• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 659
  • Last Modified:


Hi Experts

Hot topic at the moment  I suspect :-)

We are all looking for an effective defense, in a moment of lateral thinking ?

Is there a way (group policy, whatever,etc) to prevent a process trying to encrypt currently unencryted files from being encrypted ?  

If the bad guys cannot achieve this, then there is no ransom?
  • 4
  • 2
  • 2
  • +3
5 Solutions
Nick RhodeIT DirectorCommented:
You could user software restriction policies or an app locker


Decent article about software restriction but it might cause a little bit of a headache for you.  But cryptolocker is a headache itself.
We are using the following:


Direct download link:


This is not a group policy, though you could create a GPO to install it.  Make sure you test it thoroughly on a few computers to make sure it doesn't break anything specific to your environment before you deploy it.
Please do read the article, "CryptoLocker: A particularly pernicious virus." It shows how using Local Security Policy, you can prevent this virus. The article is at:

http://windowssecrets.com/top-story/cryptolocker-a-particularly-pernicious-virus/ >
Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

Giovanni HewardCommented:
Here's a solution which will render Cryptolocker, it's variants, and a majority of all Malware threats inert-- those which do not feature 0-day vm escape exploits anyway (something EMET could possibly mitigate.)


A variant could easily be created which avoids the %appdata% and %LocalAppData% folders altogether, securely deletes/encrypts your shadow volumes, etc.  

While SRP/AppLocker whitelisting is potentially viable, there appears to be trivial bypass techniques a subsequent variant could exploit.

@x66_x72_x65_x65: don't call those techniques trivial - as you could read, applocker is different, it is not, like SRP, controlled in the user space, so the user cannot circumvent it that easy. So applocker is an option if you run win7 ultimate/enterprise or win8 enterprise.

Another option are simple backups. If the data is encrypted, so what? Restore it from backup.
Giovanni HewardCommented:
The context in which I mention "trivial" is relating to a competent malware author, not an end-user or IT professional.  LoadLibraryEx has a feature (LOAD_IGNORE_CODE_AUTHZ_LEVEL) to circumvent SRP and AppLocker.  Used in conjunction with dll hijacking or macro loading-- for example-- it's very possible to create a malicious dll (loaded by a white-listed application, such as Microsoft Office) which bypasses both.

Without the hotfix I referenced above:
...malware in the %TEMP% or %system drive%:\Users directory can be executed by using the SANDBOX_INERT and LOAD_IGNORE_CODE_AUTHZ_LEVEL flags, even if access to these directories is limited by AppLocker rules.

Privilege escalation techniques could also be deployed as needed (KiTrap0D (In Memory/User), etc.)

Don't get me wrong, I'm a defense in depth advocate-- hardening systems, data backup/recovery, business continuity, etc., etc. should all be part of the design.

I'm merely posing the question, which is much more effective and efficient?  

Having an vulnerable applications run in virtual containers which automatically revert to clean states upon infection or deploying human resources for diagnosing, recovering, reimaging, and restoring?

Encrypting documents aside-- Call me eccentric, but I'd rather have malware with remote access/reverse shell firewall extrusion capability (effectively giving the author access to the victims private network) occur in an (isolated network) virtual container, as opposed to my actual network.

My recommendation is a paradigm shift, which by its very nature is destined to be resisted by the archaic paradigms of the day.
> ...to circumvent SRP and AppLocker.
Yes, I read so, but will the authors use it? It would require to trick people into using certain white listed applications and open an attached document that uses that dll trick, that might not even work with any (to-the-author-unknown-) version of (for example) word (if even present) or whatever program.
So applocker poses quite a problem to the authors.
Giovanni HewardCommented:
There are many other examples available.  Consider compromising the white listed applications themselves; a recent example is CVE-2013-3918 (MS13-090).  In this case the end user would need only visit a specially crafted web page to become exploited.  Exploitation could inject its payload directly into the memory space of the white listed application (IE).  The malware authors could also negate the need for initial C&C "phone home" requests (for the public key) by dynamically providing a (pre-generated) key upon introduction of the payload.  This could have the side effect of creating unique code for every payload instance-- which would easily bypass signature based solutions.

Again, I'd personally prefer exploitation to take place in an isolated protected space as opposed to my primary OS and private network.

Such attack vectors may be mitigated against by deploying EMET on all Windows systems.

So I pose the question, what is the wisdom in opposing "DMZ for your endpoint" architectures?  My recommendations are not made lightly.  They are thoroughly researched and proved.  I recommend you research FireEye, Invincea, EMET, and OpenDNS.

but will the authors use it?
Is your organization willing to accept the risk that they (and all other malware authors) won't?
cpmcomputersAuthor Commented:
Thanks for all the feedback
Some practical solutions and some information that made me realise just how little I know about these threats

Been surfing the net for hours following your links :-)
[If] known, no threat.
Unknown, menace.

Giovanni HewardCommented:
Your welcome.  Take a look at the following course syllabus on Securing Windows and Resisting Malware.  Much of the techniques described above are discussed.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 4
  • 2
  • 2
  • +3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now