Fighting Ransomware with Guided Undo: Nextcloud in research protecting users

Originally published at:

August 2017, Nextcloud announced a Ransomware Protection app, designed to warn Nextcloud users of possible infection by Ransomware on their desktop. Some weeks ago, researchers at the German University of Konstanz, released a research paper describing a different approach and a Nextcloud app is now available based on this research. It enables Nextcloud users to easily undo the damage done by ransomware, using sophisticated analysis on uploads to separate potential ransomware data from legitimate data.

Research into ransomware

At the University, student Matthias Held, under supervision of professor Marcel Waldvogel, researched the behavior of Ransomware, aiming to answer the question: what would the most efficient ransomware look like? What would it do to extract maximum revenue from its victims?

Dissecting many known Ransomware tools revealed most are far from efficient, wasting time with double file writes or ineffective algorithms. The team decided to find out what the ideal way was to recover data from a theoretically very efficient piece of ransomware. A key finding was that, at its essence, Ransomware is simpler than normal malware. It only deals with making data inaccessible. It does not prevent usage of the rest of the computer, so users have avenues to recover their data. The team looked to exploit this fact.

Backups won't do

Backups, on an attached drive to the computer, are not sufficient, as smart malware has the opportunity to damage backups when the drive is attached. A solution has to come from a hardware limitation to that, or perhaps a separate machine, not affected by the attack. The team looked at various potential mitigations including hardware solutions in the USB cable connecting a backup drive and file system snapshot technologies. At one point they realized that the Nextcloud server, used at the University (which is a customer of Nextcloud GmbH), qualifies as a second machine with a separate risk profile and already provides a file snapshot technology. The Trash feature in Nextcloud allow users to recover deleted files while the Versioning feature lets users bring back earlier versions of files.

[caption id="attachment_4376" align="alignright" width="300"] Detection of suspicious files[/caption]

Developing a Nextcloud app

With Nextcloud offering a flexible app architecture and the basic functionality of Trash and Versioning already available, the team started developing a solution that followed the results of their research. Essentially, their application tries to separate between ransomware actions and user actions to make rollback easier.

Their full paper details various elements of the solution: files would be examined and a Shannon entropy measure would determine whether the file is likely to be encrypted. Their implementation is clever in separating compressed data from encrypted files. Other important metrics include the number of files uploaded in over a short time period, or if lots of files with unknown extensions show up. The app closely looks at sync steps and tries to identify when a large number of files is being changed in a suspicious way.

When the user discovers their data has been taken ransom, they can visit the Ransomware Detection app and use its graphical user interface as a guide to recover their data. The likely candidates for recovery can be spotted and selected with the help of the the color guidance. Additionally, there is the option to add or remove entries from this recovery list. Of course users can also go over files one-by-one, but in tested scenarios the guided undo process significantly simplified and sped up the recovery process. Of course, if anything too little or too much has been rolled back in a first attempt, this can always be corrected later, as the Ransomware detection app simply makes use of the services of the existing Versions and Trash apps in Nextcloud.

When the user discovers their data has been taken ransom, they can visit the Ransomware Detection app and use its graphical user interface as a guide to recover their data. Of course users can also go over files one-by-one, but in tested scenarios the guided undo process simplified and sped up the recovery process significantly.

[caption id="attachment_4375" align="alignright" width="300"] Recovery in action[/caption]

A complementary solution

An interesting aspect of their approach is that it is complementary to the Nextcloud Ransomware protection app. The existing app warns users on possible infection while the new app provides recovery of data after the fact. The researchers even suspect much of the benefits of the app could be had even if the user does not have it installed. Once an attack has taken place, the user can install the app and use it to analyze the existing file versions on the server. A possible future update to the app would determine the likely point where infection took place and guide the user through the recovery.

The app uses some server resources, the team estimates this to be at about a 20-30% overhead on file upload, mostly caused by the Entropy Analysis. As large Nextcloud customers like the TU Berlin have shown that file upload makes up for far less than 10% of the load on a Nextcloud server, this makes for a reasonable trade off. The team does believe it is possible to delay the calculations to nightly cron jobs or even at the moment the user needs the data, however, with the limited performance impact, they don't see this as a priority.

Another venue for improvement is to integrate deeper with the Nextcloud versioning system, which automatically clears data it no longer deems needed. Assigning higher priority to files likely modified just before potential malicious activity, the app could decrease the amount of data lost by a ransomware attack.

Presented soon, available now

At the upcoming Norwegian Information Security Conference (NISK 2018), the team will present their paper "Fighting Ransomware with Guided Undo". You can read an abstract and download the full paper on

The Nextcloud app is already available in the Nextcloud app store, still in testing by the team.

The results of the research and the Nextcloud Ransomware Detection app are scheduled to be presented also at the upcoming Nextcloud Conference in August in Berlin, Germany.

It’s still painfull when you’re folder is shared with a team.
The better solution is still to implement it on the client side. The nextcloud sync app.

If you’re computer get locked by randsomware, the sync client won’t upload them and the team can still work on the folder without issue, without downloading bad files and wait for a solution

While preventing malware from getting a foothold is indeed the better solution (where possible), I don’t think the sync app is the way to do it. If you’re in a position to dictate user devices, you can mandate security software as you like. If not, having a little bit of detection built into the sync app would be nice, but it can and will generate both false positives and false negatives - it will scare and inconvenience users unduly, and things will still sneak past it, so it doesn’t remove the need for this. “An ounce of prevention is worth a pound of cure,” but we still need both in the end.

I’m really glad to have something like this selectively baked into Nextcloud, rather than having to rely on a VM or filesystem snapshot for a mass restore if a lot of files are compromised. Good to know we’ll be able to get the affected files back without worrying about locking unaffected users out in the mean-time.

The question here is probably about how many files of a system infected with ransomware and running a Nextcloud client syncing all the files to the server would be transferred there. If it encrypts everything sent to the Nextcloud server, then the admin should probably have an option to “simply” restore all of the users files to an earlier, uninfected stage in the web UI using the versioning and trash feature. Leaving this to the user is sometimes probably not the best idea, regardless of how “efficient” or not the ransomware was encrypting all kinds of files.

Is there any benefit of using both?
I mean Ransomware Protection and Ransomware Detection.
There are two apps.
One stops downloads, the other one lets undo changes, right?
I have seen multiple times that e.g. my whatsapp files (like. aac) are blocked. As I sync my nextcloud folder e.g. from my android smartphone to backup in nextcloud or users put a backup of them in their folder nextcloud folder.