0

Today I've had an unpleasant accident at work, one of the users downloaded something infected by Eight ransomware on their Windows computer. Worst part is it encrypted some of the files on the drives mounted on (Linux) fileserver.

Of course I recovered those files from backup, but still, I would like to have something that detects files encrypted by ransomware (not ransomware itself).

Is there any software that I can use to scan files on Linux that would tell me that?

  • no. unless the ransomware uses some special name pattern, or common file formats that the file command can recognize. Try running file through some of them, or open them with a hex editor – phuclv Apr 3 at 13:17
1

You could write a script which runs file --mime-type -b filenamegoeshere on all files in the system and if it ever changes for a file then you could immediately suspect encryption.

I believe you'd need to tell the file command not to use the file extension as part of its consideration. If there's no easy way to do that, you could have it temporarily copy each file to a RAM-based drive (or regular hard drive though beware of SSD endurance) and remove the file extension and then run it on there.

Another approach which only works with files which are already uncompressed and unencrypted is to have a script which scans the system and logs the entropy of each file, and if it ever increases more than a certain amount for a file, then raise an alert. One way you can do this is to try compressing each file and see how much the size goes down to (have the output of gzip be sent to stdout which you pipe to wc).

| improve this answer | |
  • Very neat idea, thank you! (yes yes I should not be writing this) – LetMeSOThat4U Apr 7 at 13:39
  • Question: what's wz? I searched through apt packages for this file pattern but can't seem to find anything sensible. – LetMeSOThat4U Apr 7 at 13:43
  • @LetMeSOThat4U Meant to type wc - i.e. to get count of characters – g491 Apr 7 at 16:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.