Files and links (1)
CC BY V4.0, Open Access
Journal article
Shared file protection against unauthorised encryption using a Buffer-Based Signature Verification Method
Journal of information security and applications, Vol.86, 103873
2024
Abstract
Understanding the attributes of critical data and implementing suitable security measures help organisations bolster their data-protection strategies and diminish the potential impacts of ransomware incidents. Unauthorised extraction and acquisition of data are the principal objectives of most cyber invasions. We underscore the severity of this issue using a recent attack by the Clop ransomware group, which exploited the MOVEit Transfer vulnerability and bypassed network-detection mechanisms to exfiltrate data via a Command and Control server. As a countermeasure, we propose a method called Buffer-Based Signature Verification (BBSV). This approach involves embedding 32-byte tags into files prior to their storage in the cloud, thus offering enhanced data protection. The BBSV method can be integrated into software like MOVEit Secure Managed File Transfer, thereby thwarting attempts by ransomware to exfiltrate data. Empirically tested using a BBSV prototype, our approach was able to successfully halt the encryption process for 80 ransomware instances from 70 ransomware families. BBSV not only stops the encryption but also prevents data exfiltration when data are moved or written from the original location by adversaries. We further develop a hypothetical exploit scenario in which an adversary manages to bypass the BBSV, illicitly transmits data to a Command and Control server, and then removes files from the original location. We construct an extended state space, in which each state represents a tuple that integrates user authentication and system components at the filesystem level.
Details
- Title
- Shared file protection against unauthorised encryption using a Buffer-Based Signature Verification Method
- Authors/Creators
- Arash Mahboubi - Charles Sturt UniversitySeyit Camtepe - Commonwealth Scientific and Industrial Research OrganisationKeyvan Ansari - Murdoch University, College of Science, Technology, Engineering and MathematicsMarcin Pawłowski - Jagiellonian UniversityPaweł Morawiecki - Polish Academy of SciencesHamed Aboutorab - Charles Sturt University, AustraliaJosef Pieprzyk - Data61Jarek Duda - Jagiellonian University
- Publication Details
- Journal of information security and applications, Vol.86, 103873
- Publisher
- Elsevier Ltd
- Identifiers
- 991005701566507891
- Copyright
- © 2024 The Author(s).
- Murdoch Affiliation
- Murdoch University
- Language
- English
- Resource Type
- Journal article
Metrics
3 File views/ downloads
35 Record Views