Reference : No Random, No Ransom: A Key to Stop Cryptographic Ransomware

	Document type :	Scientific congresses, symposiums and conference proceedings : Paper published in a book
	Discipline(s) :	Engineering, computing & technology : Computer science
	Focus Areas :	Security, Reliability and Trust
	To cite this reference:	http://hdl.handle.net/10993/35679

Title :	No Random, No Ransom: A Key to Stop Cryptographic Ransomware
Language :	English
Author, co-author :	Genç, Ziya Alper [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Lenzini, Gabriele [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
	Ryan, Peter [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >]
Publication date :	2018
Main document title :	Proceedings of the 15th Conference on Detection of Intrusions and Malware, and Vulnerability Assessment
Publisher :	Springer
Pages :	234-255
Peer reviewed :	Yes
On invitation :	No
Audience :	International
ISBN :	978-3-319-93410-5
City :	Cham
Country :	Switzerland
Event name :	15th Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2018)
Event date :	28-29 June 2018
Event organizer :	CEA
	Télécom SudParis
Event place (city) :	Saclay
Event country :	France
Keywords :	[en] ransomware ; cryptographic malware ; randomness ; mitigation
Abstract :	[en] To be effective, ransomware has to implement strong encryption, and strong encryption in turn requires a good source of random numbers. Without access to true randomness, ransomware relies on the pseudo random number generators that modern Operating Systems make available to applications. With this insight, we propose a strategy to mitigate ransomware attacks that considers pseudo random number generator functions as critical resources, controls accesses on their APIs and stops unauthorized applications that call them. Our strategy, tested against 524 active real-world ransomware samples, stops 94% of them, including WannaCry, Locky, CryptoLocker and CryptoWall. Remarkably, it also nullifies NotPetya, the latest offspring of the family which so far has eluded all defenses.
Research centres :	Interdisciplinary Centre for Security, Reliability and Trust (SnT) > Applied Security and Information Assurance Group (APSIA)
Target :	Researchers ; Professionals ; Students ; General public ; Others
Permalink :	http://hdl.handle.net/10993/35679
DOI :	10.1007/978-3-319-93411-2_11
Other URL :	https://link.springer.com/chapter/10.1007/978-3-319-93411-2_11

	File(s) associated to this reference
	Fulltext file(s): File Commentary Version Size Access Open access dimva2018_GLR.pdf Author postprint 447.56 kB View/Open

All documents in ORBi^lu are protected by a user license.

 

University of Luxembourg Library |  Feedback |  Legal notices Site Map