Slashdot Mirror
New R2D2 Technique Protects Files Against Wiper Malware, Secure Delete Apps (bleepingcomputer.com)
An anonymous reader writes: Purdue University scientists have developed a data protection technique called Reactive Redundancy for Data Destruction (R2D2) that can safeguard data sitting inside a virtual machine from modern data-wiping malware and even some secure file deletion methods. The technique was developed to protect enterprise systems, which are often running inside VMs.
Researchers say the new technique was successful in preventing wiper malware such as Shamoon (v1 and v2), StoneDrill, and Destover from deleting data during their experiments, but it was able to prevent data deletion attempted with legitimate "secure delete" applications. When such operations are detected, R2D2 runs each one through a series of policies that evaluate the operation for known destructive patterns. If the scan triggers a warning, the VM creates a temporary checkpoint that a human operator can use as a system restore point.
Researchers say the new technique was successful in preventing wiper malware such as Shamoon (v1 and v2), StoneDrill, and Destover from deleting data during their experiments, but it was able to prevent data deletion attempted with legitimate "secure delete" applications. When such operations are detected, R2D2 runs each one through a series of policies that evaluate the operation for known destructive patterns. If the scan triggers a warning, the VM creates a temporary checkpoint that a human operator can use as a system restore point.
You need three CPUs to run it properly!
Ezekiel 23:20
This sounds like virus scanning, but for file operations. Terrible idea.
I have an even better method for protecting files against deletion. One that is proven and robust. It's called a "backup".
Or at least issued a DMCA Takedown Notice, for daring to use 'R2D2' without paying royalties, or at least they express written permission.
If this is widely deployed the malware writers will just change tactics. Instead of destroying data completely, they will simply begin alter files to the point where they are no longer useful. The more intelligent and insidious malware writers will gradually introduce more and more errors into databases that make it into backups. Eventually it will be discovered but if an unknown percentage of your database and it's backups contain incorrect information then you are going to have a bad time.
Anons need not reply. Questions end with a question mark.
Hey, it was tested in a Windows 7 VM, so it ought to work everywhere!
Right?
Hello City of Atlanta? Oh, the city's on hold? Oh. Gosh.
---- Teach Peace. It's Cheaper Than War.
They should have called it OB1.
These are not the files you're looking for. *waves hand*
(I leave it up to someone else to come up with a good backronym.)
This Space Intentionally Left Blank
... can safeguard data sitting inside a virtual machine
You know what else can safeguard data sitting inside a virtual machine?
Backups. Snapshots. Checkpoints.
Unfortunately, this new technique is still vulnerable to Cryptographic Core Computing Processing Overload.
#DeleteFacebook
They built a component to automatically take a snapshot when it detects I/O patterns that resemble a wipe, to try to reduce the window of time between last snapshot and wrecked data. That's it. It's a supplement to scheduled snapshots, backups and so forth.
Is it called R2D2 because the normal case of secure delete the system admins say "What the bleep-bloop have you bleepy-blarp done? You stupid bloopy-blip!!" ?
-- If at first you don't succeed, lie!
>R2D2 supports 13 known "secure delete" methods that apps and malware are known to use
thank god I only use programs.
You can take them all day, and do incremetal backups that way too.
E.g. on Linux, you could create a snapshot before and after every sudo. Or on certain program launches/exits in general. And on certain file system accesses. (Linux jas built-in APIs for that too nowadays.) Plus hourly ones.
I wonder why file systems don't have built-in version control anyway.
Also, most (all?) backup software already addresses the problem that R2D2 does, in a much less complicated way. First, there's generational backups, if your data gets cryptolockered or whatever you just go back to the pre-encrypted form. Secondly, some backups will detect major changes to a file, e.g. due to overwrite or encryption, and save an alternative copy of the unchanged data in case the major change was caused by malware.
So it's really an idea that's (1) not new by a long shot and (2) not very useful compared to the alternatives.