Slashdot Mirror
Windows 10 Will Soon Protect Files and Folders From Ransomware (theverge.com)
Microsoft is making some interesting security-related changes to Windows 10 with the next Fall Creators Update, expected to debut in September. From a report: Windows 10 testers can now access a preview of the changes that include a new controlled folder access feature. It's designed to only allow specific apps to access and read / write to a folder. If enabled, the default list prevents apps from accessing the desktop, pictures, movies, and documents folders. "Controlled folder access monitors the changes that apps make to files in certain protected folders," explains Dona Sarkar, head of Microsoft's Windows Insiders program. "If an app attempts to make a change to these files, and the app is blacklisted by the feature, you'll get a notification about the attempt."
It should prove quite useful, especially for backups. Currently even doing a backup every day I am risking that malware will become active during the process and encrypt backups on connected external disk along with everything else. With this feature I can specify that only backup program can have access to the external drive.
But the recent malware attacks weren't simply malicious trojaned apps changing each other's files. It was spread by compromising / using system services that are meant to be used to access a broad array of files. I don't see how changing the permissions model to block inter-app accesses will fix this...
So it'd be enough for ransomware to impersonate those specific apps or just get into the party list. Shouldn't it?
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
will be used to block steam unless you buy windows 10 pro gamer
..the next generation of Ransomware will exploit a vulnerability in this new service to prevent YOU from accessing these folders and files.
How very convenient!
=Smidge=
And what would a sane security model look like? Ransomware runs under the credentials of the user that has executed the malware, so if the user has read/write access to files and folders, then those folders are vulnerable. It's not that much different than someone accidentally deleting a bunch of files they have access to. I suppose you could put some quantity monitoring, as in if x number of files are altered or deleted, then suspend the process that is doing the file system changes, but that would probably interfere with any program that does a lot of file system changes, like an installer.
In general, what's needed to protect data, whether it's through intentional destruction like ransomware, or through inadvertent destruction like someone deleting a file tree or a file system or physical media becoming corrupted, is backups, mirroring and the like. There's no perfect solution that's going to guarantee every file is recoverable, but what I've seen from file system or disk meltdowns is that in most cases as long as you have a good nightly backup, you're going to get most of it back.
So long as users are basically allowed to run any code they want, ransomware is going to be a reality, and even in walled gardens malware can still find a way in, so it's best to think in terms of worst case scenarios; and whenever I do it always brings me back to the old standards; frequent backups; both on and offsite.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Why not implement a sane security model instead
Because a "sane security model" uses defense in depth. There no one single "silver bullet" solution. Any security layer can fail, so you need additional layers to contain or mitigate the damage.
Your first layer of defense is your firewall ... your last layer is your offsite backups. You should have many more layers in between.
Mandatory or role based access control is no more sane than the configuration of it. The problem is that Joe Schmoe want to open his files in RandomApp without having to learn how to add rules for it.
Convenience wins over security any time.
You can use SELinux to accomplish a similar setup. You can ensure that a given application only has access to specific directories or files. Having spent a little time with it I can say it has an obscene learning curve.
On a Mac, App Store apps have restricted access to a very limited set of folders (as described by the entitlements list that has to be approved by Apple) BUT they can open any file from any folder if the user drags it onto the app or selects it from a standard system file selector within the app. That makes it totally transparent to the user for the vast majority of apps while remaining secure because the app cannot fake the user interaction that allows access to the files.
For the moment, only App Store apps are required to have such an entitlements list but I can see them extend it to all apps at some point in the future, certainly with the current wave of ransomware apps going around. Not sure how it's going to work for command line executables, though. For those, a whole lot of rules editing may become necessary.
All you need to do is send $300 worth of bitcoin to Redmond every few years if you want to keep using your computer.
Seven puppies were harmed during the making of this post.
I'm imagining a hard drive riddled with undeletable files and folders created by apps that failed to uninstall correctly.
Support Right To Repair Legislation.
There's an even easier way Microsoft could solve the problem that already exists and has probably 99% of the work already done for them: Volume Shadow Copy Service.
Set aside 100 gigs of a 500+ gig hard drive, and designate one or more folders for protection.
Any changes to files in the protected folders get journaled to that 100-gig area.
If the journal fills up, the hard drive gets write-protected, with the exception of a 1-2 gig area where the user can create and save NEW files, but can't overwrite/delete existing files (so there will always be somewhere to save open files if the rest of the drive gets write-locked).
Add some extra logic to warn the user as the journal reaches certain milestone sizes. Allow users to override the limits... but treat it like the safes used for change at convenience stores... you can override the limit NOW, but it won't take effect for 24 hours (and maybe up to a week, with warnings leading up to its execution, for more radical overrides).
Need to write lots of temp files? Do it to a directory that's not protected. Or get a bigger hard drive, and make policy changes (that have to either be set at installation time, or get delayed by a period of time to give adequate advance warning).
The only real difference between how it's used now would be the setting of hard thresholds that couldn't be exceeded without write-protecting the drive to give the user time to take action. It would probably create some new denial of service opportunities (some, accidental rather than malicious), but it would be a fairly effective safeguard against the current #1 mode of action used by ransomware (mass-encryption in the background of files over a short period of time).