  Crypto-ransomware attacks have been a growing threat over the last few years.
The goal of every ransomware strain is encrypting user data, such that
attackers can later demand users a ransom for unlocking their data. To maximise
their earning chances, attackers equip their ransomware with strong encryption
which produce files with high entropy values. Davies et al. proposed
Differential Area Analysis (DAA), a technique that analyses files headers to
differentiate compressed, regularly encrypted, and ransomware-encrypted files.
In this paper, first we propose three different attacks to perform malicious
header manipulation and bypass DAA detection. Then, we propose three
countermeasures, namely 2-Fragments (2F), 3-Fragments (3F), and 4-Fragments
(4F), which can be applied equally against each of the three attacks we
propose. We conduct a number of experiments to analyse the ability of our
countermeasures to detect ransomware-encrypted files, whether implementing our
proposed attacks or not. Last, we test the robustness of our own
countermeasures by analysing the performance, in terms of files per second
analysed and resilience to extensive injection of low-entropy data. Our results
show that our detection countermeasures are viable and deployable alternatives
to DAA.
