Refine your search
Collections
Co-Authors
Journals
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z All
Popli, Navneet Kaur
- WannaCry Malware Analysis
Abstract Views :548 |
PDF Views:7
Authors
Affiliations
1 Tilak Maharashtra Vidyapeeth, Pune, IN
2 Founder Sedulity Solutions and Technologies, IN
1 Tilak Maharashtra Vidyapeeth, Pune, IN
2 Founder Sedulity Solutions and Technologies, IN
Source
MERI-Journal of Management & IT, Vol 10, No 2 (2017), Pagination:Abstract
In business scenarios today, the most precious asset is computer systems and the data which is stored in them. Attackers are well aware of this fact and that is the reason why they can easily make money by holding this data at ransom. This is the reason why ransomware form of malware is on constant rise and is threatening businesses. WannaCry is one such ransomware which recently caused great havoc in many countries, affecting public amenities like health, in addition to causing huge monetary losses and losses to data. In this paper we will analyze wannacry in detail to understand its architecture, working, damages it caused and how the kill-switch worked to stop the damages for some time. We will also understand the various precautions to be taken to be protected from such ransomware in the future.Keywords
Ransomware, WannaCry, SMB Vulnerability, Doublepulsar, Bitcoins, TOR.
References
- Certin, M. (2017, May 13) . Wannacry/WannaCrypt Ransomware. Retrieved from Cyber Swachhta Kendra Website: http://www.cyberswachhtakendra.gov.in/alerts/wannacry_ransomware.html
- Cert,E. (2017). WannaCry Ransomware Campaign Exploiting SMB Vulnerability. Retrieved from Cert Europa Website: https://cert.europa.eu/static/SecurityAdvisories/2017/CERT-EU-SA2017012.pdf
- Mercaldo, F., Nardone, V., Santone, A., & Visaggio, C. A. (2016, June). Ransomware steals your phone. Formal methods rescue it. In International Conference on Formal Techniques for Distributed Objects, Components, and Systems (pp. 212-221). Springer International Publishing.
- Klosowski ,T. (2014, Feb 2). What is Tor and Should I Use it. Retrieved from http://lifehacker.com/
- McNeil,A.(2017, May 19). How did the WannaCry Ransomware Spread? Retrieved from https://blog.malwarebytes.com/
- Scaife, N., Carter, H., Traynor, P., & Butler, K. R. (2016, June). Cryptolock (and drop it): stopping ransomware attacks on user data. In Distributed Computing Systems (ICDCS), 2016 IEEE 36th International Conference on (pp. 303-312).IEEE.
- Gazet, A. (2010). Comparative analysis of various ransomware virii. Journal in computer virology, 6(1), 77-90.
- Kharraz, A., Robertson, W., Balzarotti, D., Bilge, L., & Kirda, E. (2015, July). Cutting the gordian knot: A look under the hood of ransomware attacks. In International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 3-24). Springer International Publishing.
- Andronio, N., Zanero, S., & Maggi, F. (2015, November). HelDroid: Dissecting and detecting mobile ransomware. In International Workshop on Recent Advances in Intrusion Detection (pp. 382-404). Springer International Publishing.
- Sterling, B.(2017,April 4). Double Pulsar NSA Leaked Hacks in the Wild. Retrieved from https://www.wired.com/beyond-the-beyond/2017/04/double-pulsar-nsa-leaked-hacks-wild/
- Digitalizing Primary Education Using Cloud Computing Data Center
Abstract Views :245 |
PDF Views:5
Authors
Affiliations
1 MERI, IN
1 MERI, IN
Source
MERI-Journal of Management & IT, Vol 10, No 1 (2016), Pagination: 14-17Abstract
Foundation of the education starts with the primary classes. Any growing phenomena needs to have a strong foundation, so as the erection towards tops can be supported firmly. In education also, the more the primary education are clearer to the pupils, the higher education for them will be easy to be completed confidently with talent".Keywords
Cloud Computing Datacentres, Digitalising, e-Learning, ICT, Primary Education, IaaS, Paas, Saas, CapEx, OpEx.References
- http://searchcloudcomputing.techtarget.com/definition/cloud-computing
- http://cloudtweaks.com/2014/12/cloud-computing-education-growth/
- http://www.intel.co.uk/content/dam/doc/case-study/cloud-computingeducation-21st-century-e-learning-study.pdf
- http://pubs.sciepub.com/iscf/2/1/2/
- Wikipedia, 2016,"Storage area network", Available at:
- http://iite.unesco.org/pics/publications/en/files/3214674.pdf
- PMASCE-Polymorphic and Metamorphic Shellcode Creation Engine
Abstract Views :403 |
PDF Views:5
Authors
Affiliations
1 Tilak Maharashtra Vidyapeeth, Pune, IN
2 Sedulity Solutions and Technologies Delhi, IN
1 Tilak Maharashtra Vidyapeeth, Pune, IN
2 Sedulity Solutions and Technologies Delhi, IN
Source
MERI-Journal of Management & IT, Vol 11, No 1 (2017), Pagination: 39-55Abstract
Signature detection is ultimately going to be of no use in the future of AVs and IDS systems. The obfuscation of several parts of the exploit code is becoming so detailed that it could become almost impossible to uncover the various layers of obfuscation and reveal the actual malicious payload. In addition to obfuscation, there are sandbox evasion techniques being followed by attackers to hide from IDS if they try to study their behaviour in a simulated environment. Also, a worm may not attack in one go but in multiple stages, probably sending a small, innocent looking code first, which prepares the system for advance attacks. The worm may become polymorphic or metamorphic depending upon the attack complexity required. Polymorphic blending enables a worm to merge with normal traffic so well that anomaly-based IDS’ are unable to discern it from normal packets. To top it all, attackers are now able to create a M:N worm which means that a worm can have many signatures, many behaviours. This is done by changing the runtime behaviour of the shellcode. In this paper we propose an engine called PMASCE-Polymorphic and Metamorphic Shellcode Creation Engine. This engine enumerates all the steps which are required to be followed to create a strong polymorphic or metamorphic shellcode. This type of shellcode is created taking into account all the defence mechanisms carried out by the detection systems currently. Once all these steps are analysed, we aim to advance the research in IDS so that the existing IDS’ can be hardened to detect all malwarespolymorphic or metamorphic, employing all kinds of techniques of the present and the future.Keywords
Malware, IDPs, Sandbox, Polymorphic Shellcodes, Obfuscation, Blending, Metamorphism.References
- Prahbu, P. V., Song, Y., & Stolfo, S. J.,(2009). “Smashing the Stack with Hydra: The Many Heads of Advanced Polymorphic Shellcode”, Defcon, 17, 1-20.
