Automatically Backup Module against Ransomware Attack

下载 0

圆圆

发布于

2229

人观看

#信息技术

Automatically Backup Module against Ransomware Attack (Kazuki Omo) - Ransomware attack is on-going nowadays, and lots of user is having trouble in Critical infrastructure. Not only Windows, but also Linux is facing from Ransomware threat. In Enterprise system, Linux is used as File Sharing server and facing Ransomware threat through NFS / Windows CIFS, and so on. In this presentation, Kazuki Omo will suggest several way to protect important file from Ransomware with developed Linux Security Module, and demonstrate it.

展开查看详情

3 . Who am I? ● Security Researcher/Engineer (18 years) ● SELinux/MAC Evangelist (14 years) ● Antivirus Engineer (3 years) ● SIEM Engineer (3 years) ● CISSP (#366942) ● 120kg Bench Press Max ● Member of Secure OSS-Sig © SIOS Technology, Inc. All rights Reserved. 3

5 . What is Ransomware? Ransomware [TrendMicro definition] Ransomware is a type of malware that prevents or limits users from accessing their system, either by locking the system's screen or by locking the users' files unless a ransom is paid. (Ref: https://www.trendmicro.com/vinfo/us/security/definition/ransomware) © SIOS Technology, Inc. All rights Reserved. 5

14 . Client Side: How Ransomware work (from Client Side). Encrypt Write Delete File Encrypted File Original file - Choose target file - Write Encrypted file • Request to Delete file. Client - Encrypt file © SIOS Technology, Inc. All rights Reserved.

15 . File Server: How Ransomware work (from File Server). Encrypt Write Delete File Encrypted File Original file - Choose target file - Write Encrypted file • Request to Delete file. Client - Encrypt file • sys_open/sys_read • Write some file • Delete file on shared File through smbd etc. on shared volume Volume through smbd. Server through smbd. • sys_close to target file(?) © SIOS Technology, Inc. All rights Reserved.

16 . File Server: How Ransomware work (from File Server). Encrypt Write Delete File Encrypted File Original file - Choose target file - Write Encrypted file • Request to Delete file. Client - Encrypt file • sys_open/sys_read • Write some file • Delete file on shared File through smbd etc. on shared volume Volume through smbd. Server through smbd. • sys_close to target file(?) Usual behavior as File Server. © SIOS Technology, Inc. All rights Reserved.

17 . File Server Side: “Prepare for Ransomware” (From Server point of view) - Fight with Ransomware (AntiVirus, etc.) → Difficult - Prepare a way to restore the file. → Take Backup. © SIOS Technology, Inc. All rights Reserved.

18 . File Server: So, How we can do? Encrypt Write Delete File Encrypted File Original file - Choose target file - Write Encrypted file • Request to Delete file. Client - Encrypt file • sys_open/sys_read • Write unknown file • Delete file on shared File through smbd etc. on shared volume Volume through smbd. Server through smbd. • sys_close to target file(?) Let’s think about here. © SIOS Technology, Inc. All rights Reserved.

19 . Linux+Samba Config Recycle bin on Samba 3/4. “vfs objects = recycle” to enable Recycle bin. [Share] comment = Public Stuf path = /Share/ browseable = yes writable = yes printable = no vfs objects = recycle guest ok = yes read only = no recycle:repository = .recycle recycle:keeptree = yes © SIOS Technology, Inc. All rights Reserved.

20 . Linux+Samba Config Recycle bin on Samba 3/4. “vfs objects = recycle” to enable Recycle bin. [Share] comment = Public Stuf path = /Share/ browseable = yes writable = yes printable = no vfs objects = recycle guest ok = yes read only = no .recycle/ recycle:repository = .recycle recycle:keeptree = yes © SIOS Technology, Inc. All rights Reserved.

21 . How about Modify? What about “Modify”, not “Delete”? Encrypt Write Delete Client Modify File Encrypted File Original file - Choose target file - Write Encrypted file • Request to Delete file. - Encrypt file • sys_open/sys_read • Write unknown file • Delete Client Modify file on File through smbd etc. on shared volume shared Volume through smbd. through smbd. Server • sys_close to target file(?) What about this situation? © SIOS Technology, Inc. All rights Reserved.

23 . From File Server: PC/User Kernel User System Call fopen() sys_open() fread() sys_read() fwrite() sys_write() Server: Can’t find User or Ransomware!! © SIOS Technology, Inc. All rights Reserved. 23

25 . From File Server: (fanotify solution) PC/User Create backup “before writing” by using Fanotify/inotify Kernel User SystemCall FAN_MODIFY FAN_CLOSE_WRITE fopen() FAN_CLOSE_NOWRITE sys_open() fread() sys_read() fwrite() sys_write() Fanotify is hooking“after writing”. - > Can’t take backup “before writing”. © SIOS Technology, Inc. All rights Reserved. 25

26 . From File Server: (LSM solution) PC/User Create backup “before writing” by using LSM. User Kernel System Call file_backup(LSM) fopen() sys_open() fread() sys_read() fwrite() sys_write() Backup © SIOS Technology, Inc. All rights Reserved. 26

27 . From File Server: (LSM solution) PC/User Performance….. User Kernel System Call file_backup(LSM) fopen() sys_open() fread() sys_read() fwrite() sys_write() Backup © SIOS Technology, Inc. All rights Reserved. 27

28 . From File Server: (LSM solution) PC/User Limit to backup “Labeled” file. User Kernel System Call file_backup(LSM) fopen() sys_open() fread() sys_read() fwrite() sys_write() Backup © SIOS Technology, Inc. All rights Reserved. 28

29 . File Label user@local:~/testdir$ ls -lh total 4.0K -rw-r--r-- 1 user user 148 Jun 1 10:43 h123 user@local:~/testdir$ getfattr h123 # file: h123 user.backup_label user@local:~/testdir$ © SIOS Technology, Inc. All rights Reserved. 29

4点赞

1收藏

0下载