to Defend Against Encryption Ransomware Jian Huang Jun Xu - PowerPoint PPT Presentation

FlashGuard: Leveraging Intrinsic Flash Properties to Defend Against Encryption Ransomware Jian Huang † ‡ Jun Xu Xinyu Xing Peng Liu Moinuddin K. Qureshi † † ‡

Encryption Ransomware Is Becoming More Aggressive May 12, 2017 2

Encryption Ransomware Is Becoming More Aggressive May 12, 2017 230,000+ computers 150+ countries $300-$600 per ransom 2

What Is Encryption Ransomware ? Destroy Ask for payments Encrypt files original files to decrypt files 3

What Is Encryption Ransomware ? 3

What Is Encryption Ransomware ? A ransom notification: users files have been encrypted 3

What Is Encryption Ransomware ? A ransom notification: users files have been encrypted Pay ransom to recover user files 3

What Is Encryption Ransomware ? A ransom notification: users files have been encrypted Pay ransom to recover user files 3

What Is Encryption Ransomware ? A ransom notification: users files have been encrypted Pay ransom to recover More ransom user files required if the payment is delayed 3

Characteristics of Encryption Ransomware Family #Samples Attack Time (minutes) Backup Spoliation Petya 14 2 CTB-Locker 119 14 Jigsaw 5 16 Mobef 7 16 Maktub 10 22 Stampado 42 27 Cerber 29 37 Locky 344 43 7ev3n 16 44 TeslaCrypt 75 44 HydraCrypt 13 70 CryptoFortree 4 75 CrytoWall 799 75 4 Total 1477

Characteristics of Encryption Ransomware Family #Samples Attack Time (minutes) Backup Spoliation Petya 14 2 CTB-Locker 119 14 Jigsaw 5 16 How long does it take for Mobef 7 16 Maktub 10 22 ransomware to finish the attack ? Stampado 42 27 Cerber 29 37 Locky 344 43 7ev3n 16 44 TeslaCrypt 75 44 HydraCrypt 13 70 CryptoFortree 4 75 CrytoWall 799 75 4 Total 1477

Characteristics of Encryption Ransomware Family #Samples Attack Time (minutes) Backup Spoliation Petya 14 2 CTB-Locker 119 14 Jigsaw 5 16 Mobef 7 16 Maktub 10 22 Stampado 42 27 Ask for ransom quickly Cerber 29 37 Locky 344 43 7ev3n 16 44 TeslaCrypt 75 44 HydraCrypt 13 70 CryptoFortree 4 75 CrytoWall 799 75 4 Total 1477

Characteristics of Encryption Ransomware Family #Samples Attack Time (minutes) Backup Spoliation Petya 14 2 CTB-Locker 119 14 Jigsaw 5 16 Mobef 7 16 Maktub 10 22 Stampado 42 27 Cerber 29 37 Locky 344 43 7ev3n 16 44 TeslaCrypt 75 44 HydraCrypt 13 70 CryptoFortree 4 75 CrytoWall 799 75 4 Total 1477

Characteristics of Encryption Ransomware Family #Samples Attack Time (minutes) Backup Spoliation Petya 14 2 CTB-Locker 119 14 Jigsaw 5 16 Mobef 7 16 Many ransomware attempt Maktub 10 22 to delete backup files Stampado 42 27 Cerber ( and bypass User Access Control ) 29 37 Locky 344 43 7ev3n 16 44 TeslaCrypt 75 44 HydraCrypt 13 70 CryptoFortree 4 75 CrytoWall 799 75 4 Total 1477

Why Existing Solutions Are Not Good Enough ? Malware detection 5

Why Existing Solutions Are Not Good Enough ? Malware detection Damage has already happened when ransomware is detected 5

Why Existing Solutions Are Not Good Enough ? Journaling & Malware detection log-structured FS 5

Why Existing Solutions Are Not Good Enough ? Journaling & Malware detection log-structured FS Ransomware with kernel privilege can destroy data backups 5

Why Existing Solutions Are Not Good Enough ? Journaling & Networked & Malware detection log-structured FS Cloud Storage 5

Why Existing Solutions Are Not Good Enough ? Journaling & Networked & Malware detection log-structured FS Cloud Storage Increased storage cost & can be stopped by ransomware 5

Threat Model of Encryption Ransomware Application userspace kernel Block Driver read/write Block I/O Interface Disk Flash Translation Layer NAND Flash 6

Threat Model of Encryption Ransomware Application userspace kernel Block Driver read/write Block I/O Interface Disk Flash Translation Layer NAND Flash 6

Threat Model of Encryption Ransomware Application userspace kernel Block Driver read/write Block I/O Interface Our Goal: defend against encryption ransomware without relying on software-based solutions & Disk Flash Translation Layer without explicit data backups NAND Flash 6

Threat Model of Encryption Ransomware Application userspace kernel Block Driver read/write Block I/O Interface Disk Flash Translation Layer NAND Flash Hard Disk Drive Flash-based SSD 6

