Microsoft really needs to build ransomware behavior detection directly into Windows. The behavior of these programs is quite distinctive. The advent of cryptocurrency was the missing link to enable all manner of anonymous extortion schemes, and this one in particular seems to now be a mainstream threat. Microsoft should be all over this.
Ransomware detection is just a (perhaps necessary) band-aid.
By default all applications should be sandboxed. Why should a random application be able to read/write to every user directory? We enforce process separation in memory, we should do the same on disk.
Ranked 151-200 in the QS rankings for CS. I bet if they handed this problem over to the CS people in the university they would have willingly helped them out to fix it. Information security is even listed as one of their main research areas. http://www.cpsc.ucalgary.ca/cpsc_research they even have some labs that does infosec http://icis.cpsc.ucalgary.ca/ http://ispia.cpsc.ucalgary.ca/ I bet the people at the CS dept…
Perhaps a student saw an opportunity to get a quick $20,000 discount on their tuition?
The headline could also be "University willingly supports criminals with $20.000" - and it would be more honest. That's really something that bothers me with the whole ransomware thing: People seem to be completely ignorant to the fact that by paying they're not only getting back their data - they're paying the bills for the people who will launch more attacks against other people. And thus they're themselve guilty o…
Why openly announce that you're paying the ransom? Here's some major disadvantages that I can think of: 1. Announces to world that you have poor security/backup practices which encourages more attacks against you 2. Announces to world that making and distributing ransomware is good business which encourages more attacks against everyone I understand that public institutions needs financial transparency in order to be…
> Why openly announce that you're paying the ransom? An effective thing they could have done is to announce that they paid the ransom, but that the decryption did not work (even though it did). That has the advantage of discouraging other people from paying up, and therefore reduces the incentive to create more ransomware attacks. Hell, the government could step in and recruit people and companies to falsely claim th…
> Hell, the government could step in and recruit people and companies to falsely claim that they were ransomware victims who paid up, but never got decryption keys and were screwed over. That could put a damper on ransomware psychology.
This actually did happen to me. Paid the money, got the key, couldn't unlock my files. Damn shame.
Microsoft really needs to build ransomware behavior detection directly into Windows. The behavior of these programs is quite distinctive. The advent of cryptocurrency was the missing link to enable all manner of anonymous extortion schemes, and this one in particular seems to now be a mainstream threat. Microsoft should be all over this.
Ransomware detection is just a (perhaps necessary) band-aid. By default all applications should be sandboxed. Why should a random application be able to read/write to every user directory? We enforce process separation in memory, we should do the same on disk.
That's exactly what UWP(universal windows platform) is - it sandboxes every app. But I am sure you will agree that having this as default behavior on windows would be disastrous, breaking compatibility with every app written before Windows 10, not to mention that the reason why we use PCs is to have low-level access to hardware, many applications require it and sandboxing isn't going to be a good option here. I guess MacOS way of doing things is a good in-between - by default, every app not from the app store is blocked, and you have to go through a slightly cumbersome process of unblocking it manually in security settings. I'm sure it beats the default windows permission popup, which I imagine 99% of users just accept without looking at, or disable outright.
Easy solution - the government writes into law it's illegal to pay ransomware hackers. Sure hackers might get the occasional payee after this but the likelihood goes down dramatically removing much incentive, especially for larger organisations to be targeted.
Only if they made their "backups" writable as well
It's difficult to create backups if you can't write into the backups storage.
The way I do it is I create backups locally and then copy them to my NAS over ftp(with a password), instead of samba. Hopefully, that way any ransomeware would not be able to encrypt my nas as well, as it does not have any publicly accessible folders on the network.