8

If I encrypt all my files can I get "attacked" by ransom attacks?

Because my files are already encrypted, they cannot access them, so I should be safe or am I wrong?

Also, if someone could tell me how this encryption works, I would be really thankful.

I already read some articles on Wikipedia and it states there that the encryption does not work while booting (in the English article it's called Cold-Boot-Attack), so would it be possible to get access to the files somehow when booting? Not that I need it now, but you never know.

Improve this question
1
  • 7
    They'll just reencrypt your encrypted files...
    – Fiasco Labs
    Aug 9, 2015 at 0:00

6 Answers 6

Reset to default
32

TLDR: Any file encryption does not protect you against Ransom Attack.

We can consider two scenarios:

  1. You encrypt your files with some tools (e.g. encrypted zip),
  2. You have encrypted whole partition (Truecrypt, dm-crypt etc.).

In the first case, even if you have encrypted your files they can be encrypted again by ransomware. And then you won't be able to decrypt them. Bad situation.

In the second case, ransomware lives in the computer's runtime (while you're using it), therefore it has an access to decrypted files on your computer. The disk partition is decrypted on boot up and encrypted again when you shutdown your machine. Again, bad situation.

A file encryption does not protect you against ransomware.

The Cold boot attack is a bit different story and you shouldn't consider it here to not confuse yourself.

I've tried to explain it in the easy way, I hope I helped somehow :)

To protect against ransomware you can (should!) do at least these three things:

  1. Do not visit malicious sites.
  2. Backup important stuff (on a separate, unplugged drive) :)
  3. You can also install some antivirus, EMET etc. The likelihood of being successfully ransom-attacked will for sure decrease.
Improve this answer
7
  • 21
    I would add to (2) that you should back up your important stuff, and then UNPLUG THE BACKUP DRIVE. Ransomware will spread to any USB hard drives or network-mounted drives that your computer is connected to.
    – Mike Ounsworth
    Aug 7, 2015 at 13:40
  • 1
    @MikeOunsworth This got me wondering, could a write only (drop box) style backup drive solution work here? For example, you can write new files without a password, but deleting, modifying and reading would require a password known only to the user. I don't know if this would be possible with USB drives, but maybe sort of networked solution.
    – David Zech
    Aug 7, 2015 at 16:37
  • @Nighthawk441 Intuitively it would seem like ransomware needs to be able to read the files so it knows what it's encrypting. So that would probably work. I think a better solution would be to keep incremental backups so you can roll back to before the files got encrypted.
    – Mike Ounsworth
    Aug 7, 2015 at 17:59
  • 2
    @Nighthawk441 A trick that should work, generally is to setup a separate backup computer and configure your backups so that the backup computer pulls files from the computers you wish to backup and that none of those computers can push files to it (without some kind of extraordinary action, e.g. in the event you wish to restore files). That seems like it should be pretty secure.
    – Kenny Evitt
    Aug 7, 2015 at 19:11
  • @Nighthawk441, if you can only write new files yes. It would need to live in a different system such as a ftp server or a versioning system, which doesn't allow you to overwrite or delete its contents (also note that some ransomwares read backup program configuration files, just like they disable copies shadow copies). Not being able to read the files is not necessarily enough, if they can corrupt it (for instance there was a ransomware that, if it found you had a usb stick connected, deleted its files instead of encrypting it).
    – Ángel
    Aug 8, 2015 at 21:40
14

A simple non-technical analogy in the form of a four step plan....

  1. You have some money you don't want stolen.
  2. You put this money in a safe so that other people can't get at it.
  3. Nefarious Evil Doer wants to stop you from getting at that money too.
  4. Nefarious Evil Doer locks your safe inside a bigger safe that you don't know the combination to.

Now neither of you can get at the money. They're out the cost of a safe, you're out the cost of whatever was in your safe. With Ransomware, their safe is basically free.

Remember, you're not defending against them stealing your data, you're defending against them effectively making it more secure by encrypting it.

Improve this answer
3
  • Just pointing out here that this is not the best analogy, because ransomware does not typically care what is in your safe (be it money or photo albums). All they want is that YOU care enough about it to give them money to unlock the safe they locked it into. Ransomware usually prioritize files that they know their owner attaches a great deal of importance to (because most people don't have backups), such as, say, jpg files in My Pictures, etc..
    – Thomas
    Aug 8, 2015 at 0:22
  • 5
    The analogy is fine it it doesn't focus just on money, your safe could have a childhood toy in it and you would still have to pay up to get it back
    – David Sykes
    Aug 8, 2015 at 6:07
  • @Thomas ... that's actually why I specifically worded it that the attacker wants to stop you from getting at it, rather than wanting it themselves. It's a fair point though, I was just trying to keep it simple.
    – Kaithar
    Aug 10, 2015 at 15:33
8

Ransomware attacks work by encrypting your files so that you don't have access to them anymore. This works regardless whether your files are encrypted or not, as the ransomware treats your files as opaque blobs.