Flash Performs Better Than Hard Disk Drive No Seek Latency 40 x lower latency 7

Flash Performs Better Than Hard Disk Drive No Seek Increased Latency Parallelism Dozens of 40 x lower latency parallel chips 7

Flash Performs Better Than Hard Disk Drive No Seek Increased Became Latency Parallelism Commodity Dozens of 40 x lower latency Less than $ 0.2 /GB parallel chips 7

Flash Performs Better Than Hard Disk Drive No Seek Increased Became Latency Parallelism Commodity Dozens of 40 x lower latency Less than $ 0.2 /GB parallel chips Significant improvements on Flash 7

How Flash Is Used Today ? Application File System Flash-based Disk 8

How Flash Is Used Today ? Application File System Flash Translation Layer Flash 8

How Flash Is Used Today ? Application File System Flash Translation Layer Flash Out-of-Place Update A 8

How Flash Is Used Today ? Application File System Flash Translation Layer Flash Out-of-Place Update Write A 8

How Flash Is Used Today ? Application File System Flash Translation Layer Flash Out-of-Place Update Write A A B 8

How Flash Is Used Today ? Application File System Flash Translation Layer Flash Out-of-Place Update Write Garbage Collection A A B 8

FlashGuard: Leveraging Intrinsic Flash Properties Application userspace kernel Block Driver read/write Block I/O Interface Flash-based SSD Flash Translation Layer Flash 9

FlashGuard: Leveraging Intrinsic Flash Properties Application userspace kernel Block Driver read/write Block I/O Interface Flash Translation Layer Flash 9

Retaining Data in SSDs without Hardware Modification Overwrite a block Overwrite A Overwrite on SSD 10

Retaining Data in SSDs without Hardware Modification Overwrite a block Overwrite A A B Overwrite on SSD 10

Retaining Data in SSDs without Hardware Modification Overwrite a block Overwrite A A A B Overwrite on SSD Overwrite on HDD 10

Retaining Data in SSDs without Hardware Modification Overwrite a block Overwrite Overwrite A A B A B Overwrite on SSD Overwrite on HDD 10

Retaining Data in SSDs without Hardware Modification Retaining all the invalid pages Overwrite a block (stale data) is expensive Overwrite Overwrite A A B A B Overwrite on SSD Overwrite on HDD 10

Retaining Data in SSDs without Hardware Modification Retaining all the invalid pages Overwrite a block (stale data) is expensive Overwrite Overwrite A A B A B Overwrite on SSD Overwrite on HDD Only retain the invalid pages caused by encryption ransomware 10

FlashGuard: A Ransomware-Aware SSD File Read Encrypt Overwrite File Read Encrypt Write new files Delete/Overwrite 11

FlashGuard: A Ransomware-Aware SSD Read Overwrite File Read Encrypt Overwrite Read File Overwrite Read Encrypt Write new files Delete/Overwrite 11

FlashGuard: A Ransomware-Aware SSD Read Overwrite File Read Encrypt Overwrite Read File Overwrite Read Encrypt Write new files Delete/Overwrite FlashGuard only retains invalid pages that have been read for a certain period of time 11

FlashGuard: A Ransomware-Aware SSD Read Write Read-Overwrite 100% Ratio of different IO operations 80% 60% 40% 20% 0% University computers ( 20 days) Enterprise servers ( 6-10 days) 11

FlashGuard: A Ransomware-Aware SSD Read Write Read-Overwrite 100% Ratio of different IO operations 80% 60% 40% 20% 0% University computers ( 20 days) Enterprise servers ( 6-10 days) 11

FlashGuard: A Ransomware-Aware SSD Read Write Read-Overwrite 100% Ratio of different IO operations 80% The data size is 60% relatively small (a few GBs) 40% 20% 0% University computers ( 20 days) Enterprise servers ( 6-10 days) 11

Tracking Invalid Data with Out-of-Band Metadata Data OOB Metadata Flash Page LPA P-PPA Timestamp RIP Flash Block 4 Bytes 4 Bytes 4 Bytes 1 bit The logical page address mapped to the physical page 12

Tracking Invalid Data with Out-of-Band Metadata Data OOB Metadata Flash Page LPA P-PPA Timestamp RIP Flash Block 4 Bytes 4 Bytes 4 Bytes 1 bit Previous physical page address for tracking all invalid pages 12

Tracking Invalid Data with Out-of-Band Metadata Data OOB Metadata Flash Page LPA P-PPA Timestamp RIP Flash Block 4 Bytes 4 Bytes 4 Bytes 1 bit Check how long the page has been retained 12

Tracking Invalid Data with Out-of-Band Metadata Data OOB Metadata Flash Page LPA P-PPA Timestamp RIP Flash Block 4 Bytes 4 Bytes 4 Bytes 1 bit Identify whether this page is a retained invalid page 12