[Test failed] Does the Active Protection really work?

Kees...did you run the tests without the white list additions?  If so, what were the results?

Quote: 'Needless to say that it's quite easy to put the exclusion in the whitelist by some hacker....'

Kees,  I disagree with your assertion.  I believe that it would be very easy for Acronis to keep the exclusion list from being hacked undetected...through permissions and encryption. 

Kees,  Whitelisting is different from file/folder exclusion listing.  When you ran your test, did AAP identify the process as suspicious or unknown?  Did the test run without intervention from AAP or did you have to approve the process?

Also, I have attached 2 files below.  The unencrypted file would be file/folder exclusions so that I can delete log files without having to turn off AAP.  The encrypted file is the same data encrypted.  How would a hacker change the data in the encrypted file so when it is unencrypted it reads c:\  and *.* ?

I think it would be impossible.

Hi FtrPilot

I did run it without the exclusion, and all bells went off.

With a simple *.* exclusion it doesnt work as the report says.

The test is a much used simulator, used in professional environments.

I didnt approve the test in AAP. It just ran as-is. With a standard installation of ati2018.

And I am convinced that it is easy for an hacker to add it in that list.

I do not have to explain that hackers laugh about permissions.

But lets stay with the claim that was made in the other thread.

When you exclude programs, it is NOT detected.

So it's easy to make a payload on a process with the same name, and voila :  the damage is done.

And that is the weak part that I claim.

So the bad advise is the exclusion list.

Regards

Kees

Kees, obvious question here, but have you raised a Support Case for this issue?  I am not qualified to judge whether your results reflect a real vulnerability with AAP as they appear to show.  But you have raised a serious security concern here and I would like to see the response from Acronis to this concern.

I will consider that.

But I raised a call for the slowing down of apps by AAP.

After expressing my disappointment HERE of not reacting, within the hour they contacted me.

I delivered a lot of logs, which is a lot of work, and asked to confirm my answers.

That has been a week now. NO reaction at all. So I expect a call soon :)

So I think they already know. I will not put more effort in that AAP as for me it's an immature product, launched to soon for commercial purposes.

The cynism of the whole story: I went to 2018 from 2014 for the same reasons a lot of people do : keeping up.

Why? Because I think Acronis is a great value for backup up and I am a fan for that.

But I payed for an upgrade that could be cheaper for me, because the AAP that I got, I never wanted and it backfires me (slow, and the exclusion table is a farce).

Maybe Acronis should have stayed in the backup business and let the security to other companies......

Regards,

Kees

Kees, thanks for the update / further information on your interaction with Acronis.

I have just download, installed and given the KnowBe4 RanSim ransomware simulator a run on my Windows 10 system with AAP active and no additional exclusions set.  This generated a lot of AAP pop-up messages for each of the RanSim tests which I took the option to Block, as I would in a real-world scenario.

The end result was that my computer was not vulnerable in 13 out of 13 scenarios.

I am a little puzzled as to why RanSim is suggesting that it found 20527 Exposed files when all vulnerabilities were blocked by AAP using the default settings.

I am not going to add a white list exclusion for *.* as that is not realistic and not something I would ever consider setting, nor would encourage anyone else to do this.  I understand why you have used this for testing in a VM scenario but my test was on my test computer, not a VM.

Kees,

I believe the claim you are referring to was made by Enchantech:

Quote: "You are misinterpreting how Active protection works.  If a ransomware were to spoof itself as a whitelisted legitimate app then subsequently behave in a known ransomware pattern that process would be halted and the user would be notified of the action taken."

Your point, I believe, is that if the user, or a hacker, changes the exclusion list to include c:\ and *.* then AAP does not stop the process.  I certainly agree that a user can disable AAP by putting c:\ and *.* in the exclusion list.  I strongly disagree that a hacker can make changes to the exclusion list.

I believe that when you ran the simulation without the *.* you actually validated Enchantech's quote.  To run the program, you had to white list it.  After white listing the program, it detected a ransomware pattern and stopped the process.

Changes to the exclusion list is not the same as white listing.  

You have made a very important finding, that I believe should be included in the user manual that : Files/Folders listed in the exclusion list should be specific and wild cards should be minimized.  I also believe that ATI should reject c:\ and *.* if the user enters it and display a warning.

I also believe that there are hackers out there trying to find a way to hack the exclusion list.  And some day, they may actually succeed.  But I hope that Acronis is working on additional safeguards to keep that from happening.

Even with AAP running, I still take other precautions.  I do a weekly off-line backup booting with rescue media.  That backup is not attached to my computer if windows is running.  I do 3 separate daily backups to different accounts on my NAS.  I don't map my NAS shares to drive letters.

Regards,

FtrPilot

I agree Steve.

Mine worked 13/13 too with AAP plain.

The exposure is that it can see/access that much files. Which is not surprising as it runs in your system.

The all  mask *.* shouldnt be used indeed. But files put in the exclusion list are simply replaced with a payload and then not detected. Thats the bottom line.

When makers of ransomware know after some time, what programs are often put in the exclusion list, then the protection has gone.

Hi FtrPilot,

I agree in most.

But the hackers will edit the excl list and if not, after some time, will know what program files will be used often in the exclusion list. So exposed risks there.

I know there is difference between whitelisting and the excl list, but the effect is the same here.....

Hello Kees,

Good investigative work here.  Your example shows that sure, if I the user exclude everything under the sun I open a vulnerability.  So as a ransomware, if I were one, I would first need to take over an authenticated admin user account.  In this case I would take over the system admin user account to gain the most privileges.  Then I would hack into the AAP, alter the exclusion list, and then go after the backup archives.  Possible, sure it is, likely, probably not. 

Like I said earlier, the currently most prolific malware is being delivered by run in RAM payloads.  No need to go through all of the above, just run, take over the system admin account, run PowerShell and have at it.

One of the primary targets of ransomware is the MBR.  I believe it is the number one target myself.  AAP watches for attempted changes to the MBR.  So attempts made to modify the MBR are halted.  That has nothing to do with application processes.  To me this is the real value of AAP.

I do not agree that it is an immature product.  Can it be hacked, disabled, etc.?  Sure, but what app can't?