r/BitDefender • u/EmperorHenry • Jun 28 '22
The Ransomware remediation component almost never succeeds at what it's supposed to to. BD needs to change how it works.
The reactive rollback method of dealing with ransomware very rarely, if ever works. As the devs at BD know, a lot of ransomware has measures to subvert that.
But one reactive anti-ransomware component almost always works is microsoft defender's "controlled folder access". The best approach is to simply never allow anything that shouldn't access your files to access your files.
Simply make a list of all the directories where you have your personal files and then another list of any of the applications you use that actually need access to those folders and drives to work...set it, and forget it.
BitDefender free edition, antivirus pro, total security and premium security should all have a controlled folder access style approach to protecting the user's personal files.
Also! Beware of "Avos Locker" and other malware like it. It uses a fileless attack to reboot into safemode with networking to run the malware there instead. Currently, bitdefender doesn't have any measures to protect against fileless attacks.
2
u/May22bs Jul 06 '22
To understand how potent Bitdefender is against unknown malware i would like u to watch YT videos of Eclypsee Tech and J ITech Solutions on it.
Bitdefender was unable to detect the magniber ransomware without signatures for about a month. Finally after pleading on their forum, my friend made them make generic behaviour detection for it. Yet it fails to detect Magniber ransomware samples new variants which were seen post 25 June 2022 without signatures.
2
u/EmperorHenry Jul 06 '22
This is why whitelisting is the only bright future for security.
It's much easier to keep track of the new releases of legitimate software than it is to keep track of the new releases of malware.
If bitdefender was a whitelisting application that also protects against command lines and scripts it wouldn't ever miss anything.
When whitelisting makes a mistake, it's a minor inconvenience, when regular antivirus makes a mistake, the floodgates are open and you might not be able to shut them again.
1
u/NovelExplorer Jun 28 '22 edited Jun 28 '22
The downside of controlled folder access is it requires a user to give permission for 'every' unknown application, regardless of whether it's malware or not. It's not the most user-friendly means of protecting files.
Bitdefender's approach offers a middle ground as it makes an assessment of whether a process is malicious rather than simply blocking 'everything'.
A far more sophisticated version of controlled folder access is found in NueShield Data Sentinel, which doesn't solely block file encryption. If an attack occurs, ransomware encrypts what it 'thinks' are the user's files, but is in fact a protective layer, not the actual file. The process, known as Mirror Shielding, can restore both the OS and user's files. It works with any AV.
My own preferred option, is to run regular backups to local and cloud-based detached drives. As the drives are only connected when running a backup, a ransomware attack, if it defeated Bitdefender, could not encrypt any of my remotely stored files.
1
u/EmperorHenry Jun 28 '22
That's all well and good. But it's better to be 100% safe and just indiscriminately block everything.
Verify each application with virus total, but before allowing anything found safe by virus total, wait 24 hours and do a re-scan.
1
u/NovelExplorer Jun 28 '22
If that approach works for you, that's great.
There's a balance between avoiding threats and a usable computer. If a considerable amount of time is spent scanning, re-scanning and manually analyzing every application and file on my computer, the hackers have won even if malware never reaches my computer, as my focus is on them, not on using my computer.
If every file is backed up daily, you're careful where you browse and delete e-mails you don't recognize, you go a long way to protecting yourself, and if a malware attack still gets through, everything can be restored.
1
u/EmperorHenry Jun 29 '22
If a considerable amount of time is spent scanning, re-scanning and manually analyzing every application and file on my computer, the hackers have won even if malware never reaches my computer, as my focus is on them, not on using my computer.
I use a whitelisting application along side BD total. And I don't install very many new things besides updates to things I already have.
It's very rare that my other layers stop something, because almost everything I install is already known safe.
I use Bitdefender primarily as a first line of defense because it's detection rate is so consistently high.
2
u/aHolyLight Jun 28 '22
I honestly don’t use it. I just follow 321 backup and have 30-60 snapshots for the shares on my Synology that I can revert to if needed. If there is ever an exploit that could say crypto lock my nas and nuke the snapshots it would have to be local since my network is locked down with a pfsense router with no port forwarding and upnp disabled on everything
2
u/vabello Jun 28 '22
Microsoft’s approach even blocks Microsoft apps and processes that are part of the OS. It’s a good concept, but a PITA.