Fighting Ransomware with Guided Undo: Nextcloud in research protecting users

Post date

August 6, 2018

Research into ransomware

At the University, student Matthias Held, under supervision of professor Marcel Waldvogel, researched the behavior of Ransomware, aiming to answer the question: what would the most efficient ransomware look like? What would it do to extract maximum revenue from its victims?

Dissecting many known Ransomware tools revealed most are far from efficient, wasting time with double file writes or ineffective algorithms. The team decided to find out what the ideal way was to recover data from a theoretically very efficient piece of ransomware. A key finding was that, at its essence, Ransomware is simpler than normal malware. It only deals with making data inaccessible. It does not prevent usage of the rest of the computer, so users have avenues to recover their data. The team looked to exploit this fact.

Backups won’t do

Backups, on an attached drive to the computer, are not sufficient, as smart malware has the opportunity to damage backups when the drive is attached. A solution has to come from a hardware limitation to that, or perhaps a separate machine, not affected by the attack. The team looked at various potential mitigations including hardware solutions in the USB cable connecting a backup drive and file system snapshot technologies. At one point they realized that the Nextcloud server, used at the University (which is a customer of Nextcloud GmbH), qualifies as a second machine with a separate risk profile and already provides a file snapshot technology. The Trash feature in Nextcloud allow users to recover deleted files while the Versioning feature lets users bring back earlier versions of files.

Detection of suspicious files

Developing a Nextcloud app

With Nextcloud offering a flexible app architecture and the basic functionality of Trash and Versioning already available, the team started developing a solution that followed the results of their research. Essentially, their application tries to separate between ransomware actions and user actions to make rollback easier.

Their full paper details various elements of the solution: files would be examined and a Shannon entropy measure would determine whether the file is likely to be encrypted. Their implementation is clever in separating compressed data from encrypted files. Other important metrics include the number of files uploaded in over a short time period, or if lots of files with unknown extensions show up. The app closely looks at sync steps and tries to identify when a large number of files is being changed in a suspicious way.

When the user discovers their data has been taken ransom, they can visit the Ransomware Detection app and use its graphical user interface as a guide to recover their data. The likely candidates for recovery can be spotted and selected with the help of the the color guidance. Additionally, there is the option to add or remove entries from this recovery list. Of course users can also go over files one-by-one, but in tested scenarios the guided undo process significantly simplified and sped up the recovery process. Of course, if anything too little or too much has been rolled back in a first attempt, this can always be corrected later, as the Ransomware detection app simply makes use of the services of the existing Versions and Trash apps in Nextcloud.

When the user discovers their data has been taken ransom, they can visit the Ransomware Detection app and use its graphical user interface as a guide to recover their data. Of course users can also go over files one-by-one, but in tested scenarios the guided undo process simplified and sped up the recovery process significantly.

Recovery in action

A complementary solution

An interesting aspect of their approach is that it is complementary to the Nextcloud Ransomware protection app. The existing app warns users on possible infection while the new app provides recovery of data after the fact. The researchers even suspect much of the benefits of the app could be had even if the user does not have it installed. Once an attack has taken place, the user can install the app and use it to analyze the existing file versions on the server. A possible future update to the app would determine the likely point where infection took place and guide the user through the recovery.

The app uses some server resources, the team estimates this to be at about a 20-30% overhead on file upload, mostly caused by the Entropy Analysis. As large Nextcloud customers like the TU Berlin have shown that file upload makes up for far less than 10% of the load on a Nextcloud server, this makes for a reasonable trade off. The team does believe it is possible to delay the calculations to nightly cron jobs or even at the moment the user needs the data, however, with the limited performance impact, they don’t see this as a priority.

Another venue for improvement is to integrate deeper with the Nextcloud versioning system, which automatically clears data it no longer deems needed. Assigning higher priority to files likely modified just before potential malicious activity, the app could decrease the amount of data lost by a ransomware attack.

Presented soon, available now

At the upcoming Norwegian Information Security Conference (NISK 2018), the team will present their paper “Fighting Ransomware with Guided Undo”. You can read an abstract and download the full paper on Netfuture.ch.

The Nextcloud app is already available in the Nextcloud app store, still in testing by the team.

The results of the research and the Nextcloud Ransomware Detection app are scheduled to be presented also at the upcoming Nextcloud Conference in August in Berlin, Germany.