Encrypting a file while leaving the first four bytes unaltered bypasses detection.

BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based on header bytes. An authenticated attacker could encrypt files, preserving the first four bytes and preventing this particular method from triggering. The affected product implements additional integrity-based detection mechanisms capable of identifying file corruption or encryption for some common file extensions independent of header bytes. As a result, this vulnerability does not represent a complete bypass of ransomware detection, but a limitation of one detection method when evaluated independently. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected. BullWall plans to improve detection method documentation.

We do not consider this to represent a vulnerability or a bypass of BullWall’s ransomware containment.

The scenario described applies when evaluating a single detection mechanism in isolation. BullWall is intentionally designed as a layered containment system, and this behavior has been covered by an existing integrity-based detection mechanism that has been generally available for several years.

Specifically:

• BullWall includes a file integrity verification sensor that detects corruption or encryption of common file formats independently of the first four bytes.
• This sensor has been part of the product for years and is used to balance detection coverage against false positives in real customer environments.
• The product does not rely on a single heuristic to assert containment.

From our perspective, this CVE reflects an incomplete characterization of a layered security design rather than a newly discovered weakness or missing control.

No product changes are planned for this item, as the described behavior is already covered by design.

BullWall does not currently provide a detection for this issue.