论文标题
评估勒索软件攻击缓解措施中的实用法医技术
Evaluation of Live Forensic Techniques in Ransomware Attack Mitigation
论文作者
论文摘要
内存是从被勒索软件感染的系统中捕获的，并使用实时法医工具检查了其内容，并目的是识别使用的对称加密密钥。在调查期间，测试了NotPetya，Bad Rabbit和Phobos混合勒索软件样品。如果发现键，还执行以下两个步骤。首先，通过组合来自多个来源的数据来说明勒索软件的行为，并显示内存中存在加密密钥何时以及它们剩下多长时间，可以手动创建时间表。其次，尝试使用发现的密钥将勒索软件加密的文件进行了尝试。在所有情况下，调查都能够确认可以识别使用的加密密钥。还提供了对这些键如何成功地解密在执行勒索软件期间已加密的文件的描述。生成的时间表提供了一种绝佳的方式，可以看到勒索软件的行为和所采用的加密密钥管理实践，以及从法医调查和可能的缓解观点，当加密密钥在内存中时。
Memory was captured from a system infected by ransomware and its contents was examined using live forensic tools, with the intent of identifying the symmetric encryption keys being used. NotPetya, Bad Rabbit and Phobos hybrid ransomware samples were tested during the investigation. If keys were discovered, the following two steps were also performed. Firstly, a timeline was manually created by combining data from multiple sources to illustrate the ransomware's behaviour as well as showing when the encryption keys were present in memory and how long they remained there. Secondly, an attempt was made to decrypt the files encrypted by the ransomware using the found keys. In all cases, the investigation was able to confirm that it was possible to identify the encryption keys used. A description of how these found keys were then used to successfully decrypt files that had been encrypted during the execution of the ransomware is also given. The resulting generated timelines provided a excellent way to visualise the behaviour of the ransomware and the encryption key management practices it employed, and from a forensic investigation and possible mitigation point of view, when the encryption keys are in memory.
