Start a new topic

Endpoint Security and KnowBe4 RanSim

Just ran the newest version of KnowBe4's RanSim on a workstation with Endpoint Security 10.1.7340, definition updates 3 hours ago.

Advanced Active Protection enabled.

Block processes that are taking potentially malicious actions is selected.

Vipre failed completely - allowing all 14 of the test scenarios.

What settings can I tweak to improve protection?

Hi Ralph,

The RanSim tool is, in KnowBe4's words: "a tool that simulates the behavior of ransomware. The purpose of RanSim is to check if a workstation is well-protected with endpoint security software which would be able to detect and prevent real ransomware attacks." 

Reading between the lines a little bit here, it seems like KnowBe4's intention is to create a tool that can test a very specific subset of endpoint protection functionality. Real-world endpoint protection solutions leverage a wide variety of detection and blocking capabilities, ranging from simple signature/hash based techniques to complex heuristic rules to advanced behavioral detection. These solutions deploy multiple techniques because the simpler ones (hash/signature, for example) are extremely fast and efficient, whereas the more advanced techniques tend to consume more system resources. In fact, modern solutions are constantly pushing new threat intelligence up the pipeline: as the more advanced techniques detect new and novel forms of malware, the associated hashes and signatures are forwarded (often automatically) upstream so that future detection of the same piece of malware can be much faster.

The RanSim tool breaks this model because they are explicitly asking endpoint protection vendors to not detect suspicious code using the most efficient techniques: they want AV vendors to ensure that the RanSim binaries are not stopped using the normal hash/signature techniques that would typically be deployed (i.e. that they are whitelisted) but they do want the more time-consuming behavioral techniques to still stop the simulator. Leaving aside the burden this places on the AV vendor to circumvent all the normal efficiency-improving and whitelisting processes that would ordinarily be in place, this also raises a very important question: when is ransomware not ransomware?

According to KnowBe4, RanSim attempts to simulate ransomware in ways that, in their opinion, should be caught by endpoint security software. The VIPRE team has investigated these claims, however, and we have found that RanSim, aside from performing some actual encryption on some private files, does not really behave much like typical ransomware. This is a critical distinction, because modern behavioral analysis engines such as VIPRE's don't just take a simplistic rule like "watch out for programs that encrypt things," they are far more sophisticated. In our case, we have passed literally billions of known malware samples plus a similar amount of known-good samples through a machine learning-driven behavioral engine. This has generated—without any "expert" input—a model of what ransomware actually does compared to many benign programs, including perfectly legitimate encryptors.

We haven't yet analyzed this very latest version of RanSim so I suppose things might have changed, but as an example real ransomware explicitly is trying to find your sensitive data in your document directories, whereas RanSim is (or was, when we looked at it in detail) downloading a set of private files and then operating its encryption solely on those. Now, a good behavioral engine (like ours) will pick up on these differences and simply say "well, this isn't ransomware, really." So we are left with a "when is a spoon not a spoon" scenario: KnowBe4 is asking ransomware detectors to detect something that is not actually ransomware as if it were ransomware.

This is a bit of a conundrum. Frankly, I think the only way KnowBe4 can actually create an "unknown ransomware simulator" would be to create a real piece of polymorphic ransomware, but then give away the decryption keys for free. Of course, there's plenty of risk there: what if the decryption doesn't work? But anything short of that isn't really ransomware, and so the best ransomware detectors, unless they "fake it," will consistently notice the differences and classify it as something else.

Does this all make sense? It's a bit of a dilemma, we know, but that's where we are. 

David, that answer was 10/10 and super informative. 


Thanks for your quick and detailed answer.

I understand your explanation and your assertion that your behavioral analysis is so good that it can tell the difference between real ransomware and a ransomware simulator, and that makes a lot of sense.  I'm curious how the people at KnowBe4 would respond to your position on this.  

Hi Ralph,

Good question. I imagine that KnowBe4 wants us to special-case their testing utility, and they would probably quibble about our characterization of their test as "not like real ransomware."  All I can really tell you is that although it's true we don't flag and block this simulator, we do score extremely well on tests by independent AV testing agencies such as AV Comparatives, AV Test, and Virus Bulletin - in fact I just heard today that we made AV Test's "Top Product" award this month (for the Home version, which has the same engine).

That said, we are right now in the process of releasing a major update to our Advanced Active Protection engine (target Q4) and then in Q2 will be releasing a completely new network stack with a better firewall, IDS, and DNS protection (target Q2 2019). One of the features of the DNS protection is real-time detection of the use of domain generation algorithms (DGAs), frequently used by ransomware to contact C&C servers. We hope to continue to refine and improve our detection rates, especially against zero-day threats and tricky things like file-less malware. 

We have a lot of core work to do, you've probably noticed that we released our Cloud Edition almost exactly a year ago and a multi-site management console a couple months ago, we release a new cloud-based Email Security product 5 months ago, and we're continuing to build out our portfolio. At the same time, however, we are always looking for good ideas from our user community (although sadly we built up a rather large backlog of such requests, before my time as PM) which you can contribute to here:

Login or Signup to post a comment