Ransomware: Anti-virus unable to detect it

[MalwareGuy]

https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=9186656#abc

[phendrenad2]

Interesting. You still need to download the ransomware file encryption program, which is something users aren't likely to have, and would quickly be detected everywhere once a few people report it. Normal compression programs have limits and wouldn't continue working after the user reboots etc.

[pdenton → phendrenad2]

Yes, but if the user is able to add exceptions to the anti-virus program, the malware would simply automate that.

Things like this are why popular operating systems are increasingly diverting control from the user to their vendor. And frankly I think it's impossible for those vendors to win the arms race TFA refers to.

[tinus_hn → phendrenad2]

Windows includes a full disk encryption system and a file encryption system. All you need to do is steal the key and remove it from the user.

[m-p-3 → tinus_hn]

The ransomware part requires you to have some way of informing the user of the situation, and give them a way to pay the ransom and communicate.

I'd argue the easier part is the encryption, the harder part is the ransom delivery and file decryption automation.

[tinus_hn → m-p-3]

Showing a pop-up isn’t a malware specific action and ransom delivery and decryption doesn’t need to be automated. Why wouldn’t an attacker be able to send the user the key and some instructions? And a lot of ransomware already just shows a Bitcoin address and a message telling the user to send money himself.

[m-p-3]

Can we add [PDF] in the title?