I Wrote my Own Ransomware; did not make 1 iota of a Bitcoin

I Wrote my Own Ransomware; did not make 1 iota of a Bitcoin

Thomas Fischer

published in Magdeburger Journal zur Sicherheitsforschung (2018, #16, p. 879-892)

Info

2016 saw a substantial rise in ransomware attacks and in some cases the return of some favourites with Cryptowall, CTB-LOCKER and TeslaCrypt being some of the most popular. The volume of attacks was in fact pretty steady for a good part of the year, with regular campaigns coming out on a weekly basis. It was interesting to see the variety in mechanisms used for the ransomware which not only included self-contained binaries but went all the way to the use of scripts. As part of the research I conducted last year, I wanted to understand why there’s such a drive and lure for ransomware, outside of the victims payment, as well as have some way of properly testing »anti-ransomware« solutions with an unknown variant. So to do that, I went ahead and built my own ransomware and drew some conclusions on why it became so popular. This talk explore the background and process used to build a live ransomware that I was able to use for controlled testing. To finally draw some of my own personal conclusions.

BibTeX-Entry für mjs:Fischer:Ransomware

 1@article{mjs:Fischer:Ransomware,
 2  author = {Thomas Fischer},
 3  title = {I Wrote my Own Ransomware; did not make 1 iota of a Bitcoin},
 4  year = {2018},
 5  pages = {879-892},
 6  journaltitle = {Magdeburger Journal zur Sicherheitsforschung},
 7  issn = {2192-4260},
 8  url = {https://d-nb.info/1173082379/34},
 9  codeberg = {https://codeberg.org/0xKaishakunin/Publikationen/src/branch/main/MagdeburgerJournalSicherheitsforschung/MJS_059_Fischer_Ransomware.pdf},
10  language = {DE},
11  issue = {2},
12  volume = {16},
13  urldate = {2018-11-03},
14  keywords = {mjsarticle,malware analysis, bitcoin, encryption, ds19,ransomware},
15  abstract = {2016 saw a substantial rise in ransomware attacks and in some cases the return of some favourites with Cryptowall, CTB-LOCKER and TeslaCrypt being some of the most popular. The volume of attacks was in fact pretty steady for a good part of the year, with regular campaigns coming out on a weekly basis. It was interesting to see the variety in mechanisms used for the ransomware which not only included self-contained binaries but went all the way to the use of scripts. As part of the research I conducted last year, I wanted to understand why there’s such a drive and lure for ransomware, outside of the victims payment, as well as have some way of properly testing »anti-ransomware« solutions with an unknown variant. So to do that, I went ahead and built my own ransomware and drew some conclusions on why it became so popular. This talk explore the background and process used to build a live ransomware that I was able to use for controlled testing. To finally draw some of my own personal conclusions.},
16}

AsciiDoc citation commands

1. citenp:[mjs:Fischer:Ransomware]
2. cite:[mjs:Fischer:Ransomware]
3. bibitem[mjs:Fischer:Ransomware]

LaTeX citation commands

1. \textcite{mjs:Fischer:Ransomware}
2. \parencite{mjs:Fischer:Ransomware}
3. \cite{mjs:Fischer:Ransomware}

generated at Mon May 12 10:48:34 2025