|
|
Criminological and criminal law aspects of the ransomware spread
Lédl, Kryštof ; Gřivna, Tomáš (advisor) ; Richter, Martin (referee)
67 Criminal-law aspects and criminological aspects of ransomware spread Abstract The thesis deals with the ransomware spread and its exploration from the perspective of criminology and substantive criminal law. This theme is still relevant as ransomware is still a highly used form of cybercrime, whose method of execution is being constantly improved by the perpetrators. The theme is further relevant because this form of cybercrime is also used as a form of waging war against another state, as may be seen e.g. in the increasing number of cyber-attacks incurring in connection with the current war between Ukraine and Russia. The first part of this thesis defines the term ransomware and then briefly describes the history of this type of cybercrime. This part further describes the different types of ransomware currently recognized by the professional community. Current trends in the ransomware spread are also outlined. The second part discusses the criminological aspects of ransomware, focusing primarily on explaining the ransomware spread by the criminological theories, examining the personality of the perpetrator and the victim from a criminological perspective, and exploring other criminological aspects of ransomware. The third part of the thesis concerns the assessment of ransomware spread under substantive...
|
|
|
Methods of Ransomware Analysis and Detection
Vojtáš, Samuel ; Kolář, Dušan (referee) ; Zobal, Lukáš (advisor)
The purpose of this thesis is to demonstrate the threat of malware and to describe its forms. Special focus is put on ransomware - its historical evolution, method of analysis, detection, and recovery from it. Various techniques of reverse engineering are also introduced alongside concepts related to it, such as static and dynamic analysis or sandboxing. Paper centers around creating detection mechanisms and malware classification. Company Avast provided samples of several ransomware families for the analysis to create detection YARA rules and to describe samples' behavior. The process of development of detection mechanisms for ransomware threats is shown alongside the method to decrypt files encrypted by various ransomware families that contained cryptography errors. The end of the thesis sums up the resulting data regarding the efficiency of defense mechanisms.
|
|
|
Cybercrime in the EU
Molnárová, Martina ; Loutocký, Pavel (referee) ; Stupka, Václav (advisor)
This bachelor thesis deals with cybercrime in the European Union at present time. It begins with a description of the most well-known historical cybercrimes, which has helped to create cybercrime as a separate branch of crime. Subsequently, the work describes the changes that have occurred in the development of cybercrime, describes the practical problems in prosecuting cybercrime and its current trends. At the same time, it outlines the problems that arise in producing adequate statistics. The practical part of the work then describes the basic function of the application, which was created to work for the purpose of providing information on cybercrime and clear mediation of available statistical information.
|
|
|
Criminological and criminal law aspects of the ransomware spread
Oborák, Daniel ; Gřivna, Tomáš (advisor) ; Bohuslav, Lukáš (referee)
The subject of this diploma thesis is the ransomware spread, which is currently one of the most prominent global cybernetic threats. Ransomware is malicious code that, when activated on a computer system, usually blocks access to that system or encrypts the data contained in it, which is then used to blackmail the user. This thesis deals with criminological and criminal aspects of this phenomenon. In its criminological part, this thesis deals with the issue of the etiology of the ransomware spread and its criminogenic factors, while examining, among other things, the applicability of cybercriminological theory named space transition theory to a given phenomenon. It also deals with the victimological aspect of the matter, listing the most fundamental factors influencing victimization, both in the case of widespread non-targeted ransomware attacks and in the case of specifically targeted attacks. It also examines the issue of the high latency of this phenomenon and cybercrime in general and the possibility of prevention, which it considers to be the best way to defend against a ransomware attack. In particular, it deals with the issue of ransomware attacks on hospitals and critical infrastructure, and also raises the issue of the increase in the number of attacks due to the COVID-19 pandemic. The...
|
|
|
Defeating Ransomware By Hooking System Calls On Windows Os
Touš, Filip
This paper explains why ransomware needs to use the Windows API to encrypt files andhow this can be utilized to protect sensitive data from ransomware. Critical API functions are examinedon a low level and a generic method to monitor and possibly block their usage through systemcall hooks is presented. This approach is then demonstrated with a custom kernel mode driver whichcan keep protected files safe from any user mode malware. It is then compared to current ransomwareprotection in Windows 10.
