Global S&T Development Trend Analysis Platform of Resources and Environment
Ransomware: research strikes back | |
admin | |
2021-12-12 | |
发布年 | 2021 |
语种 | 英语 |
国家 | 法国 |
领域 | 地球科学 ; 资源环境 |
正文(英文) |
![]()
All it takes is one click for your computer to be taken hostage by a malware program that will relinquish control only for a ransom. Upon the launch of Cybermallix, a CNRS joint laboratory with the software publisher Wallix, Jean-Yves Marion, director of the LORIA, explains how these attacks work, and how AI and formal methods provide protection.
You specialise in the fight against ransomware using formal methods, artificial intelligence, and collaboration with start-ups and industry. Can you explain what these programs are, and how they function? These attacks can take place on a large scale, as was recently the case in the US where a pipeline network was completely paralysed. Specifically, almost all of them follow roughly the same pattern in three phases. The first consists in entering the system. The intrusion generally occurs through phishing, a social engineering technique which prompts the victim to open an email containing a link or document that will execute a script. This script, known as a loader, in turn retrieves—unbeknownst to the user—a malicious code which will install the executable file that is at the heart of ransomware. A malware program, like WannaCry, can also exploit a vulnerability such as a bug or an error in order to infect a system. ![]() The second phase then begins. The installed malware can try to update itself and see if the host machine is not already infected, or seek to communicate with the attacker via an encrypted protocol. These attacks typically occur within a network. A compromised machine, known as the bot, will connect to a larger network, the botnet. All of this is controlled using command and control software. Ransomware is part of a fairly structured black economy that includes multiple specialised tools, which generally do not come from the same source. Some of them compromise the system and conceal the malware's presence, while others develop the elements central to the attack. The third phase is that of exploitation. Data can be stolen and exfiltrated, or it can be encrypted and held for ransom in the case of ransomware. What's more, malware can subsequently be replaced by another, which will in turn infect the host and exploit its position. This is the case with Emotet, some versions of which have downloaded Trickbot, and then the Ryuk ransomware. Can a simple click paralyse a computer immediately, or how does it actually happen? ![]() One can imagine cameras and security systems being infected in advance, with the attacker waiting for a favourable moment to take advantage of the situation. This type of attack mostly targets industry, transportation, and the energy sector. The network of compromised devices, the botnet, can also proceed with denial-of-service attacks, which flood a server with requests in order to overload it and shut it down. What are the specific difficulties in combatting ransomware? Obfuscation offers different ways of designing software, such as self-modifying codes. They are deployed in waves, and self-generate during execution. It thus becomes impossible to access their semantics, in other words their ultimate intent. The most sophisticated malware can include up to six hundred waves. To manage this, the best-known method is to use a succession of packers that decode data on the fly and transform it into executable code. They are often analysed using dynamic analysis, which runs malware in a secure environment in order to remove traces of its execution. Software development courses teach us to separate programs from data, to consider them as two distinct elements. This distinction is however not so clear-cut in such wave-based programming. These self-modifying programs use both a reflexive mechanism, thereby converting data into a program, as well as a reification mechanism, transforming a program into data. Another example of self-modification is program virtualisation, which involves piling up interpreters of programming languages. Each interpreter executes its code in different programming languages that are unknown to outsiders. Obfuscations are fascinating, as they are concrete in some ways but also relate to programming theory, which remains little explored. There is sometimes talk of digital epidemics. What do you think of this notion? What solutions can researchers offer? ![]() For a number of years now, AI has provided new detection solutions. Machine learning methods can train a neural network using characteristics from malware obtained via statistical analysis. However, AI is not the be-all and end-all, as malware authors, who know it only too well, develop attacks specifically designed to bypass such software. The other approach involves dynamic analysis, in which the malware is executed in a closed environment known as a sandbox. This makes it possible to gather information on its behaviour, which is once again processed using statistical analysis methods. In practice, most researchers combine both the statistical and dynamic solutions. The most advanced systems for malware analysis and detection include the three above-mentioned approaches. The Gorille software suite, developed by the Cyber-Detect start-up thanks to the technology transfer to industry of research conducted at the LORIA, is no exception. It proceeds with morphological analysis of code, and detects threats based on what it has already learned. While Gorille is not a traditional antivirus program, it can provide rapid answers in the face of new infections. My laboratory, the LORIA, has just signed a LabCom partnership, called Cybermallix, with the company Wallix. We propose a solution that collects all available information regarding a network, and then resorts to our expertise in executable programs and network traces to identify an attack from the onset. For me this project is interesting because it involves an approach developed by researchers, and put to use by experts in this field. Footnotes
Go further
0 comment
|
URL | 查看原文 |
来源平台 | CNRS News |
文献类型 | 新闻 |
条目标识符 | http://119.78.100.173/C666/handle/2XK7JSWQ/343429 |
专题 | 地球科学 资源环境科学 |
推荐引用方式 GB/T 7714 | admin. Ransomware: research strikes back. 2021. |
条目包含的文件 | 条目无相关文件。 |
个性服务 |
推荐该条目 |
保存到收藏夹 |
查看访问统计 |
导出为Endnote文件 |
谷歌学术 |
谷歌学术中相似的文章 |
[admin]的文章 |
百度学术 |
百度学术中相似的文章 |
[admin]的文章 |
必应学术 |
必应学术中相似的文章 |
[admin]的文章 |
相关权益政策 |
暂无数据 |
收藏/分享 |
除非特别说明,本系统中所有内容都受版权保护,并保留所有权利。