Slashdot Mirror
New R2D2 Technique Protects Files Against Wiper Malware, Secure Delete Apps (bleepingcomputer.com)
An anonymous reader writes: Purdue University scientists have developed a data protection technique called Reactive Redundancy for Data Destruction (R2D2) that can safeguard data sitting inside a virtual machine from modern data-wiping malware and even some secure file deletion methods. The technique was developed to protect enterprise systems, which are often running inside VMs.
Researchers say the new technique was successful in preventing wiper malware such as Shamoon (v1 and v2), StoneDrill, and Destover from deleting data during their experiments, but it was able to prevent data deletion attempted with legitimate "secure delete" applications. When such operations are detected, R2D2 runs each one through a series of policies that evaluate the operation for known destructive patterns. If the scan triggers a warning, the VM creates a temporary checkpoint that a human operator can use as a system restore point.
Researchers say the new technique was successful in preventing wiper malware such as Shamoon (v1 and v2), StoneDrill, and Destover from deleting data during their experiments, but it was able to prevent data deletion attempted with legitimate "secure delete" applications. When such operations are detected, R2D2 runs each one through a series of policies that evaluate the operation for known destructive patterns. If the scan triggers a warning, the VM creates a temporary checkpoint that a human operator can use as a system restore point.
Don't need to worry about Moscow Donald deleting his Russia collusion emails, since apparently he doesn't even realize that treason is illegal...
Seems simple. Keep the tardo/republicans away from anything important. You have seen what happens when these fail.
stupid article
stupid claims
stupid site
of course it came from the fucking idiotic msmash
someone with a clue just fucking ban that fucking retarded aborted fetus
You need three CPUs to run it properly!
Ezekiel 23:20
This sounds like virus scanning, but for file operations. Terrible idea.
I have an even better method for protecting files against deletion. One that is proven and robust. It's called a "backup".
Even if he blames Obama.
Researchers say the new technique was successful in preventing wiper malware such as Shamoon (v1 and v2), StoneDrill, and Destover from deleting data during their experiments, but it was able to prevent data deletion attempted with legitimate "secure delete" applications.
Successful and able to prevent?
Successful but unable to prevent?
To the NSA. Problem solved.
--sf
Or at least issued a DMCA Takedown Notice, for daring to use 'R2D2' without paying royalties, or at least they express written permission.
If this is widely deployed the malware writers will just change tactics. Instead of destroying data completely, they will simply begin alter files to the point where they are no longer useful. The more intelligent and insidious malware writers will gradually introduce more and more errors into databases that make it into backups. Eventually it will be discovered but if an unknown percentage of your database and it's backups contain incorrect information then you are going to have a bad time.
Anons need not reply. Questions end with a question mark.
Deletes checkpoints.
Checkmate.
They should have called it OB1.
These are not the files you're looking for. *waves hand*
(I leave it up to someone else to come up with a good backronym.)
This Space Intentionally Left Blank
... can safeguard data sitting inside a virtual machine
You know what else can safeguard data sitting inside a virtual machine?
Backups. Snapshots. Checkpoints.
Unfortunately, this new technique is still vulnerable to Cryptographic Core Computing Processing Overload.
#DeleteFacebook
New R2D2 Technique Protects Files
1) copy files onto data disk
2) insert data disk into astro-mech droid
3) insert astro-mech droid into escape pod
4) jettison escape pod from ship
They built a component to automatically take a snapshot when it detects I/O patterns that resemble a wipe, to try to reduce the window of time between last snapshot and wrecked data. That's it. It's a supplement to scheduled snapshots, backups and so forth.
How about extending this to work against ransomware?
Backup comes with data loss; any writes made after backup started are not recoverable. There are other products in the data protection platform that do protect against this and many other problems. A VMM that uses VMI to journal every single IO in a log. Roll forward or backward down to the block by block transaction. Less intrusive than R2D2, but consumes far more storage. That's not theory, EMC's RecoverPoint software does this and I first learned about that 2 years ago.
Backup comes with data loss; any writes made after backup started are not recoverable.
Non-issue. I perform two backups per day. If something happens, we're only out half a day's work max.
Is it called R2D2 because the normal case of secure delete the system admins say "What the bleep-bloop have you bleepy-blarp done? You stupid bloopy-blip!!" ?
-- If at first you don't succeed, lie!
setup frequent snapshots (so you can roll back to before the moment the wiper wiped) and be done with it.
>R2D2 supports 13 known "secure delete" methods that apps and malware are known to use
thank god I only use programs.
You can take them all day, and do incremetal backups that way too.
E.g. on Linux, you could create a snapshot before and after every sudo. Or on certain program launches/exits in general. And on certain file system accesses. (Linux jas built-in APIs for that too nowadays.) Plus hourly ones.
I wonder why file systems don't have built-in version control anyway.
... when described that way.
Although not newsworthy.
Just a feature I would expect my distribution to have by default, or as a feature you can enable in your file system.
Remember when we were promised a database as a filesystem with built in version control.
New Jar Jar Malware will address this issue.
Also, most (all?) backup software already addresses the problem that R2D2 does, in a much less complicated way. First, there's generational backups, if your data gets cryptolockered or whatever you just go back to the pre-encrypted form. Secondly, some backups will detect major changes to a file, e.g. due to overwrite or encryption, and save an alternative copy of the unchanged data in case the major change was caused by malware.
So it's really an idea that's (1) not new by a long shot and (2) not very useful compared to the alternatives.
3 copies
2 locations
1 off-site
New R2D2 Technique Protects Flies Against Windshield Wipers?