The first time it was funny.....

[Gerry_Locke]

The first time this happened I just had a bit of a laugh. Subsequent times made me question the effectiveness of Checkpoint.

I have just done a fresh install of Windows on a Surface Pro. After the image was applied, I logged onto the device for the first time......and almost immediately I got a Checkpoint popup telling me that 18 files had been harmed by a ransomware attack and been quarantined. I clicked the link to show me that 18 files that had been quarantined.......only to find they all had names along the lines of 'checkpoint curriculum vitae-don'tdelete.pptx' or 'sandblast zero-day-funddon't-delete.txt'.

I am not the Checkpoint administrator in my organisation, so my understanding of Checkpoint is fairly limited, but I believe these are honeypot files placed on my C drive by Checkpoint? I don't know if this is an indicator of the quality of Checkpoint - they have created honeypot files so convincing that it managed to fool itself, or an indicator of the lack of quality of Checkpoint - it doesn't know the difference between a real ransomware infection and it's own honeypot files. Either way doesn't really fill me with a lot of confidence.

And on the subject of the honeypot files, we have had the odd user - admittedly only 1 or two - who have had gigabytes of these honeypot files placed in their user profiles. This causes major problems for users with roaming profiles!

[PhoneBoy]

We do create a number of "honeypot" files as part of SandBlast Agent to more readily detect Ransomware infections.
It's possible these files were a part of the initial image somehow and we (falsely) detected them.
We also keep copies of modified files to allow quick restore in case we detect a Ransomware attack.

In the case where either the honeypot files and/or the backup files start taking up an unexpected amount of space, it is best to engage our TAC we can troubleshoot what's going on.

[Pasha_Pal]

Hi Gerry,

GM of Anti-Ransomware here. The Honey pot files are one of several detection mechanisms that are not signature based for ransomware attacks. The deletion or modification of these files triggers an AR detection. In the past we had a problem with User Profile Deletions which was fixed. What version of the product are you running?

As was recommended earlier please open a ticket with TAC. We would love to see what is causing the AR honey pot files to be modified on your system and will then be able to help you accordingly.

As for the gigabytes of honey pot files, the next version of the agent (E82.10) due really soon has an older honey pot cleaner that should help remove the older honey pots on upgrade. In addition, the latest versions will not keep creating new honey pot folders. If this continues to be a problem please do reach out to us.