Re:Microsoft Can Fix Ransomware Tomorrow
by gjsman-1000 on Friday July 14, 2023 @01:16PM
(#36726913)
This is a HUGE point that he missed.
If processes have a rate limit, why don't I create create more processes to bypass the limit? Why don't I add some mutation code to my virus, making it polymorphic, to appear to the OS as separate processes that are unrelated?
Now we need to add a methodology to rate-limit how often a process can start another process or open another application, from any API or method that could have been used to accomplish that. And if you think that limiting CreateFile() was a breaking change...
Right off the top of my head, why not use the scheduling tool in Windows to run a theoretical SpawnSeperateProcess.exe once every second?
Re:Microsoft Can Fix Ransomware Tomorrow
by ipython on Friday July 14, 2023 @01:25PM
(#36727060)
Don’t forget that processes can inject code into other processes on the same session, so you can hijack other “innocent” processes to further bypass this rate limit.
If processes have a rate limit, why don't I create create more processes to bypass the limit? Why don't I add some mutation code to my virus, making it polymorphic, to appear to the OS as separate processes that are unrelated?
Now we need to add a methodology to rate-limit how often a process can start another process or open another application, from any API or method that could have been used to accomplish that. And if you think that limiting CreateFile() was a breaking change...
Right off the top of my head, why not use the scheduling tool in Windows to run a theoretical SpawnSeperateProcess.exe once every second?