News for hackers. Stuff that matters.
Re:Microsoft Can Fix Ransomware Tomorrow by lucb1e on Friday July 14, 2023 @01:07PM (#36726747)
TL;DR

> Microsoft should rate-limit the CreateFile() API

---

A friend of mine worked on (published?) a tool that puts canary files on the system in various places. When one of them is overwritten or removed, you know what's up. That seems more reliable than letting ransomware just trickle through the system instead of rushing through, more clear than a warning about some software touching all your files, and much less invasive to other software

The article also kinda glosses over that the criminals, in business cases, typically have domain admin. The whitelisting feature that the author proposes to use for backup software is going to make the limit ineffective

Re:Microsoft Can Fix Ransomware Tomorrow by ok123456 on Friday July 14, 2023 @01:09PM (#36726782)
Now you can only move 400 files/day. Upgrade to Microsoft Blue to get 4000 files/day.
Re:Microsoft Can Fix Ransomware Tomorrow by giaour on Friday July 14, 2023 @01:13PM (#36726853)
I realize you meant the above as a joke, but a configurable throttle on CreateFile would probably only be part of a Pro SKU. Ransomware is a much bigger threat in a business setting than for personal devices
Re:Microsoft Can Fix Ransomware Tomorrow by NBJack on Friday July 14, 2023 @01:15PM (#36726890)
But don't worry, Windows S2 has you covered! Now that you are in our walled garden, we don't limit things like that at all here; it's 110% safe and trustworthy and never ever ever gets compromised. You won't be able to install anything outside of our app store again, but who cares!