Intel SGX Enabled Ransomware: A Potentially New Malware Strain In the Future?

点击翻译按钮获取中文摘要

Ransomware is a type of malware that uses a security mechanism based on cryptography to hijack user resources and files to demand a ransom in exchange for a private key that decrypts the data. This led to the creation of a unique ecosystem and a highly lucrative business for cybercriminals to effectively extort money from organisations and individuals whose computers they infect. Unlike traditional malware, without the co-operation and decryption key from its creator, the effect from ransomware in most cases is difficult to mitigate and irreversible even after removal. There are a number of reasons why ransomware has gained increasing popularity over the past decade. Firstly, the use of encryption is effective and virtually unbreakable, providing the attacker great confidence due to its high probability of successful return on malware investment. Secondly, the use of an anonymous cyber-currency can make traceability hard. Thirdly, the readily available ransomware tools enables easy entry.This research aims to shed some light on how a cybercriminal could develop new ransomware variants that could leverage Intel's SGX secure and private execution capability to securely manage secret cryptographic keys on victim's untrusted memory and potentially use it for offensive purposes. The research is mainly focused on investigating how Intel SGX could be leveraged by an attacker to overcome limitations faced by existing ransomware strains, in particular on key management schemes. The following objectives have been set for the project:-Conduct a thorough investigation into how ransomware currently manages the cryptographic keys.-Investigate how ransomware authors could leverage innovative technology, such as Intel SGX, to enhance the current key management schemes.-Develop a proof-of-concept showing the feasibility of using Intel SGX to manage the cryptographic keys.-Investigate how an attacker can initiate the release of the key once the ransom is paid