Experts: Windows Feature Can Be Used as Ransomware

Ransomware attackers could turn a key Windows security tool against the system, according to new research. The tactic could also evade leading security tools.

The research from SafeBreach Labs covered "EFS", otherwise known as Encrypting File System. EFS was released as far back as Windows 2000 (in the year 2000), and is somewhat similar to Bitlocker. The main difference between the two is that Bitlocker can encrypt an entire volume, while EFS can encrypt individual files and folders.

In either case, the reason for encrypting files / folders or an entire volume is that if an attacker gained physical access to a hard drive, they would not be able to decrypt the files without a password.

Hacker Could Encrypt With Own Key

EFS uses part of the Windows login to encrypt the files in order to produce a "key" for the encryption. SafeBreach says that there's a significant flaw in how this works.

Through proof of concept, SafeBreach discovered that an attacker could effectively produce their own security key and use it to remotely force the computer to encrypt all its files through EFS using that key. The attacker would then delete the key.

This would mean that the legitimate user's login details and associated key would no longer unlock the EFS-encrypted files. The security benefits of EFS would now be turned against the legitimate user, who could then be hit with a ransomware note, demanding payment to restore access. If the user did pay up, the attacker could (if they stuck to the 'deal') use their key to decrypt the files.

The researchers also found that three leading security tools that claim to combat ransomware were unable to protect against such an attack. (Source: theregister.co.uk)

Microsoft Not Planning Update

SafeBreach says it contacted Microsoft and a range of security software manufacturers to give them a chance to tackle the problem before it went public and risked tipping off attackers. Most of the security software makers have updated their products or are in the process of doing so.

Microsoft says that they "... assessed this submittal to be a moderate class defense in depth issue, which does not meet the Microsoft Security Servicing Criteria for Windows." They went on to say that the topic may be addressed in a future product. (Source: safebreach.com)

What's Your Opinion?

Are you surprised nobody thought of this tactic before? Should the researchers have gone public at all or restricted their findings to security professionals? Is this risk still worthwhile for the benefits encryption brings to PC owners?