<story><title>New Mac ransomware spreading through piracy</title><url>https://blog.malwarebytes.com/mac/2020/06/new-mac-ransomware-spreading-through-piracy/</url></story><parent_chain><item><author>b212</author><text>Apple puts so much pressure on security, shouldn&amp;#x27;t it be possible to block ransomware somehow on the OS level, possibly on all platforms?&lt;p&gt;I mean not many apps need to modify millions of files on all drives including network drives and dongles... It should be fairly easy to spot, something like:&lt;p&gt;1. If xxx wants to modify more than 50 files in 24 hours go to 2.&lt;p&gt;2. If some of the files were modified more than a week ago or if the files are in directories across multiple drives go to 3.&lt;p&gt;3. If some of the files are images&amp;#x2F;documents it&amp;#x27;s a no go, prompt user to accept and list the affected files.&lt;p&gt;I&amp;#x27;d love something like this for my Synology, it&amp;#x27;s connected to my Macbook as a network drive and I store my backups there, if anything modifies these files without my knowledge I&amp;#x27;m doomed. I need to access some of my backups on daily basis so it&amp;#x27;s kinda hard to disconnect te drive all the time :&amp;#x2F;</text></item></parent_chain><comment><author>aj3</author><text>Windows 10 has just what you describe: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.bleepingcomputer.com&amp;#x2F;news&amp;#x2F;microsoft&amp;#x2F;how-to-enable-ransomware-protection-in-windows-10&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.bleepingcomputer.com&amp;#x2F;news&amp;#x2F;microsoft&amp;#x2F;how-to-enabl...&lt;/a&gt;&lt;p&gt;Of course, bad guys still can 1) create encrypted copy and delete originals instead of modifying files in place; 2) disable protection alongside with A&amp;#x2F;V and proceed as usual; and my favorite 3) rely on built-in disk encryption mechanisms and simply overwrite encryption keys &amp;amp; salts.</text></comment>
<story><title>New Mac ransomware spreading through piracy</title><url>https://blog.malwarebytes.com/mac/2020/06/new-mac-ransomware-spreading-through-piracy/</url></story><parent_chain><item><author>b212</author><text>Apple puts so much pressure on security, shouldn&amp;#x27;t it be possible to block ransomware somehow on the OS level, possibly on all platforms?&lt;p&gt;I mean not many apps need to modify millions of files on all drives including network drives and dongles... It should be fairly easy to spot, something like:&lt;p&gt;1. If xxx wants to modify more than 50 files in 24 hours go to 2.&lt;p&gt;2. If some of the files were modified more than a week ago or if the files are in directories across multiple drives go to 3.&lt;p&gt;3. If some of the files are images&amp;#x2F;documents it&amp;#x27;s a no go, prompt user to accept and list the affected files.&lt;p&gt;I&amp;#x27;d love something like this for my Synology, it&amp;#x27;s connected to my Macbook as a network drive and I store my backups there, if anything modifies these files without my knowledge I&amp;#x27;m doomed. I need to access some of my backups on daily basis so it&amp;#x27;s kinda hard to disconnect te drive all the time :&amp;#x2F;</text></item></parent_chain><comment><author>robert_g</author><text>Just quickly thinking of where there might be a lot of images&amp;#x2F;documents modified quickly: web browser cache, photo management software, antivirus software.&lt;p&gt;I think it&amp;#x27;d be easier to isolate applications and data like Cubes OS instead of trying to create a universal rule set.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.qubes-os.org&amp;#x2F;intro&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.qubes-os.org&amp;#x2F;intro&amp;#x2F;&lt;/a&gt;</text></comment>