Windows 10: Clarify Microsoft's Stance on the RIPlace ransomware issue with respect to Protected Folders

Discus and support Clarify Microsoft's Stance on the RIPlace ransomware issue with respect to Protected Folders in AntiVirus, Firewalls and System Security to solve the problem; With all the ransomware issues these days, I have turned on the Ransomware protection's "Controlled folder access" feature. I've clicked on the... Discussion in 'AntiVirus, Firewalls and System Security' started by Don Lind, Jan 1, 2020.

  1. Don Lind Win User

    Clarify Microsoft's Stance on the RIPlace ransomware issue with respect to Protected Folders


    With all the ransomware issues these days, I have turned on the Ransomware protection's "Controlled folder access" feature.

    I've clicked on the "Protected folders" link and added the folders I need to protect.

    And I've had to use the "Allow an app through Controlled folder access" link to specify a few non-default programs that I trust.

    That's all fine, and it was relatively painless.


    But, I've just read about the RIPlace issue and Microsoft's response to it and, well, it seems like using the "Controlled folder access" feature is a waste of time at this point.


    The RIPlace issue is that there's apparently a pretty easy way to completely circumvent the controlled folder access stuff and there's a "proof of concept" available that shows how your files can be replaced with encrypted copies of them without the "Controlled folder access" feature noticing. Details are here https://www.geekwire.com/2019/new-windows-10-ransomware-threat-examining-claims-potentially-unstoppable-vulnerability/ and in a couple of other sites.


    From the story, it sounds like Microsoft doesn't view this as a big deal... they may fix it in some future version of Windows.

    To me, this seems to be a hole in the basic functionality that is big enough to drive a truck through. This issue was disclosed to Microsoft and other security vendors six months ago. The PoC is publicly available now. Ransomware authors have probably already started using it.


    How can this not require an immediate "patch Tuesday" fix?


    I don't go wading into the cesspool corners of the internet and I don't blindly click on links or run attachments.

    I have some offline backups, but ransomware is getting way too common and I don't want to be a victim.

    I viewed the "Controlled folder access" as something that could help.

    I know all news stories aren't necessarily always exactly correct and maybe the stories have not relayed Microsoft's stance correctly. But both geekwire and bleepingcomputer make it sound like the basic response is "this isn't a bug... it's an expected functionality because of the use of an older, legacy API call... and it's no big deal." And if Microsoft is going to ignore the issue and/or "slow roll" any fix for this issue, I find that troubling.

    :)
     
    Don Lind, Jan 1, 2020
    #1
  2. Percu1 Win User

    Sub-folders in ransomware protection

    I want to add a folder with sub-folders in it to be protected with Windows 10 ransomware protection.

    Is enough to add the root folder in ransomware protected folder options in order that all of its subfolders are also protected? Or do I have to add each sub-folder individually?
     
    Percu1, Jan 1, 2020
    #2
  3. mcquicker Win User
    Bug in Ransomware Protected Folders?

    I have a list of 13 folders (from different drives) in the Ransomware "Protected Folders" feature.

    Although the feature can be disabled completely, while enabled I can only remove 2 of the "Protected Folders" on the list.

    I cannot remove/delete the others.

    I tried disabling/enabling the feature from Settings and Group Policy options, and cannot do it. I also cannot find a way to remove the "Protected Folders" using regedit.

    When I changed one of the drive letters, the original letter remained in "Protected Folders," and the drive with the new letter assigned was not "protected."

    I wonder if this is a bug, or is something else keeping me from removing a folder listed in the "Protected Folders" once it is added.

    But, if so, why some of the folders listed can be removed while others cannot?

    Many thanks in advance,
    Peter Bond
     
    mcquicker, Jan 1, 2020
    #3
  4. Clarify Microsoft's Stance on the RIPlace ransomware issue with respect to Protected Folders

    Jsssssssss, Jan 1, 2020
    #4
Thema:

Clarify Microsoft's Stance on the RIPlace ransomware issue with respect to Protected Folders

Loading...
  1. Clarify Microsoft's Stance on the RIPlace ransomware issue with respect to Protected Folders - Similar Threads - Clarify Microsoft's Stance

  2. ransomware protection

    in AntiVirus, Firewalls and System Security
    ransomware protection: will microsoft defender's ransomware protection work if using avira free antivirus.avira free's ransomware protection is locked behind a paywall. https://answers.microsoft.com/en-us/protect/forum/all/ransomware-protection/5c6595fe-f89a-4e70-816c-2aff4929aac5
  3. I want to exclude the default 'users' folder from the Ransomware Protection Protected folders.

    in Windows 10 Gaming
    I want to exclude the default 'users' folder from the Ransomware Protection Protected folders.: I use 'Controlled folder access' feature in 'Ransomeware protection' on Windows 10 to prevent ransomware attacks. in the 'Protected folders' list i can specify the folders that i want to protect. No application will be able to modify or delete the files inside the folders on...
  4. I want to exclude the default 'users' folder from the Ransomware Protection Protected folders.

    in Windows 10 Software and Apps
    I want to exclude the default 'users' folder from the Ransomware Protection Protected folders.: I use 'Controlled folder access' feature in 'Ransomeware protection' on Windows 10 to prevent ransomware attacks. in the 'Protected folders' list i can specify the folders that i want to protect. No application will be able to modify or delete the files inside the folders on...
  5. I want to exclude the default 'users' folder from the Ransomware Protection Protected folders.

    in Windows 10 Customization
    I want to exclude the default 'users' folder from the Ransomware Protection Protected folders.: I use 'Controlled folder access' feature in 'Ransomeware protection' on Windows 10 to prevent ransomware attacks. in the 'Protected folders' list i can specify the folders that i want to protect. No application will be able to modify or delete the files inside the folders on...
  6. How can I remove the DEFAULT protected folders by Ransomware Protection?

    in AntiVirus, Firewalls and System Security
    How can I remove the DEFAULT protected folders by Ransomware Protection?: Causing issues with me letting take screenshots from a game on Steam, I'd like to remove the "DEFAULT" protected folders but the "Remove" button is greyed out....
  7. Ransomware protection

    in AntiVirus, Firewalls and System Security
    Ransomware protection: That ransomware protection that Windows Defender has might a little to over-protection. When turned on: It will not access save games from Origin and other EA games Uplay seems not the problem I find it really necessary to share this information. It seems like Win Defender...
  8. Sub-folders in ransomware protection

    in AntiVirus, Firewalls and System Security
    Sub-folders in ransomware protection: I want to add a folder with sub-folders in it to be protected with Windows 10 ransomware protection. Is enough to add the root folder in ransomware protected folder options in order that all of its subfolders are also protected? Or do I have to add each sub-folder...
  9. Bug in Ransomware Protected Folders?

    in AntiVirus, Firewalls and System Security
    Bug in Ransomware Protected Folders?: I have a list of 13 folders (from different drives) in the Ransomware "Protected Folders" feature. Although the feature can be disabled completely, while enabled I can only remove 2 of the "Protected Folders" on the list. I cannot remove/delete the others. I tried...
  10. Ransomware Protection?

    in AntiVirus, Firewalls and System Security
    Ransomware Protection?: Been visiting a website that discusses ransomware and all of the nasty things that can happen, starting to make me paranoid. Data files are backed up and stored offline, but still...So, I am looking for a quality anti-ransomware software package. As I am new to this concept,...