Ransomware is one of the most common forms of attack today. Hackers who use it encrypt their victims' files and then demand a ransom in exchange for the decryption key. And now two University of Illinois students, Chance Coats and Xiaohao Wang, along with assistant professor Jian Huang, are looking into the possibility of using the storage devices already on a computer to store files without having to pay the ransom.
“The study explains how to leverage the properties of SSD storage, which is found in most laptops and desktops today ,mobile phones and even IoT devices,” said Coats, a graduate student in Electrical and Computer Engineering (ECE). “Our motivation was a class of malware called ransomware, in which hackers encrypt a device’s files, delete unencrypted files, and then demand money for the decryption key.”
SSDs are part of the storage system in most computers. When a file is modified on the computer, instead of immediately deleting the old version of the file, the SSD stores the updated version in a new location. These old versions are key to preventing ransomware attacks. In the event of an attack, the tool described in the research could restore an older version of the files. It could also help if a user accidentally deletes a file.
As Coats describes in the study, the tool will have the ability to move old files to another location so that new ones can take their place. If the new tool’s parameters are set to retain data for too long, old and useless file versions will remain on the system and take up space on the storage device. As the device fills up with old file versions, the system will take longer to respond to typical storage requests and its performance will degrade. On the other hand, if the parameters are set to not retain old files for a long time, users will have a faster response time, but they may not have all of their backup files saved in the event of an attack.
To address this problem, Huang and his students built a feature into the tool that would make it responsive. The tool guarantees that data will be retained for at least three days. This allows users to back up their data to other systems within that time frame if they choose.
This research has gained worldwide interest and it will be interesting to see how effective this way of dealing with ransomware will be.