|
|
|
Analysis of malware
Bláha, Michael ; Caha, Tomáš (referee) ; Člupek, Vlastimil (advisor)
The aim of my bachelor thesis is to design a safe environment for the analysis of malicious software. In the theoretical part of the work, I deal with the basic division of computer viruses. Next, I describe two main procedures for malware analysis, namely static and dynamic analysis. I describe why they are used and what tools fall into these categories. I also present my methodology for secure malware analysis. In the practical part of the work, I focus on creating an analytical environment on Windows 10 and Fedora platforms. I use a graphical environment and a command line to create virtual machines. For the analysis of network traffic, I create the so-called "Fake Internet" program with the INetSim program. In the last part of the work, I deal with a sample analysis of selected types of computer viruses. I follow the described methodology. For each analysis, I describe a brief summary and results. At the end of the work, I describe a possible defense against malicious software.
|
|
|
Criminological and criminal law aspects of the ransomware spread
Fousek, Jan ; Gřivna, Tomáš (advisor) ; Bohuslav, Lukáš (referee)
Criminological and criminal law aspects of the ransomware spread Abstract This diploma thesis examines different aspects of criminology and criminal law with the issue of the malware spread in the form of ransomware. This text is divided into two main parts. First, the theoretical part consists of the chapters about cybercrime, malware and criminological and criminal law aspects of ransomware spread. It uses the substantive law and also procedural law perspective. All chapters are divided into subchapters dealing with the questions of offenders and victims, criminal law qualification of the ransomware phenomena and with related concepts used for the broader understanding of this kind of cybercrime. Second, the analytical part follows. This thesis combines different criminological research methods and tries to verify the main hypothesis regarding the increase in the number of ransomware attacks in the Czech Republic. The hypothesis is as follows: "The number of ransomware attacks registered by the Police of the Czech Republic has been increasing since 2016". This hypothesis cannot be accepted due to missing relevant data from the Police of the Czech Republic and other institutions. It can be said that for the period 2016-2018, there was 3 registered ransomware attacks per 100,000 inhabitants of the Czech...
|
|
|
Ransomware Obfuscation Techniques
Jacko, Jerguš ; Barabas, Maroš (referee) ; Kačic, Matej (advisor)
This master's thesis seeks to design, implement, and point out new techniques for obfuscation of ransomware activity using the entropy principles of data that do not fall within the detection capabilities of known anti-ransomware and anti-virus tools. The proposed techniques are aimed at changing the ransomware activity in the downgrading phase (encryption or obfuscation) of files on the infected system.
|
|
|
Automatic Detection of Cryptography Used in Code
Mička, Richard ; Šilhavý, Pavel (referee) ; Hajný, Jan (advisor)
This thesis covers the topic of automatic detection of cryptography used in application code, which currently requires a lot of manual effort to analyze for a given unknown program sample. In this thesis, a possibility of implementing an automated tool for analysing the usage of Microsoft CryptoAPI cryptographic library by analysed programs is researched. This library is distributed with Microsoft Windows and can be misused by an attacker to cause significant harm to a victim. By recognizing cryptographic operations used and by presenting the summary of their use, it is in certain situations possible to distinguish malicious programs just based on the presented analysis summary. Main objective of this thesis was creation of such automatic analyser module integrated into Cuckoo sandbox. Along with the design proposal of such analyser, this thesis includes CryptoAPI library and Cuckoo sandbox functionality exploration and description. Proposed automatic analyser was successfully created, deployed and tested in production environment and the achieved results were discussed.
|
|
|
Analysis of the GlobeImposter ransomware
Procházka, Ivo ; Komosný, Dan (referee) ; Martinásek, Zdeněk (advisor)
The aim of this diploma thesis is to analyze an instance of the GlobeImposter ransomware extracted from an affected device. The first part outlines various types of malware and ransomware and includes a description of encryption mechanisms and key distribution systems. It also discusses possible approaches of static and dynamic analysis of malware samples and requirements for test environments. The practical part describes the source of the malware sample, the physical and virtual test environment and the results of the static and dynamic analysis of the GlobeImposter ransomware. The final part discusses the results and the possibility of implementing a decryptor for the analyzed GlobeImposter ransomware.
|
guest ::
