As we mentioned earlier this month, 2016 was the year of ransomware. Its effectiveness is beyond all discussion, and infections are multiplying among everyday users. Several security companies have begun to modify their products to respond to this threat, but there remains the question of how to evaluate their detection capability. The new tool RanSim seeks to cover that hole, and although it still needs to correct some things, it is a good step.
The Ransomware Threat
Most malware falls into the category of “annoying”. The most likely scenario is that the user loses data and ends up with a hijacked browser or bombarded with advertising, but the story changes completely when we enter the territory of ransomware. We're talking about something equivalent to a virtual kidnapping, and the computer (or rather, its content) becomes a hostage. The process is absolutely degrading, generates enormous stress for the user, and as if that weren't enough, it's a race against time. For this and other reasons we insist so much on backups: the idea is to not lose control of our data, whether due to a hardware failure or a software problem. Now, difficulties also accumulate for security solutions. Traditional antivirus cannot catch ransomware, therefore we need to evaluate the perimeter in some way.
RanSim: A Ransomware Simulator
So we come to this new program called RanSim, developed by the folks at KnowBe4. In essence, it is a ransomware simulator that reproduces the activity of ten different variants on the system, expecting some kind of blocking, interruption, or report from the installed protection. The full evaluation takes a couple of minutes and divides the results into “vulnerable” or “not vulnerable”, accompanied by details about the types of files that could be compromised (documents, images, videos, etc.). Each simulated ransomware comes with a description explaining its underlying mechanism.
Results and Conclusions
How good is RanSim? Personally, I like to see it as a work in progress. The program carries some bugs on its shoulders, and I imagine it will be critical to open channels with anti-ransomware developers to establish a standard in testing. At first I can say that Windows Defender let it pass like a champion, as did the recent RansomFree (I imagine we'll see an official response soon), and in the case of VoodooShield it first tried to block the simulator itself, and then scored a 9 out of 10. The official RanSim page requests personal data to access the download, but below I'll leave the link to a secure mirror.
