Next Generation Cryptographic Ransomware

Abstract

We are assisting at an evolution in the ecosystem of cryptoware -the malware that encrypts files and makes them unavailable unless the victim pays up. New variants are taking the place once dominated by older versions; incident reports suggest that forthcoming ransomware will be more sophisticated, disruptive, and targeted. Can we anticipate how such future generations of ransomware will work in order to start planning on how to stop them? We argue that among them there will be some which will try to defeat current anti-ransomware; thus, we can speculate over their working principle by studying the weak points in the strategies that seven of the most advanced anti-ransomware are currently implementing. We support our speculations with experiments, proving at the same time that those weak points are in fact vulnerabilities and that the future ransomware that we have imagined can be effective.

NoCry: No More Secure Encryption Keys for Cryptographic Ransomware

“…Each defense system has pros and cons, and NoCry may well find its beater in some next generation ransomware. As discussed in [8], ransomware applications can find other ways than calling CSPRNG to get random numbers e.g., by relying on noncryptographic sources of randomness, but we believe that the alternative choices have weak points. The fact is that all the samples and variants of ransomware in the cryptographically-hard niche that we have analyzed so far, do call CSPRNG APIs.…”

Ransomware Detection using Markov Chain Models over File Headers

“…Different surveys have been published on ransomware protections (Genc ¸et al, 2018;Al-rimy et al, 2018b;Aurangzeb et al, 2017;Moussaileb, 2020). A first idea to protect data against ransomware attacks is to use data back-up as explained in (Castiglione and Pavlovic, 2019;Baykara and Sekin, 2018) but it is not possible to have at any time an up to date back-up of data and to decide when and which data need to be restored it is necessary to have a mechanism to detect a ransomware attack when it occurs.…”

Why Current Statistical Approaches to Ransomware Detection Fail

“…The use of statistical approaches to detect ransomware was the second most common approach to detecting ransomware in 2019, according to an analysis of the academic anti-ransomware landscape [20]. Genç et al classify measuring entropy inflation as one of the main behavioural analysis approaches to defending against ransomware [7], and Al-Rimy et al highlight the use of entropy in their analysis of ransomware research [1]. There are some potential reasons as to why statistical approaches may be so popular in this context.…”

“…We then moved towards compressed data, whose tendency to generate false positives has been noted in the literature [7,15]. We compressed data from the Govdocs threads, which are mutually exclusive sets of approximately 1,000 files.…”