Ransomware Attack as Hardware Trojan: A Feasibility and Demonstration Study

Abstract

The integrated circuit (IC) ecosystem, today, is widely distributed. Usually, a handful of companies is involved in the development of a single chip -an environment that presents many opportunities for malicious activities such as the insertion of hardware trojan horses. This work presents a specialized form of a hardware trojan that is able to mount a hardware-based ransomware attack, an attack that previously only existed in the software domain. This attack is therefore termed a hardware ransomware and is the main contribution of this work. As case studies, two architectures of the hardware ransomware are presented, along with a silicon demonstration in 65nm CMOS. In order to discuss the detectability of the malicious logic, the hardware ransomware is inserted in a complex system on chip (SoC). The experimental results show how an adversary can effortlessly insert the ransomware logic: the baseline SoC has a representative area utilization factor of 59.97% and, after the trojan is inserted, the area utilization factor increases by 0.73% to 60.70%. The inserted logic is also responsible for an increase of approximately 2% in static power -well within process variation margins. Finally, this paper discusses the implications of such an attack at length, showing that from the implementation and technological side, there are no barriers for an adversary to devise a hardware ransomware.INDEX TERMS Ransomware attack, hardware security, hardware trojan horse, malicious logic, ASIC.

Mitigating Data Exfiltration Ransomware through Advanced Decoy File Strategies

“…Later campaigns like WannaCry (2017) and DarkSide (2020) took advantage of unpatched software vulnerabilities to propagate quickly across networks in worm-like fashion [34,35,21]. These marked a shift towards "big game hunting", targeting victims with deeper pockets through manual, lateral movement techniques post-intrusion [24,36]. Attackers eventually realized that data encryption alone was an inadequate extortion tactic.…”

“…However, advanced evasion techniques like polymorphism, metamorphism, and antisandbox checks allow threats to avoid triggering alerts [30,46]. Attackers now operate slowly and stealthily, conducting extensive internal reconnaissance over months before staging data and launching encryption [36,13]. Hence, existing defenses have largely only managed to capture threats post-breach as opposed to preventing breaches entirely [31,33].…”

Ransomware Detection with Opcode Analysis and GAN-Based Unsupervised Learning

“…Extensive studies have been conducted on various features of ransomware. One key aspect analyzed is the use of sophisticated fingerprinting methods by ransomware, which include time, date, language, and geolocation data, to tailor social engineering attacks [11,12]. For example, ransomware variants like Reveton and Cerber have been noted for customizing ransom notes in the victim's language, enhancing the efficacy of the scam [13,14,15,16].…”

Modus Operandi, Factors, Implications and Governance of Ransomware Attacks on Transportation Systems

“…Financial gain is one of the primary motivations behind ransomware attacks on transportation systems. Transportation systems are interesting targets because they frequently manage significant quantities of sensitive data and play a vital part in people's everyday lives [43]. Ransomware is used by attackers to encrypt crucial data and demand money in exchange for the decryption key; it may be a profitable source of cash for hackers.…”