Hacker News Reader

If you're a Windows programmer, might be a good idea to write a Windows Service that watches for drive encryption. Then you could stop it before it does anything. For now, I think most of the methods are known, so they are easy to watch for.

View on HN

That's the sort of thing that should already exist in anti-virus software or host intrusion detection systems. I presume that the university wasn't running such software, or that it didn't work correctly, or that the ransomware was smart enough to bypass it.

IMO, Micro$oft can gain a huge amount of positive press/PR as well as user-love by integrating a defense/protection mechanism right into the OS.

The moment Microsoft try to be proactive and integrate a defence mechanism I would suspect people would then try to hold them liable if another ransomware attack succeeded.

Microsoft could do without the overhead, or the headache, and so despite the PR upside it's probably not worth their effort.

Might be an opportunity for an ISV to make a utility though?

The same logic could be applied to their built-in anti-malware software (Windows Defender), so I don't think that's what's stopping them.

Reply on news.ycombinator.com