RansomClave project uses Intel SGX enclaves for ransomware attacks

guest · Aug 19, 2021

RansomClave project uses Intel SGX enclaves for ransomware attacks
August 19, 2021
https://therecord.media/ransomclave-project-uses-intel-sgx-enclaves-for-ransomware-attacks/

Academics have developed a proof-of-concept ransomware strain that uses highly secure Intel SGX enclaves to hide and keep encryption keys safe from the prying eyes of security tools.

Named RansomClave, the project was developed by Alpesh Bhudia, Daniel O’Keeffe, Daniele Sgandurra, and Darren Hurley-Smith, all four from the University of London.

“A typical ransomware attack lifecycle goes through four main phases: installation, unique public/private key generation, encryption (with symmetric keys), and extortion/private key release,” the researchers said in a research paper published last month.
Today, several ransomware strains generate and store these encryption keys in untrusted areas of a computer’s memory and then discard the key after the encryption process ends, or the key gets deleted when infected systems are rebooted.
Click to expand...

RansomClave is the result of the team’s curiosity. It is a proof-of-concept ransomware strain that uses Intel SGX enclaves to safely handle encryption keys.

In addition, it also uses the enclave to automatically decrypt files on the infected host when the enclave detects that a payment to a specific address on a cryptocurrency blockchain has been made.
Click to expand...

In an email last week, Mark Loman, Director Of Engineering at Sophos, told The Record why projects like RansomClave, while ingenious, would likely not be adopted by real ransomware gangs, as they’ve already changed how they carry out these attacks.
He explained:

RansomClave aims to break a recovery approach called PayBreak, which they reference and was documented in another research paper from 2017. For PayBreak to work, the ransomware must use the Windows CryptoAPI, monitored by PayBreak. Mentioned ransomware families that use CryptoAPI are the original CryptoLocker and CryptoWall – both gone since years. In real-world attacks there is no PayBreak software on the machines, so memory must be scraped instead, hoping it still contains any encryption keys.

For ransomware gangs today, storing the encryption keys in a CPU enclave makes no sense. RansomClave looks to solve a problem that doesn’t exist anymore.
Click to expand...

For pretty obvious reasons, a project like RansomClave would be of great interest to ransomware gangs.

“We plan to keep all the [RansomClave] code private to prevent potential abuse,” Alpesh Bhudia, one of the four researchers behind the project, told The Record in an email conversation last week when asked about the potential Pandora’s box his team was opening.
Click to expand...

arXiv: RansomClave: Ransomware Key Management using SGX
(PDF): https://arxiv.org/pdf/2107.09470

Rasheed187 · Aug 21, 2021

It's ridiculous, why would you want to give malware writers such ideas. But Mark Loman says it's most likely not going to be used, so that's a good thing.

Log in or Sign up

RansomClave project uses Intel SGX enclaves for ransomware attacks

guest Guest

Rasheed187 Registered Member

Log in or Sign up

RansomClave project uses Intel SGX enclaves for ransomware attacks

guest Guest

Rasheed187 Registered Member

Useful Searches