CASE STUDY SNAPSHOT
Customer : A global leader in enterprise data management and backup solutions, engaged through a leading system integration partnerSize : > 10,000
Project vertical : Enterprise Security, Data Protection
Challenge : Develop a production ransomware protection solution for an enterprise Linux-based backup system, addressing two critical attack vectors, manipulation of the system clock to circumvent data retention policies, and unauthorised access to protected storage through malicious or compromised processes
Solution : A production ransomware protection implementation comprising a tamper-proof software persistence clock and a virtual airgap combining kernel-level IO filtering with user-space access control, protecting enterprise backup data against the most prevalent ransomware attack patterns
Services & Products Availed : Embedded Software Development, Linux Driver Development, Enterprise Security
Tools and Technologies:
- Platform: Linux Enterprise PC
- Implementation: Linux kernel-level driver, user-space daemon
- Languages: C, C++
- Security mechanisms: Persistence clock, Virtual airgap, IO filter, Process authentication
Introduction
Ransomware attacks on enterprise backup infrastructure represent one of the most damaging categories of cyber threat facing organisations today. Unlike attacks on primary data stores, where backup copies provide a recovery path, attacks that successfully compromise the backup system itself can leave organisations with no recovery option, forcing either payment of ransom demands or acceptance of permanent data loss. Enterprise backup systems are therefore high-value targets, and sophisticated ransomware increasingly incorporates specific techniques designed to defeat backup-based recovery, including manipulation of system time to cause retention policy violations and direct attacks on backup storage to encrypt or destroy protected data.
A global leader in enterprise data management and backup solutions, engaged through a leading system integration partner, approached Embien to develop a production ransomware protection solution for their enterprise Linux-based backup product. The solution had to address two specific and well-documented ransomware attack vectors, clock manipulation attacks targeting data retention policy enforcement, and unauthorised storage access attacks targeting the protected backup data itself, through mechanisms robust enough to withstand sophisticated, persistent attackers operating with elevated system privileges.
Challenge
The challenge was not simply to detect ransomware, detection alone is insufficient when the attack has already begun corrupting or encrypting data. The solution had to prevent the attack from succeeding even in scenarios where the ransomware had already gained significant system access, including scenarios where the attacker had compromised processes running with elevated privileges.
The persistence clock requirement addressed a specific and insidious attack pattern, ransomware that advances the system clock to cause backup data to appear older than the configured retention period, triggering automatic deletion of backup copies that the system believes have exceeded their retention window. A reliable clock for retention policy enforcement had to be immune to this manipulation, continuing to provide accurate time even when an attacker with root-level access was actively attempting to alter the system time.
The virtual airgap requirement addressed the direct storage attack vector, ransomware attempting to access, encrypt, or delete the protected backup storage through any available mechanism including legitimate system calls, raw device access, and privilege escalation techniques. The airgap had to operate below the application layer, enforcing access control at a level where even highly privileged malicious processes could not bypass it without detection and blocking.
Both mechanisms had to be implemented without impacting the normal operation of the legitimate backup application, adding no perceptible overhead to backup and restore workflows and introducing no compatibility issues with the existing Linux enterprise platform.
Solution
Tamper-Proof Persistence Clock
The persistence clock provides a reliable, manipulation-resistant time source for the backup system's data retention policy enforcement. Implemented entirely in software, the clock maintains its own independent time state stored redundantly across multiple locations on the backup storage, locations inaccessible to normal system processes. The clock synchronises with trusted external time sources under controlled conditions and detects discrepancies between the system clock and its own maintained state. When a discrepancy indicating potential clock manipulation is detected, the persistence clock flags the condition and the retention policy enforcement logic uses the persistence clock's value rather than the system clock, ensuring that retention decisions are always based on a trustworthy time reference regardless of the state of the system clock.
The persistence clock design ensures that even an attacker with root-level system access cannot reliably manipulate the time reference used for retention policy enforcement without the manipulation being detected, closing the clock-manipulation attack vector that ransomware exploits to trigger premature backup deletion.
Virtual Airgap
The virtual airgap provides a protective layer around the backup storage that enforces a strict access control policy, allowing only authenticated, authorised processes to read from or write to the protected storage, and blocking all other access attempts regardless of the privilege level of the requesting process.
The implementation combines a kernel-level IO filter driver with a user-space access control daemon working in coordination. The kernel-level component intercepts all IO operations directed at the protected storage at the block device layer, below the filesystem and well below the application layer, evaluating each operation against the current access policy before allowing or blocking it. This interception position ensures that no process, including those with elevated privileges, can access the protected storage through any normal IO path without the operation being evaluated by the airgap.
The user-space daemon maintains the access control policy, defining which processes and credentials are authorised to access the protected storage under which conditions, and communicates policy state to the kernel-level component. The daemon also monitors for behavioural indicators of compromise, access patterns inconsistent with legitimate backup application behaviour, and can dynamically tighten the access policy in response, further limiting the window of opportunity for a ransomware process that has gained initial access to cause damage.
The virtual airgap was designed and validated to handle the full range of access mechanisms a sophisticated attacker might employ, including direct block device access, filesystem-level manipulation, and attempts to exploit kernel interfaces that bypass normal IO paths.
Integration and Validation
The complete solution was integrated into the customer's enterprise Linux backup product and validated against a comprehensive set of attack scenarios, covering clock manipulation attacks, direct storage access attempts by simulated ransomware processes, privilege escalation attacks, and combinations of multiple simultaneous attack vectors. The solution was validated to block all tested attack scenarios without impacting the performance or functionality of the legitimate backup application. The implementation was delivered as a production-ready component, integrated into the customer's product release process and deployed to enterprise customers.
Benefits
- Clock manipulation defence Tamper-proof persistence clock maintains a reliable retention policy time reference immune to system clock manipulation by even root-level privileged attackers
- Deep storage protection Kernel-level IO filter intercepts all storage access below the filesystem layer, blocking unauthorised access from any process regardless of privilege level
- Layered defence architecture Kernel and user-space components working in coordination provide defence-in-depth against the full spectrum of storage attack techniques employed by sophisticated ransomware
- Zero impact on legitimate operations Solution validated to add no perceptible overhead to backup and restore workflows and introduce no compatibility issues with the enterprise Linux platform
- Production-grade delivery Complete implementation validated against comprehensive attack scenarios and integrated into the customer's enterprise product release process for deployment to enterprise customers
Conclusion
This ransomware protection project demonstrates Embien's capability to develop sophisticated, production-grade security solutions for enterprise Linux environments. By addressing two of the most impactful ransomware attack vectors, clock manipulation and direct storage access, through a combination of a tamper-proof persistence clock and a deeply integrated virtual airgap, Embien delivered a solution that meaningfully strengthens the resilience of enterprise backup infrastructure against the ransomware threats that most directly threaten its recovery value. This project reflects Embien's ability to work at the intersection of Linux kernel development, system security architecture, and enterprise software integration, a combination increasingly in demand as ransomware attacks on critical infrastructure continue to grow in sophistication and impact.