Ransomware and the Legacy Crypto API

Abstract : Ransomware are malicious software that encrypt their victim’s data and only return the decryption key in exchange of a ransom. After presenting their characteristics and main representatives, we introduce two original countermeasures allowing victims to decrypt their files without paying. The first one takes advantage of the weak mode of operation used by some ransomware. The second one intercept calls made to Microsoft’s Cryptographic API. Both methods must be active before the attack takes place, and none is general enough to handle all ransomware. Nevertheless our experimental results show that their combination can protect users from 50% of the active samples at our disposal.
Type de document :
Communication dans un congrès
Frédéric Cuppens; Nora Cuppens; Jean-Louis Lanet; Axel Legay. The 11th International Conference on Risks and Security of Internet and Systems - CRiSIS 2016, Sep 2016, Roscoff, France. Springer, Lecture Notes in Computer Science, 10158, pp.11-28, 2017, Risks and Security of Internet and Systems. 〈https://conferences.telecom-bretagne.eu/crisis/2016/〉. 〈10.1007/978-3-319-54876-0_2〉
Liste complète des métadonnées

Littérature citée [30 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/hal-01388056
Contributeur : Colas Le Guernic <>
Soumis le : mardi 28 mars 2017 - 11:08:11
Dernière modification le : mardi 3 juillet 2018 - 13:10:03

Fichier

papier.pdf
Fichiers produits par l'(les) auteur(s)

Identifiants

Collections

Citation

Aurélien Palisse, Hélène Le Bouder, Jean-Louis Lanet, Colas Le Guernic, Axel Legay. Ransomware and the Legacy Crypto API. Frédéric Cuppens; Nora Cuppens; Jean-Louis Lanet; Axel Legay. The 11th International Conference on Risks and Security of Internet and Systems - CRiSIS 2016, Sep 2016, Roscoff, France. Springer, Lecture Notes in Computer Science, 10158, pp.11-28, 2017, Risks and Security of Internet and Systems. 〈https://conferences.telecom-bretagne.eu/crisis/2016/〉. 〈10.1007/978-3-319-54876-0_2〉. 〈hal-01388056〉

Partager

Métriques

Consultations de la notice

489

Téléchargements de fichiers

340