Google drive Ransomware

[h424]

In a hypothetical scenario; 

• Ransomware gains access to the computer of a single user in an organization
• They encrypt all the local google drive files / folders
• Google Drive files sync back to Google Drive and therefore resulting the loss of files to all users in the organization

Recovery?

• If the files weren't modified, but deleted - then all the files could easily be recovered by an admin in bulk.
• If the files were modified (encrypted) and not deleted - then the only way to restore the files would be individually, which is kind of an unfeasible task.

Solution:

Ability to restore modification of files in bulk, based on a specific timeframe.

[Jessica_CM]

@h424 Is this a suggestion? If so, you might want to request access to the Feature Ideas group. Feature Ideas is a dedicated area specifically for making suggestions for new features. Product-related questions can be posted in Workspace Q&A, whereas Workspace Discussion is for watercooler conversations and networking.

[CalebSpring]

I think you can use API tools such as GAM to restore files in bulk. I am not a GAM pro but am pretty sure it is possible. 

[anerd]

Yeah in the past I've written a script to restore files to a previous revision in the case of Ransomeware having done exactly that.
It would be a nice feature to have in the GAM tool.

[chris491]

I would be interested in hearing more how you did this?

[anerd]

I actually did this using the Drive API and python scripting. Unfortunately lost the script, so currently would need another client project to give me a reason to make a new one.

[chris491]

That's a shame, undoubtedly a useful script to have in your pocket 😔

[Jessica_CM]

I've moved the thread to Workspace Q&A, in case anyone here sees the thread and has additional insight.

[JerryW]

You have to write a script using Google Drive APIs to restore all files to a previous state, or use a backup/restore tool, such as CubeBackup.

[ciprian]

I am currently facing this exact scenario. One of the employees was hit by a ransomware that modified (encrypted and renamed) all files in My Drive and Shared Drives. Looking in the admin panel I do not see any option provided by Google to bulk revert files.

Is there any available script to revert these files? I'm thinking either by date or by file extension added by the ransomware.

[cryptochrome]

I can't help with the script, but I would like to mention a few things you all can do to prevent this from happening in the first place. 

1.) Have a solid endpoint protection software in place. Normal antivirus software is no longer good enough to protect your business from modern threats like ransomware. Here is a good blog article that explains why. Purchase something like SentinelOne or Crowdstrike to replace your antivirus software. These products detect malicious behavior on a computer (example, a program starting to encrypt lots of files, like Ransomware does). It then kills these programs and reverts any changes that the malicious software made. 

2.) Backup your data, regularly and often. Google does not protect you against data loss. If a malicious actor really wanted to harm you badly, they could get hold of a super admin account, disable all versioning on Drive and then detonate the ransomware. I always recommend our clients to use something like Afi Cloud Backup, which connects directly to the Drive API and backs up your data reliably. It's also affordable. We are a reseller and have deployed this for many customers. It's rock-solid, easy to use, and an absolute lifesaver when data loss occurs. 

[ciprian]

I ended up writing a basic nodejs app with Drive API. Here's the main function for anyone needing it.

The function deletes revisions created by the compromised user account after a set date. This reverts the file to the most recent revision previous to the attack.

const ransomUser = 'user@domain.com';
const ransomStart = new Date('2022-09-16');

// get a list of encrypted files and call restoreRevision for each file.

async function restoreRevision(drive, fileId, fileName) {
	try {
		let response = await drive.revisions.list({
			fileId: fileId,
			fields: 'revisions(id, modifiedTime, lastModifyingUser(emailAddress), mimeType, originalFilename)',
		});
		const revisions = response.data.revisions;
		if (!revisions || revisions.length === 0) {
			console.log(fileId, fileName, 'No revisions found.');
			return;
		}

		let revisionDeleted = false;
		for (let i = revisions.length - 1; i > -1; i--) {
			const revision = revisions[i];
			const date = new Date(revision.modifiedTime);
			if ((!revision.lastModifyingUser || revision.lastModifyingUser.emailAddress == ransomUser) && date > ransomStart) {
				await drive.revisions.delete({
					fileId: fileId,
					revisionId: revision.id,
				});
				revisionDeleted = true;
				continue;
			}
			if (revisionDeleted) {
				drive.files.update({
					fileId: fileId,
					supportsAllDrives: true,
					requestBody: {name: revision.originalFilename},
				});
				return;
			}
		}
	} catch (err) {
		console.log(fileId, fileName, 'Failed restoreRevision with error', err.message);
	}
}