The Frightening Power of Ransomware Done Right
nautil.us
nautil.us
> As a copy-on-write file system, OpenZFS provides efficient and consistent snapshots of your data at any given point in time. Each snapshot only includes the precise delta of changes between any two points in time and can be cloned to provide writable copies of any previous state without losing the original copy. Snapshots also provide the basis of OpenZFS replication or backing up of your data to local and remote systems. Because an OpenZFS snapshot takes place at the block level of the file system, it is immune to any file-level encryption by ransomware that occurs over it. A carefully-planned snapshot, replication, retention, and restoration strategy can provide the low-level isolation you need to enable your storage infrastructure to quickly recover from ransomware attacks.
I guess because of this you see "protect yourself from ransomware attack" guides recommending keeping your backup drive/filesystem attached for as short a period as possible. But even then you're left hoping that the ransomware doesn't encrypt your backups first - perhaps because it's smart enough to - or that it doesn't get too many of them before you notice the infection.
I wish all backup software would avoid making the remote filesystem available system-wide and raise the bar by requiring ransomware to know how to extract access to the remote filesystem from the particular backup software you're using before it could encrypt your backups. Unfortunately, as far as I could tell last time I looked this issue seems to be ignored by backup software vendors.
Where I have implemented it, the only access the production system has to the backup system is to connect to an ssh server with a private key, and shove a tar down the pipe, which the backup system then squirrels away somewhere safe. This is a push configuration, but it's a safe one - the backup system doesn't have access to the production system either, and the production system cannot overwrite/delete any data on the backup system.
See also: There is no stable ZFS implementation for Windows as of right now, and the implementation for macOS (while surprisingly painless in general) requires at least some command line use to set up.
If anyone actually develops a ZFS implementation designed for average users, I would agree that it should include automated backups by default.
It certainly should help against ransomware in that an admin who was investigating an unexpectedly full disk, who's hopefully aware of such things, would probably notice that all the files on the drive were no longer readable and all had recent modification timestamps. And that's if a user doesn't happen to notice it first and report issues with their files to IT.
As long as those snapshots last more than a few days as to provide sufficient time to catch and investigate the issue, ransomware damage is usually revertable much faster than backups with simple snapshots.
I don't know about this specific system, but typical behaviour of NILFS (a continuously shapshotting log file system) is to report the filesystem as full, requiring manual intervention or waiting until the data ages-out and gets garbage collected.
Sort of. The data corruption part yes, that's a core transparent part of the filesystem as it should be. But for ransomware ZFS only provides helpful tools for doing so, it's not designed around that specifically (though it could provide the foundation for something that was). Very low cost atomic snapshots and ease of replication definitely can help if they're used, particularly combined with ZFS permission delegation system. You can set a user to have snapshotting permissions separately from permission to destroy snapshots, as well as rollbacks, sends, etc. Of course that won't help if ransomware gets root (unless in turn the storage has hardware separation, loaded over a NAS say), but it's still quite handy.
It would be interesting actually if ZFS had some limited active content monitoring capabilities, such as detecting changes in entropy or a sudden massive spike in snapshot delta size (indicating everything in the file system had been touched). At any rate though note the "a carefully planned" bit there, ZFS is a fantastic foundation for a better data protection system and makes it easier to do well. But it's not install-and-forget by itself either right now, though someone could build something on top if they wanted to (or maybe already has? it has been a while since I surveyed ZnapZend and the like).
I'm not sure he cared about being discovered given this information..."Bogachev lives in the resort town of Anapa on the Black Sea, where Russian officials have declined for years to arrest him or extradite him to the United States. In fact, the Russian government has benefited from his criminal activity."
Friends in high places never hurts, especially if they are corrupt. He basically gets to live life like a Bond villain so I'm reasonably confident he never intended to hide his name or activity for the long haul.
If I were him (and also had no morals) I'd probably be pretty happy with my life.
† Note, "not many" ≠ zero. I realize this would sometimes result in false positives, but I imagine the trade-off would be worthwhile, especially if the protection was user controlled.
He gave a lecture about it in one of the classes I followed at one point.
Wouldn't there be a seed on each infected machine used to determine the current C&C domains to use? Why couldn't we predict them?
>The FBI worked with a number of security researchers to reverse engineer the DGA and figure out how it generated the list of domain names it provided to the infected computers every week. That way, the FBI would know which thousand domains were being selected every week in advance. Then, right before the takedown, they acquired a temporary restraining order that required domain registries in the U.S. to redirect any attempts to contact those thousand domains to a substitute, government-run server.
So the answer is, yes, there was a way, and so eventually that's what law enforcement did.
From the article: "on July 11, 2014, the Justice Department reported that the number of computers infected with GOZ malware had been reduced by 31 percent thanks to law enforcement intervention."
Also they were blocking the autogenerated domains on a weekly basis, but that would only work if the infected machine was in the US I believe.
It's a shame the Russians aren't a little more cooperative with stopping this kind of stuff.
If there is any criminal organization powerful enough in Russia, and their leaders haven't been assassinated or imprisoned, it's safe to assume they work closely with the government.
It would have to be for crimes defined in Russian law, but yes.
As a hypothetical, I wonder whether the US could carry out a private prosecution in Russia under Russian law.