8

Malware files execute themselves after downloading them. Let's look at it from the point of view of a piece of ransomware like CryptoLocker, from Wikipedia:

Crypyowall 3.0, uses a payload written in JavaScript as part of an email attachment, which downloads executables disguised as JPG images.

and

the ads redirected to rogue websites which used exploits in browser plugins to download the payload.

Ok, it may download them but how about running them? As far as I know no server-side language can do any action on the clients, like running programs.

Note: I am not interested in knowing the exploits of how to run a downloaded file, as far as I know no server-side language can do any action on clients, I'm interested in knowing if there is a way to avoid this kind of behaviour.

Disabling JavaScript is not a bright solution since most websites use it.

  1. Is there any way of enabling JavaScript only for the websites of my wish, like a white list (using Chrome)?
  2. Is it possible to disable JavaScript from Gmail's mails or Outlook's?
| improve this question | |
  • 1
    Server side languages can execute programs on clients depending on the plug-ins (or handlers) registered with the browser or other client. A classic example is java, but there are others such as .pdf executing in client-side.pdf rendering engines so the distinction is very blurred. – David Scholefield Jun 30 '15 at 16:50
  • I'd be interested to know if there's any way to limit any ransomware's ability to your backups. Let's say that there is a mounted drive or folder that your files are automatically backed up to. Is it possible to configure your system so that the only process that has the ability to modify/delete that folder/drive is the process that does your backup? Can you at least prevent processes that lack root/administrator privileges to modify/delete it? Is this likely to help a lot? At least on Unix-like? Is this question within the scope of OP, or should it be asked as a question of its own? – Revetahw says Reinstate Monica Apr 18 '16 at 9:34
  • 1
    @Fiksdal you can set the drive as read-only or encrypt it, and allow access only for the user that does the backups, if you do so you must also ensure that the user that does the backups is safe... not part of the question but im thinking of including it as a tip – Alpha2k Apr 18 '16 at 9:58
  • thanks for these useful tipps. Is it a good idea to make backups in password protected ZIP (or RAR) files? When I make file backups in a built in harddrive I won't be secure I know. But does the zippped backup files help? Or is ransomware able to encrypt these files? Thanks! Daniel – user121751 Aug 18 '16 at 8:30
6

You can have a look at Script Defender, ScriptSafe and ScriptBlock Chrome extensions. It looks like they can do what you are asking for.

But the JavaScript issue you are talking about is only the tip of the iceberg. Protecting yourself against ransomware is much more complicated than this.

At a glance, here is what you can do :

  • If you are using Windows, you can use group policies to prevent the launch of executables from certain directories.
  • You can block or limit access to Tor IP addresses.
  • You can block or limit access (read only) to network shares.
  • You can filter spam and malicious attachments.
  • You must backup files regularly and you have to make sure to not overwrite a good backup with a cryptolocked one.

Source : Calyptix blog

| improve this answer | |
2

Sandbox your web facing applications like your browser, email client, PDF reader, anything that opens and deals with files you work with online. When you have actually sandboxed these applications you can download and surf as much crap as you like. Yes you can even open downloaded malicious files (from email or browser or P2P, it does not matter where you got them from) in a sandbox, play with it, check it out, the moment you close the application in the sandbox the entire place on your hard drive where these applications placed files will be securely deleted end of story. This of course is much more technical and complicated but to make things easy you can think of it like I described it. Have a look at the link below to understand this better.
http://www.sandboxie.com/index.php?HowItWorks

Use a VPN 24/7/365. There are plenty offers out there, be careful with the small print. Try to find one that does not keep logs of your activity. One I can think of straight away is below but as I said there are plenty others as well.
https://www.privateinternetaccess.com/

Use a HOSTS file. Instead of only blocking spam/malware/addware/crapware client side once the request has been initiated with a browser add-on, block them at the system level before that. Any request to spam/malware/addware/crapware will be kept on your system and redirected to your own machine (localhost). This will also greatly improve website loading time and your perceived surfing speed.
http://winhelp2002.mvps.org/hosts.htm

Last not least, backup your data, either online (if you have the trust) or locally. Hard drives are cheap and even getting 2 for the same data won't cost you the time, money and most of all mental stress of having lost data or having had to deal with ransomware. Again and only as example here is a service I can suggest.
https://www.backblaze.com/

With this, the only time I have ever caught a virus that was able to damage my system was back in the 90ties. Once I started using the above simple measures spam/malware/addware/crapware for me at least are a thing of the past.

I am in no way affiliated with any of the services mentioned. I just use them and am a really happy camper doing so. So I am not advertising these here, but simply giving a solid suggestion. If this is against site rules please do remove the links accordingly.

| improve this answer | |
  • 1
    Be careful about running bad stuff in a sandboxed browser. While it may not permanently write (protects you against changed data, as the OP has asked), it still may steal private information. – Marcel Apr 18 '16 at 8:16
  • 1
    100% correct and thank you for pointing that out! Personally the few sites I frequent are the Stack Exchange universe and a few other web dev related sites and blogs, though, yes, there have been cases of big corporate sites/blogs/forums with injected malware that did harm people. – lowtechsun Apr 18 '16 at 8:36
  • Sandboxing is not going to be a foolproof solution for much longer. We're starting to see strains of malware that are aware of their sandboxed environment/VM and take steps to break out of jail. The best method of avoiding malware will always be not deliberately introducing it into your network. – Ivan Aug 18 '16 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.