[Wish] Anti-Ransomware Protection feature (idea)

[RejZoR]

I've got this idea while replying to some other thread on this forum.

avast! has the functionality ALREADY built in, but avast! team isn't using it for reasons absolutely unknown to me.

We know ransomware encrypts files like images and music and forces user to pay for it to unlock.

This could easily be solved by a generic, but highly effective method entirely separate from the regular detection signatures.

All we need for this is:
- HIPS component (which we already have)
- Extensive whitelist (which we already have in Hardened Mode (Aggressive))
- Exclusions menu (to give advanced users some control)

HIPS would track what app tries to access other file for write access and allow or prevent it depending on the status on the whitelist.

If program unrecognized by the whitelist tries to write access .jpg file anywhere on the system disk, it should be blocked and popup presented to the user.

If program is verified by the whitelist, it is allowed to modify the .jpg file silently, meaning nothing would really change for the users.

This way only signature required to be processed and updated is the usual whitelist that avast! already has and maintains and the blacklist of extensions to be protected which could be easily updated via VPS at any time.

avast! team literally just has to chain existing features together to get this functionality and add extra exclusion tab next to existing ones for File System, Hardened Moe and CyberCapture. We could have had anti-ransomware protection months if not a year ago and yet for some reason we don't. Why not?

Why is this not already implemented in avast! ?

[Asyn]

One of the devs said they're working on it, but that was several months ago...

[Staticguy]

In one of the article I have read that when Avast and AVG finally is ONE company, that article also mentioned that Avast will provide protection from ransomware and other features and functions. My best guess is that end of this year/early next year Avast and AVG will have a new brand name (not confirmed yet) they will start having those features

[Rednose]

I am not entirely sure, but I beleve Avast is also using Ransomware blocklists from https://ransomwaretracker.abuse.ch/blocklist

Greetz, Red.

[RejZoR]

One of the devs said they're working on it, but that was several months ago...

Considering everything is already in avast!, this could be done in 1 month time tops. Like a year ago...

[Rednose]

Btw. what is the current status of the HIPS ?
And why is it, as far as I know, still not properly documented by Avast ?

Even some months ago, there was a lot of confusion about it in this topic https://forum.avast.com/index.php?topic=188972.0
See in particular the posts from David and Asyn.

Greetz, Red.

[Be Secure]

Or avast and AVG together makes a dedicated expert team on Ransomware analyst and protection.It is not too hard. what say?

[RejZoR]

Lets just say that's around a year or year and a half too late...

[Lisandro]

Fully agree RejZoR.
Other antiransomwares relay on blocking executables being launched from certain folders, some of them have absolutely no configuration.
There are tons of articles in Avast Blog covering ransomwares blocked by Avast but, indeed, a special protection could make me drop the free  CryptoPrevent.
I could be that other Avast users (at least the advanced ones) will have a dedicated protection against ransomwares.
Thanks for raising this point.

[RejZoR]

avast! isn't striving for that as much as we'd hope for. If ransomware is on the rise now, make sure you add effective method to prevent that asap. Even if it's not 100%, dramatically decreasing those chances is a very desired thing. What good is adding this 1-2 years into the ransomware frenzy? It's pointless and you let down all the users in the meanwhile. The thing is, most other companies that matter have this covered in one or another way. Not avast! for some reason. And it has been like this for quite a while. I have no idea why.

I mean, anyone remembers how certain companies brute forced malware stored in encrypted ZIP archives as e-mail attachments? Or how they went as far to make AV capable of OCR reading the passwords from attached images to unlock those archives? That's dedication I have yet to see from avast!.

I'm just surprised they skipped this capability even though 90% of it is already there, it's just not forming a complete, connected functionality. With all the engineers at avast! and no one even came up with this idea, I don't know...

[REDACTED]

Long overdue need it had to be done. Proactive protection in Avast is easily bypassed a ransomware.

[Pondus]

New ransom sample, AVG got it but not avast

First submission 2016-10-16 00:12:11 UTC ( 2 days, 16 hours ago )
https://virustotal.com/en/file/85da17f723f971c4256752ecaf5e94b1838fe8df190ad5920b1ab4de467a7473/analysis/1476809991/

[DavidR]

New ransom sample, AVG got it but not avast

First submission 2016-10-16 00:12:11 UTC ( 2 days, 16 hours ago )
https://virustotal.com/en/file/85da17f723f971c4256752ecaf5e94b1838fe8df190ad5920b1ab4de467a7473/analysis/1476809991/

The few that did detect anything have a wide variety of detection names. Trend with Ransom_HDDCRYPTOR.F detection is very close, AVG with FileCryptor.NAI is close. The rest are very generic and appear very wide of the mark (for ransomware).

[Pondus]

TrendMicro is always quick with new ransomware, they seem to have a high priority on it, i guess bc they have lots of business customers
They also have one of the best info blogs about ransomware


Anyway, this is the message that popped up on the screen to the one that found the sample above and found out the hard way

“You are Hacked ! H.D.D Encrypted, Contact Us For Decryption Key (w889901665@yandex.com) YOURID: 123152”

[DavidR]

TrendMicro is always quick with new ransomware, they seem to have a high priority on it, i guess bc they have lots of business customers
They also have one of the best info blogs about ransomware


Anyway, this is the message that popped up on the screen to the one that found the sample above and found out the hard way

“You are Hacked ! H.D.D Encrypted, Contact Us For Decryption Key (w889901665@yandex.com) YOURID: 123152”

For me, ransomware and other serious malware/infections really do need the user to have a robust backup and recovery strategy. Relying 100% on your AV and or other malware tools could well come unstuck in the early days of a new variant.

The only real way is hard disk imaging software run at least once a week (and keeping at lease 3 generations of the drive imaging, I keep 6), one that can be restored outside of windows, essentially wiping out the malware infection should you ever get hit.