Zobrazit v EDS

How to Circumvent and Beat the Ransomware in Android Operating System—A Case Study of Locker.CB!tr.

Uloženo v:
Podrobná bibliografie
Název: How to Circumvent and Beat the Ransomware in Android Operating System—A Case Study of Locker.CB!tr.
Autoři: Drabent, Kornel, Janowski, Robert, Mongay Batalla, Jordi
Zdroj: Electronics (2079-9292); Jun2024, Vol. 13 Issue 11, p2212, 20p
Témata: RANSOMWARE, SOURCE code, CELL phones
Abstrakt: Ransomware is one of the most extended cyberattacks. It consists of encrypting a user's files or locking the smartphone in order to blackmail a victim. The attacking software is ordered on the infected device from the attacker's remote server, known as command and control. In this work, we propose a method to recover from a Locker.CB!tr ransomware attack after it has infected and hit a smartphone. The novelty of our approach lies on exploiting the communication between the ransomware on the infected device and the attacker's command and control server as a point to reverse disruptive actions like screen locking or file encryption. For this purpose, we carried out both a dynamic and a static analysis of decompiled Locker.CB!tr ransomware source code to understand its operation principles and exploited communication patterns from the IP layer to the application layer to fully impersonate the command and control server. This way, we gained full control over the Locker.CB!tr ransomware instance. From that moment, we were able to command the Locker.CB!tr ransomware instance on the infected device to unlock the smartphone or decrypt the files. The contributions of this work are a novel method to recover the mobile phone after ransomware attack based on the analysis of the ransomware communication with the C&C server; and a mechanism for impersonating the ransomware C&C server and thus gaining full control over the ransomware instance. [ABSTRACT FROM AUTHOR]
Copyright of Electronics (2079-9292) is the property of MDPI and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)
Databáze: Complementary Index
Popis
Abstrakt:Ransomware is one of the most extended cyberattacks. It consists of encrypting a user's files or locking the smartphone in order to blackmail a victim. The attacking software is ordered on the infected device from the attacker's remote server, known as command and control. In this work, we propose a method to recover from a Locker.CB!tr ransomware attack after it has infected and hit a smartphone. The novelty of our approach lies on exploiting the communication between the ransomware on the infected device and the attacker's command and control server as a point to reverse disruptive actions like screen locking or file encryption. For this purpose, we carried out both a dynamic and a static analysis of decompiled Locker.CB!tr ransomware source code to understand its operation principles and exploited communication patterns from the IP layer to the application layer to fully impersonate the command and control server. This way, we gained full control over the Locker.CB!tr ransomware instance. From that moment, we were able to command the Locker.CB!tr ransomware instance on the infected device to unlock the smartphone or decrypt the files. The contributions of this work are a novel method to recover the mobile phone after ransomware attack based on the analysis of the ransomware communication with the C&C server; and a mechanism for impersonating the ransomware C&C server and thus gaining full control over the ransomware instance. [ABSTRACT FROM AUTHOR]
ISSN:20799292
DOI:10.3390/electronics13112212