Does AAP log blocked or questionsd activity?
Today I was doing some tests and FTPed a .tib file onto an AAP-protected PC. (The copy worked without AAP noticing.) I then tried deleting the file and got the expected AAP popup asking if the activity should be allowed. I responded that it could be allowed and, after a couple false tried, deleted the file.
Latter I wanted to see what process was intercepted - a .dll name had been mentioned - and could not find a record of the activity. This surprised me; it seems like important information. Have I just looked in the wrong log files, or is there an option that needs to be set?
As far as I know I looked in all of the log types. (I may have skipped some unlikely ones.) I even looked for log-like files that the Log Viewer doesn't look at. If there is data logged that corresponds to the AAP popup, I couldn't find it. Is there a logging option that needs to be set?
Patrick, you will probably need to look at the Anti Ransomware log via the Log viewer but this can be a very 'busy' log and take a while to get to where any relevant entries might be found.
You should use the Find option for the Log Viewer.
Thank you Steve. I somehow missed the "Find" function in the log viewer. I tried to use "find" in Notepad while accessing the log file but I must have mistyped the search arg.
And now I have to retract something I said in another thread. I can clearly see that AAP does see FTP accesses but it allowed WinSCP to write a .tib file. WinSCP is not in my "Manage processes" list. Surprisingly (to me), I sometime manually added explorer.exe and dllhost.exe with "Can modify and backup" access.
I guess I don't know how this list works. Yesterday I tried deleting a test .tib file using Explorer and got the AAP popup. Today I was able to copy (locally) and delete a .tib file without the popup. Did my allowing the delete yesterday give Explorer permanent authority to do this? I thought AAP opened a 1 hour window allowing that access.
I've removed explorer.exe and dllhost.exe from the list. Firefox was there, too, so I removed it. And I now see in the log that they have been marked as trusted again (but they haven't been added to the managed process list.
Is there a good clear but detailed description of how AAP works? I definitely do not understand it.
Is there a good clear but detailed description of how AAP works?
Not that I am aware of..!
Bob, thanks for the AAP whitepaper link, didn't have that one and makes interesting reading.
Your welcome
:)
I agree with Steve. Thank you! (And thank you, Steve for divulging that "Enchantech" translates to "Bob".)
For the specific questions I have (relating to "In-place overwrite" and "Via new fle"), the really important part of the whitepaper was "The driver provides fle access notifcations to the service".
I ran a small test but did not check the timing closely enough to macht my actions with records in the ATI Anti Ransomware log. I did discover that AAP does not raise an alert when copying a new .tib file onto a local drive. It does present the AAP popup if there is an attempt to overwrite that .tib file. And if permission is given for the file to be overwritten, the file can be overwritten multiple times.
Wasn't there a 1 hour window opened by that permission in the past? (I know it was requested during the 2019 Beta program that the time be set at the time the override was given - that 1 hour could be too long.) I saw no mention of a time limit in the popup this time. I'll try another overwrite later today or tomorrow to see if the override is still in effect. (I hope it is not.)
I suspect the 1 hour time limit is still in place. I think if you have proper security measures in place on your LAN then you are in good shape when it comes to malware of all types. There is always a possibility that some offender will gain access to your system and that is precisely the idea behind AAP, to protect your files in that event.
Enchantech wrote:I suspect the 1 hour time limit is still in place.
Looks like that's not the case. I just tried overwriting the test .tib file (on a local drive) and AAP let me. I used File Explorer to copy the files and Windows, of course, asked if I wanted to overwrite it, but there was not a peep from AAP. I can see lots of activity in the Anti Ransomware log (which I can make no sense of) but nothing stopped me from overwriting the file.
The AAP Activity tab shows explorer.exe was whitelisted yesterday at 11:55. I suspect that was when I told AAP to allow Explorer to overwrite the file.
I don't think I have the protection I would like to have right now. I don't think I actually need protection from File Explorer but I would like to see AAP provide it anyway. This would not be protection from ransomware so much as protection from my own fumble-fingers - a more ever-present threat than ransomware in my case. Does this warrant my opening a case with Acronis support, or am I just expecting too much from AAP?
Conventional wisdom for data security is to protect data from outside bad actors, not so much from inside fumble fingers. Nevertheless, each user has there own unique needs in security. From my stand point I think the inbuilt security of Windows, SMB, SSH, TLS, etc. are sufficient if implemented correctly that I need not worry much especially on my own LAN. I run a fairly sophisticated LAN in which there are 6 available wireless channels, and 24 available wired ports. The LAN is setup using sub-net topology that incorporates a cable modem for WAN connectivity, and 2 routers each running its own sub-net with each sub-net having an 8 port switch one of which is managed.
I think of this arrangement as having a primary network and a secondary network. My secondary network is home to my most sensitive data from a security standpoint whereas my primary network is home to shared data including internet, movies, music, media.
I allow one password protected internet only wireless connection for any guests to my LAN but there are NO unsecured connections to my LAN. I am comfortable with this arrangement. I keep multiple backups of my most important data in various locations so I do not fear the fumble fingers.
You can beef up your security but even the best can be compromised. In my view point, the harder it is to gain access to my data the more likely that a would be intruder will pass me by and look for easier prey!