Cerber Ransomware Creates Self-Inflicted Canary Vaccine

itman · Aug 17, 2017

Interesting article on how to use ransomware against itself. Does show that ransomware developers are actively pursuing ways to bypass the anti-ransomware solutions.

Researchers Say Cerber Ransomware Now Has a Feature to Avoid Triggering "Canary Files"

The concept is very simple. A bogus file designed to look like a prime ransomware target is strategically placed and watched by an anti-ransomware application. There is no valid reason for this file to be encrypted. If the watching anti-ransomware detects any attempt to do so, it knows that ransomware is present and can take the necessary action.

Cybereason researchers have discovered that the Cerber ransomware now includes a new feature to avoid triggering canary files. "To avoid encrypting canary files and triggering antiransomware programs," reports Uri Sternfield, Cybereason's lead researcher, "a new feature in Cerber now searches computers for any image file (.png, .bmp, .tiff, .jpg, etc.) and checks whether they are valid. Image files are commonly used as canary files. If a malformed image is found, Cerber skips the entire directory in which it is located and does not encrypt it."

"While this trick might allow Cerber to evade some canary-file anti-ransomware solutions, it also makes it vulnerable," explains Sternfield; "a user can 'vaccinate' any important directory against Cerber by creating an invalid image file inside it, for example by copying any non-image file to this directory and renaming it to .jpg. Cerber will assume that the file is a canary file installed by an anti-ransomware program on the user's machine and refuse to encrypt it!"
Click to expand...

http://www.securityweek.com/cerber-ransomware-creates-self-inflicted-canary-vaccine

Log in or Sign up

Cerber Ransomware Creates Self-Inflicted Canary Vaccine

itman Registered Member

Log in or Sign up

Cerber Ransomware Creates Self-Inflicted Canary Vaccine

itman Registered Member

Useful Searches