Ransomware attacks are increasing at an alarming rate. Most of us rely on antivirus software to keep our devices safe from viruses and defend against ransomware. Every antivirus solution provides ransomware protection to keep our personal data safe. But is that enough? Can antivirus software protect your data from the threat of ransomware?
Can malware bypass ransomware protection provided by an antivirus?
Typically, the defense against ransomware provided by antivirus solutions is quite effective.
You can select the folders/files you want to protect and the antivirus software ensures that no unauthorized access or modifications are made to the folders. You can also configure Windows Defender to protect your computer from ransomware, using the protected folder method. You can only access your protected folders from trusted applications.
Read also: What is the best antivirus for your Android smartphone?
Apart from this, antivirus programs apply smart techniques to detect a malicious program or any malicious activity on your computer, to combat ransomware.
Of course, there are other protections that make your online experience safe and help ensure you don't download anything suspicious. Generally, any antivirus program provides solid protection against ransomware.
However, a 2021 study conducted by researchers from the University of Luxembourg and the University of London points out that can malware effectively bypass ransomware protection and "trick" the antivirus program to avoid detection.
It is difficult to know which antivirus software products are vulnerable to this issue, so it is important to have some information about how it can happen.
How can malware "trick" antivirus?
According to the study, malware can "trick" antivirus protection and bypass ransomware protection in two clever ways:
- Checking a trusted application.
- Disabling antivirus protection.
The first method is simple. While your protected folders are safe from unauthorized use, some trusted applications can still access these files.
See also: Hackers lure Android users with fake antivirus and infect them with malware
Of course, a trusted application like Notepad is not malware. And, if malware controls the Notepad application, it can perform operations like copy, cut, and paste to modify your protected files.
This is just one example of how malware can “trick” protection features like controlled folder access. In other words, any trusted application that has been allowed by the antivirus can be controlled by malware to perform unauthorized actions that are “disguised.”
The second method involves malware that simulates mouse clicks to disable antivirus protection (or real-time protection). The attacker simply needs to open the antivirus program and click the mouse, using precise coordinates on the screen to disable the protection feature.
Proposal: US: Accuses China of committing ransomware attacks
Can antivirus protect you from ransomware?
Yes, but there's a catch. Antivirus protects you from ransomware in most cases. However, you should keep in mind that malicious actors are constantly evolving their methods to "trick" an antivirus program into infecting your computer with ransomware.
While some antivirus programs can successfully protect you from this threat, there are some that cannot, so it is essential to learn how else you can mitigate the threat of ransomware. Overall, it is worth investing in a security suite.
It's best not to rely on antivirus programs for complete protection against ransomware. Every antivirus company has probably already addressed the problem. But soon, hackers will find new techniques to bypass antivirus protection.
You should not rely solely on antivirus software as your sole defense against ransomware. You should take additional steps to protect your data, such as physically backing up your files.
Antivirus programs offer a variety of protection services that make things easier – but you should always have a plan B for the safety of your data, in case the security suite is “tricked” by malware.
Information source: makeuseof.com
