXACTLY why smart cards exist!

  • Thanks, I was afraid of that. Would upvote but I don't have that priv yet. Unfortunately online backups are not practical for me as I produce 1TB per year of photo/video easily. I currently backup to multiple physical disks both internal/external, onsite and offsite. I already spend a lot on disks as you can imagine, but cloud pricing for this amount of data and bandwidth would be exorbitant. But... I have an idea for a solution! 1) Add another drive to my tower for dual boot (easy with many spare small disks around AND spare bays in my tower). Do not connect this drive to the internet... – Dave Johnson Jan 2 '15 at 10:30
  • ... and do not mount it in the primary boot drive's OS. Heck, I could put Linux on the second boot drive, and with EXT it would be impossible for the Win disk to see it! 2) When I need to update my external backup disks, I simply boot the box to secondary OS. I now know I'm on an uninfected system and I have access to all the data (on other internal disks) that needs to be incrementally updated to the external disk. If older data has been modified on the internal disk, it will be apparent. And I know that no rogue process will corrupt my external disk while I perform this inspection. – Dave Johnson Jan 2 '15 at 10:33
  • @DaveJohnson: Im not talking about cloud backups. What im talking in this contect with Offline and Online, is that it connected to the computer in question. So what im mean, is that you need a Always-connected "online"-backup that enforces versioning/incremental Changes. So grab a good Linux server or NAS, that supports forced incremential backups on server, and then fill that machine with disks. Its no problems filling that server up with petabytes of storage, and then use that as incremential backup server. – sebastian nielsen Jan 2 '15 at 12:28
  • So you simply have a server at home, with lots of storage. The Linux software and Samba, enforces that anytime a file is written to this share that overwrites/deletes a file, a difference/incremential file is saved instead to the physical disk. Then you connect to this share from your Windows 7 computer. If CoinVault or Cryptolocker encrypts your important files, then you will notice they are missing from the share. Then you physically login from the console on the server and "rollback" the incremential system to a date prior to the infection, for example by deleting the newest diff files. – sebastian nielsen Jan 2 '15 at 12:32
  • Thanks, I have't dealt with NAS before and was just picturing it more as an attached drive that a standard user could read/write to. I guess with the client/server model and incremental backups enforced, then an infected user machine could not destroy the historical data on the NAS. I will look into it more. – Dave Johnson Jan 5 '15 at 6:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.