Of course, bad guys still can 1) create encrypted copy and delete originals instead of modifying files in place; 2) disable protection alongside with A/V and proceed as usual; and my favorite 3) rely on built-in disk encryption mechanisms and simply overwrite encryption keys & salts.
How would the malware do that? I've looked into this and with Windows 10 1903 onward, Tamper Protection is enabled by default. [1]
I have yet to find a programmatic method to disable Tamper Protection (which is a prerequisite to disable Defender). I've tried regedit (permission denied), GPO, and all other manner of PowerShell thuggery, but I have not succeeded. In the end, I scripted extracting and editing the registry hive offline (outside the VM) to disable Tamper Protection.
Unless the malware has a way to open the Settings app and toggle Tamper Protection in the UI as if they were a user, I can't think of any way they could disable it unless they exploit a known weakness in Defender or a third-party anti-virus program (entirely possible).
[1] https://docs.microsoft.com/en-us/windows/security/threat-pro...
I've looked into this, but it feels limited to me. It's all or nothing. I can't have App1 only access Documents and App2 only access Pictures. Once I give any one app access to the "protected folders", it has access to all the protected folders.
All applications run inside a VM, and you set up different VMs for different tasks. The windows are all composited onto one seamless desktop environment, with the colour of the window decorations telling you which VM it's in. You can copy and paste between the VMs with a special keyboard shortcut, and you can manually copy files between them as well, but otherwise they have no access to each other.
If you open some ransomware in one VM, it can't touch (or read, or know of the existence of) any of the data in other VMs.
XEN Virtualization with their custom X-passthrough driver is super fast as well. No hardware acceleration of course, but it didn't feel choppy at all. As long as you have enough RAM (I'd say 16GB at least), it works pretty much like bare metal (even though there are several VMs running in background at all times for network, fw, usb, etc), way faster than Spice, VNC, RDP or Virtualbox (talking about UI not number crunching).
In practice though, if you're a power user you probably won't run shady binaries, and if you do - nothing will protect you from them as your user is likely a member of administrative group / wheel and you use sudo/su/doas somewhat regularly. While if you're worried about protecting your employees/family members, just making sure they are not part of the same admin groups and enforcing basic Software Restriction Policy / AppLocker / SELinux / RBAC will be enough to protect against 99% threats out there.
However, the issue I see with this approach is that the default location for saving pretty much everything on Windows is the Documents folder. So I think most people would just blindly agree to give access to this folder.
Most malware comes from apps people wilfully install, so they would probably grant them access to the folders because they would want to use them.
The approach I like best is what MacOS does, where you have to approve access to a specific folder. The drawback of the MacOS implementation is that I cannot define specific folders I want protected (say .ssh).
However, there is also a question of properly enforcing granular per-process restrictions (without breaking backwards compatibility). It's not a trivial task, there are plenty of corner cases: race conditions, symlinks, alternate data streams, process hollowing... I don't expect any implementation to be full-proof in the first decade.
But if you thought the app was good and granted it access and it then goes wild...
Not a good first impression, and I don't really want to learn the file access patterns of all the things I use.
I think it'd be easier to isolate applications and data like Cubes OS instead of trying to create a universal rule set.
- External drive with a bootable backup (Carbon Copy Cloner)
- Network drive with automagical Time Machine backups
- Offsite versioned backups (for example Backblaze)
"Pride goes before destruction, and a haughty spirit before a fall", but I'd be surprised if I ever will lose a file like this.
I guess that's one reason why if you don't try restoring from you backups it's as good as not having any...
I have a vague memory of ransomware that waited for one to mount external disks yes, but not as advanced as they ones you mentioned
Don’t let apps access “files on external volumes” or “files on removable media” or whatever it calls it on the popup when an app first tries to access those.
And one flips a hardware switch to start overwriting from the beginning, if disk full
https://en.wikipedia.org/wiki/Write_once_read_many
This is the acronym I saw on HN somewhere though, WORM.
Edit: Upon further research its kind of annoying that this isn't more common for NAS / cloud storage solutions. I think some like Dropbox do keep revisions on the other hand.
https://docs.syncthing.net/users/versioning.html
Lots of config options
No -- that only writes to sub dirs
I mean not many apps need to modify millions of files on all drives including network drives and dongles... It should be fairly easy to spot, something like:
1. If xxx wants to modify more than 50 files in 24 hours go to 2.
2. If some of the files were modified more than a week ago or if the files are in directories across multiple drives go to 3.
3. If some of the files are images/documents it's a no go, prompt user to accept and list the affected files.
I'd love something like this for my Synology, it's connected to my Macbook as a network drive and I store my backups there, if anything modifies these files without my knowledge I'm doomed. I need to access some of my backups on daily basis so it's kinda hard to disconnect te drive all the time :/