I Wrote my Own Ransomware; did not make 1 iota of a Bitcoin
I Wrote my Own Ransomware; did not make 1 iota of a Bitcoin
Thomas Fischer
published in Magdeburger Journal zur Sicherheitsforschung (2018, #16, p. 879-892)
2016 saw a substantial rise in ransomware attacks and in some cases the return of some favourites with Cryptowall, CTB-LOCKER and TeslaCrypt being some of the most popular. The volume of attacks was in fact pretty steady for a good part of the year, with regular campaigns coming out on a weekly basis. It was interesting to see the variety in mechanisms used for the ransomware which not only included self-contained binaries but went all the way to the use of scripts. As part of the research I conducted last year, I wanted to understand why there’s such a drive and lure for ransomware, outside of the victims payment, as well as have some way of properly testing »anti-ransomware« solutions with an unknown variant. So to do that, I went ahead and built my own ransomware and drew some conclusions on why it became so popular. This talk explore the background and process used to build a live ransomware that I was able to use for controlled testing. To finally draw some of my own personal conclusions.
BibTeX-Entry für mjs:Fischer:Ransomware
1@article{mjs:Fischer:Ransomware,
2 author = {Thomas Fischer},
3 title = {I Wrote my Own Ransomware; did not make 1 iota of a Bitcoin},
4 year = {2018},
5 pages = {879-892},
6 journaltitle = {Magdeburger Journal zur Sicherheitsforschung},
7 issn = {2192-4260},
8 url = {https://d-nb.info/1173082379/34},
9 codeberg = {https://codeberg.org/0xKaishakunin/Publikationen/src/branch/main/MagdeburgerJournalSicherheitsforschung/MJS_059_Fischer_Ransomware.pdf},
10 language = {DE},
11 issue = {2},
12 volume = {16},
13 urldate = {2018-11-03},
14 keywords = {mjsarticle,malware analysis, bitcoin, encryption, ds19,ransomware},
15 abstract = {2016 saw a substantial rise in ransomware attacks and in some cases the return of some favourites with Cryptowall, CTB-LOCKER and TeslaCrypt being some of the most popular. The volume of attacks was in fact pretty steady for a good part of the year, with regular campaigns coming out on a weekly basis. It was interesting to see the variety in mechanisms used for the ransomware which not only included self-contained binaries but went all the way to the use of scripts. As part of the research I conducted last year, I wanted to understand why there’s such a drive and lure for ransomware, outside of the victims payment, as well as have some way of properly testing »anti-ransomware« solutions with an unknown variant. So to do that, I went ahead and built my own ransomware and drew some conclusions on why it became so popular. This talk explore the background and process used to build a live ransomware that I was able to use for controlled testing. To finally draw some of my own personal conclusions.},
16}
AsciiDoc citation commands
1. citenp:[mjs:Fischer:Ransomware]
2. cite:[mjs:Fischer:Ransomware]
3. bibitem[mjs:Fischer:Ransomware]
LaTeX citation commands
1. \textcite{mjs:Fischer:Ransomware}
2. \parencite{mjs:Fischer:Ransomware}
3. \cite{mjs:Fischer:Ransomware}
generated at Mon May 12 10:48:34 2025