Intel SGX Enabled Ransomware: A Potentially New Malware Strain In the Future?

勒索软件是一种恶意软件，它使用基于密码学的安全机制劫持用户资源和文件，要求赎金以换取解密数据的私钥。这导致了一种独特的生态系统的诞生，并为网络犯罪分子提供了一种高利润的业务，可以有效地从被他们感染计算机的组织和个人那里勒索金钱。与传统恶意软件不同的是，勒索软件没有其创建者的合作和解密密钥，在大多数情况下，它的影响很难减轻，即使在删除后也不可逆。勒索软件在过去十年中越来越受欢迎的原因有很多。首先，加密的使用是有效的，几乎是牢不可破的，由于其高概率成功回报恶意软件投资，为攻击者提供了极大的信心。其次，使用匿名网络货币会使追踪变得困难。第三，随时可用的勒索软件工具可以轻松进入。这项研究旨在揭示网络犯罪分子如何开发新的勒索软件变体，利用英特尔的SGX安全和私有执行能力，安全地管理受害者不可信内存上的秘密加密密钥，并可能将其用于攻击目的。这项研究主要集中在调查攻击者如何利用英特尔SGX来克服现有勒索软件所面临的限制，特别是在密钥管理方案方面。为该项目设定了以下目标：-对勒索软件目前如何管理加密密钥进行彻底调查。-调查勒索软件作者如何利用创新技术，如英特尔SGX，来增强当前的密钥管理方案。-开发一个概念验证，显示使用英特尔SGX管理加密密钥的可行性。-调查攻击者如何在支付赎金后启动密钥释放

Ransomware is a type of malware that uses a security mechanism based on cryptography to hijack user resources and files to demand a ransom in exchange for a private key that decrypts the data. This led to the creation of a unique ecosystem and a highly lucrative business for cybercriminals to effectively extort money from organisations and individuals whose computers they infect. Unlike traditional malware, without the co-operation and decryption key from its creator, the effect from ransomware in most cases is difficult to mitigate and irreversible even after removal. There are a number of reasons why ransomware has gained increasing popularity over the past decade. Firstly, the use of encryption is effective and virtually unbreakable, providing the attacker great confidence due to its high probability of successful return on malware investment. Secondly, the use of an anonymous cyber-currency can make traceability hard. Thirdly, the readily available ransomware tools enables easy entry.This research aims to shed some light on how a cybercriminal could develop new ransomware variants that could leverage Intel's SGX secure and private execution capability to securely manage secret cryptographic keys on victim's untrusted memory and potentially use it for offensive purposes. The research is mainly focused on investigating how Intel SGX could be leveraged by an attacker to overcome limitations faced by existing ransomware strains, in particular on key management schemes. The following objectives have been set for the project:-Conduct a thorough investigation into how ransomware currently manages the cryptographic keys.-Investigate how ransomware authors could leverage innovative technology, such as Intel SGX, to enhance the current key management schemes.-Develop a proof-of-concept showing the feasibility of using Intel SGX to manage the cryptographic keys.-Investigate how an attacker can initiate the release of the key once the ransom is paid