RSSD: defend against ransomware with hardware-isolated network-storage codesign and post-attack analysis

Abstract

Encryption ransomware has become a notorious malware. It encrypts user data on storage devices like solid-state drives (SSDs) and demands a ransom to restore data for users. To bypass existing defenses, ransomware would keep evolving and performing new attack models. For instance, we identify and validate three new attacks, including (1) garbage-collection (GC) attack that exploits storage capacity and keeps writing data to trigger GC and force SSDs to release the retained data; (2) timing attack that intentionally slows down the pace of encrypting data and hides its I/O patterns to escape existing defense; (3) trimming attack that utilizes the trim command available in SSDs to physically erase data.To enhance the robustness of SSDs against these attacks, we propose RSSD, a ransomware-aware SSD. It redesigns the flash management of SSDs for enabling the hardware-assisted logging, which can conservatively retain older versions of user data and received storage operations in time order with low overhead. It also employs hardware-isolated NVMe over Ethernet to expand local storage capacity by transparently offloading the logs to remote cloud/servers in a secure manner. RSSD enables post-attack analysis by building a trusted evidence chain of storage operations to assist the investigation of ransomware attacks. We develop RSSD with a real-world SSD FPGA board. Our evaluation shows that RSSD can defend against new and future ransomware attacks, while introducing negligible performance overhead.

Crypto-Ransomware: A Revision of the State of the Art, Advances and Challenges

“…A recent work is reference [223], where a ransomware SSD (State Solid Disk) (RSSD) controller is constructed based on an assisted hardware registry. This keeps old data copies in a conservative way and performs storage requests with a small overhead.…”

Analyzing Data Theft Ransomware Traffic Patterns Using BERT

“…This led to a notable transition in the ransomware landscape, where recent trends have witnessed a pivot towards ransomware strategies that prioritize data exfiltration [10,11]. This new breed of ransomware, exemplified by groups like Royal and Ragnar Locker, has adopted a dual-threat approach that combines the conventional method of encryption with the additional threat of exposing stolen data [5,12].…”

“…The progression from crypto-ransomware to ransomware that prioritizes data exfiltration signifies a more complex and menacing threat environment [4,5,12]. Data exfiltration, which entails the unauthorized copying, transferring, or retrieving of data from a computer or server, represents a ransomware variant that is frequently carried out through network channels [11,13,14].…”

RSSD: defend against ransomware with hardware-isolated network-storage codesign and post-attack analysis

“…Performance of RSSD: Our evaluation shows that (1) RSSD can retain the stale data for a much longer time than state-of-the-art approaches, over 200 days in our evaluation (see Figure 2); (2) It has less than 1% negative impact on storage performance and minimal impact on device lifetime; (3) It performs fast data recovery after attacks; (4) It enables efficient post-attack analysis by building a trusted chain of I/O operations (see [3] for the full evaluation).…”