Ransomware: Analysis and Evaluation of Live Forensic Techniques and the Impact on Linux based IoT Systems
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866911814084722688 |
|---|---|
| author | Korac, Salko Maglaras, Leandros Moradpoor, Naghmeh Buchanan, Bill Canberk, Berk |
| author_facet | Korac, Salko Maglaras, Leandros Moradpoor, Naghmeh Buchanan, Bill Canberk, Berk |
| contents | Ransomware has been predominantly a threat to Windows systems. But, Linux systems became interesting for cybercriminals and this trend is expected to continue. This endangers IoT ecosystems, whereas many IoT systems are based on Linux (e.g. cloud infrastructure and gateways). This paper researches how currently employed forensic techniques can be applied to Linux ransomware and evaluates the maturity as well as the impact on the system. While Windows-based ransomware predominantly uses RSA and AES for key management, a variety of approaches was identified for Linux. Cybercriminals appear to be deliberately moving away from RSA and AES to make Live forensic investigations more difficult. Linux ransomware is developed for a predefined goal and does not exploit the full potential of damage. It appears in an early stage and is expected to reach a similar potential to Windows-based malware. The results generated provided an excellent basic understanding to discuss and assess implications on the IoT industry at an early stage of development. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2403_17571 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Ransomware: Analysis and Evaluation of Live Forensic Techniques and the Impact on Linux based IoT Systems Korac, Salko Maglaras, Leandros Moradpoor, Naghmeh Buchanan, Bill Canberk, Berk Cryptography and Security Ransomware has been predominantly a threat to Windows systems. But, Linux systems became interesting for cybercriminals and this trend is expected to continue. This endangers IoT ecosystems, whereas many IoT systems are based on Linux (e.g. cloud infrastructure and gateways). This paper researches how currently employed forensic techniques can be applied to Linux ransomware and evaluates the maturity as well as the impact on the system. While Windows-based ransomware predominantly uses RSA and AES for key management, a variety of approaches was identified for Linux. Cybercriminals appear to be deliberately moving away from RSA and AES to make Live forensic investigations more difficult. Linux ransomware is developed for a predefined goal and does not exploit the full potential of damage. It appears in an early stage and is expected to reach a similar potential to Windows-based malware. The results generated provided an excellent basic understanding to discuss and assess implications on the IoT industry at an early stage of development. |
| title | Ransomware: Analysis and Evaluation of Live Forensic Techniques and the Impact on Linux based IoT Systems |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2403.17571 |