- Sarraute, C., Miranda, F., & Orlicki, J. I.,(2010) “Simulation of computer network attacks”, arXiv preprint arXiv:1006.2407.
- Konstantinou, E., & Wolthusen, S., (2008) “Metamorphic virus: Analysis and detection”, Technical Report, Royal Holloway University of London, 15 .
- x86 Instruction Sequence, Article, Accessed: 24 July 2017, Available via: http://x86.renejeschke.de/html/file_module_x86_id_217.html
- Akritidis, P., Markatos, E. P., Polychronakis, M., & Anagnostakis, K., “Stride: Polymorphic sled detection through instruction sequence analysis”, IFIP International Information Security Conference, pp. 375-391, Springer, Boston, MA(2005, May).
- Haugsness K., ”IDFAQ: What is polymorphic shell code and what can it do?”, Article, SANS, Accessed: 10 July 2017, Available via: https://www2.sans.org/security-resources/idfaq/what-is-polymorphic-shell-code-and-what-can-it-do/2/19
- Johansson K., ”Re:pen testing & obfuscated shellcode(more neat stuff)”, Article, Accessed: 9 July 2017, Available via: http://seclists.org/pen-test/2004/Feb/69
- CourseHero, “Trampolining despite the fact that nop sledding makes”, Article, Accessed: 26 June 2017, Available via: https://www.coursehero.com/file/p2o51ar/Trampolining-Despite-the-fact-that-NOP-sledding-makes-stack-based-buffer
- Polychronakis, M., Anagnostakis, K. G., & Markatos, E. P., “Emulation-based detection of non-self-contained polymorphic shellcode”, International Workshop on Recent Advances in Intrusion Detection, pp. 87-106. Springer, Berlin, Heidelberg, September, 2007.
- CERT UK
- Sharif, M. I., Lanzi, A., Giffin, J. T., & Lee, W. , “Impeding Malware Analysis Using Conditional Code Obfuscation”, NDSS, February, 2008.
- Christodorescu, M., & Jha, S. , “Static analysis of executables to detect malicious patterns”,. Wisconsin Univ-Madison Dept of Computer Sciences, 2006.
- Song, Y., Locasto, M. E., Stavrou, A., Keromytis, A. D., & Stolfo, S. J., “On the infeasibility of modeling polymorphic shellcode”, Proceedings of the 14th ACM conference on Computer and communications security, pp. 541-551, ACM, 2007, October.
- Li, X., Loh, P. K., & Tan, F,(2008) “Mechanisms of polymorphic and metamorphic viruses”, Intelligence and Security Informatics Conference (EISIC), 2011 European, pp. 149-154, IEEE, 2011, September.
- Borello, J. M., & Mé, L., “Code obfuscation techniques for metamorphic viruses”. Journal in Computer Virology, 4(3), pp. 211-220 .
- Crandall, J. R., Su, Z., Wu, S. F., & Chong, F. T. ,(2005) “On deriving unknown vulnerabilities from zero-day polymorphic and metamorphic worm exploits”, Proceedings of the 12th ACM conference on Computer and communications security, pp. 235-248, ACM, November.
- Rad, B. B., Masrom, M., & Ibrahim, S.,(2012) “Camouflage in malware: from encryption to metamorphism”, International Journal of Computer Science and Network Security, 12(8), 74-83.
- Song, Y., Locasto, M. E., Stavrou, A., Keromytis, A. D., & Stolfo, S. J.. “On the infeasibility of modeling polymorphic shellcode”, Proceedings of the 14th ACM conference on Computer and communications security (pp. 541-551). ACM, October, 2007.
- Cheng, T. H., Lin, Y. D., Lai, Y. C., & Lin, P. C. , “Evasion techniques: Sneaking through your intrusion detection/prevention systems”. IEEE Communications Surveys & Tutorials, 14(4), 1011-1020, 2012.
- Fogla, P., Sharif, M. I., Perdisci, R., Kolesnikov, O. M., & Lee, W. , “Polymorphic Blending Attacks”. In USENIX Security Symposium (pp. 241-256), 2006, July.
- Balakrishnan, A., & Schulze, C. . “Code obfuscation literature survey”. CS701 Construction of compilers, 19, 2005.