If you are lucky, and your ransomware does file(1)-like checks for the file type, about which file to encrypt (some ransomware only encrypts data which it thinks is important to you, like pictures), you might get away.

The only way to prevent harm from ransomware attacks is through verified backups.

Improve this answer
9
  • Perhaps someone could place a server on the net that will do brute-force password discovery of a small file for free? Some kind of distributed computation or whatever it is called... Then when this happens, you send a file, the server works on it until the key is discovered (producing readable ASCII text or whatever) and then it gives you the key. Kills the motive entirely. Now all we need is a system where many computers can be combined to solve hard problems for no investment... Hmmm. I guess it would be easier to search for signals from space, or protein folding or something...
    – user82913
    Aug 8, 2015 at 1:09
  • 2
    If ransomware is implemented "properly", brute-forcing won't help (it will be too expensive, or totally out of reach), as the key is so complex.
    – user10008
    Aug 8, 2015 at 2:51
  • Quantum computers will make all forms of encryption worthless. Maybe Ransomware is a huge, invisible conspiracy to get users to learn about their computers and back up their files?
    – user82913
    Aug 8, 2015 at 2:57
  • 2
    @nocomprende Quantum computers hardly affect symmetric cryptography, so "all forms of encryption" is a bit of a stretch. Asymmetric cryptography will require some reworking though, granted.
    – Thomas
    Aug 8, 2015 at 3:14
  • 1
    Beware that ransomware can crypt crypted files, but they can also crypt backups. The rule is: to avoid being a target of ransomware, do verified backups on a verified system!
    – dan
    Aug 8, 2015 at 22:42
2

If I encrypt all my files can I get "attacked" by ransom attacks?

Yes. They will re-encrypt your data anyway and hope that you don't have an "offline" back up.

Because they're already encrypted they cannot access them, so I should be save or I think wrong?

You are safe from the fact that they won't be able to access your information, but you are troubled anyway if you don't have a backup.

Also, if someone could tell me how this encryption works, I would be really thankful.

Take a look at this very easy to understand and well written article - How Does Encryption Work, and Is It Really Safe?

I already read some articles on Wikipedia and there stand that the encryption does not work while booting (in the English article it's called Cold-Boot-Attack), so would it be possible to get access to the files somehow when booting? Not that I need it now, but you never know.

You are right, unless the system as a pre-boot authentication system embedded.

Pre-Boot Authentication (PBA) or Power-On Authentication (POA) serves as an extension of the BIOS or boot firmware and guarantees a secure, tamper-proof environment external to the operating system as a trusted authentication layer.

Improve this answer
2
  • Thanks for your Answer and the link to how Encryption Works :) But actually i mean how it's saved on the Computer - i know the Algorithms for the Encryption Methods the thing is that i want to know how the Hard Drive makes it not accessable with as example another Operating System like Linus :)
    – PixelStudio
    Aug 7, 2015 at 13:44
  • @PixelStudio it is misleading (as seen in the original question) to think of encrypted files as inaccessible to the attacker - they are fully accessible, but have been modified to be unfeasibly difficult to decode. A more relevant analogy is as if a physical file was put in a lockbox. The attacker cannot get to the lockbox contents, but they can put the whole box in a safe without opening it, and offer to sell/ransom the safe key to you if you ever want to see your data again.
    – Peteris
    Aug 7, 2015 at 16:30
1

Just adding to the other answers why encryption doesn't save you from further encryption.

Let's say your file only contains 4 letters, "abc4" (or just think of it as a simple String)

You encrypt that file with a very simple encryption that takes a "password" and then adds this to every character of your file. We take "3" as a password so our encryption method looks like this:

for (int i=0; i<file_length; i++){
    file[i]=file[i]+3}

It adds 3 to every space in our file so "abc4" would become "def7"

The decrypt function for this would be the following (mind the - sign as we "revert" the encryption):

for (int i=0; i<file_length; i++){
    file[i]=file[i]-3}

resulting in our initial string "abc4"

If now the ransomeware tries to encrypt your file, it doesn't really care if it's already encrypted or not. Taking the following encryption method for the ransomware:

 for (int i=0; i<file_length; i++){
    file[i]=file[i]*2}

your encrypted file (def7) would become "hjl14" (let's just say 10 comes after 9 in that format).

If you now try to decrypt "hjl14" with your method of subtracting everything by 3, you'd get "egi11" which would still be unreadable to you.

Improve this answer
-2

As pointed out in the other answers, encryption does not work, it doesn't prevent the data from being encrypted again. The only way you could perhaps put a stop to this is by using some old computer as a bait, if the data on that computer get's encrypted by ransomware and they ask for payment, you could try to contact the police and set up the payment such that they can be caught.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .