Ransomware: Anti-virus unable to detect it

https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=9186656#abc

by MalwareGuy • 6 years ago

29 6 6 years ago

ieeexplore.ieee.org

Interesting. You still need to download the ransomware file encryption program, which is something users aren't likely to have, and would quickly be detected everywhere once a few people report it. Normal compression programs have limits and wouldn't continue working after the user reboots etc.

pdenton• 6 years ago

Yes, but if the user is able to add exceptions to the anti-virus program, the malware would simply automate that.

Things like this are why popular operating systems are increasingly diverting control from the user to their vendor. And frankly I think it's impossible for those vendors to win the arms race TFA refers to.

tinus_hn2• 6 years ago

Windows includes a full disk encryption system and a file encryption system. All you need to do is steal the key and remove it from the user.

m-p-32• 6 years ago

The ransomware part requires you to have some way of informing the user of the situation, and give them a way to pay the ransom and communicate.

I'd argue the easier part is the encryption, the harder part is the ransom delivery and file decryption automation.

m-p-32• 6 years ago

Can we add [PDF] in the title?

Ransomware: Anti-virus unable to detect it

Related Stories