@inproceedings{a4aab00710df42b6860ed332a6f8ca83,
title = "RSSD: Defend against Ransomware with Hardware-Isolated Network-Storage Codesign and Post-Attack Analysis",
abstract = "Encryption ransomware has become a notorious malware. It encrypts user data on storage devices like solid-state drives (SSDs) and demands a ransom to restore data for users. To bypass existing defenses, ransomware would keep evolving and performing new attack models. For instance, we identify and validate three new attacks, including (1) garbage-collection (GC) attack that exploits storage capacity and keeps writing data to trigger GC and force SSDs to release the retained data; (2) timing attack that intentionally slows down the pace of encrypting data and hides its I/O patterns to escape existing defense; (3) trimming attack that utilizes the trim command available in SSDs to physically erase data. To enhance the robustness of SSDs against these attacks, we propose RSSD, a ransomware-Aware SSD. It redesigns the flash management of SSDs for enabling the hardware-Assisted logging, which can conservatively retain older versions of user data and received storage operations in time order with low overhead. It also employs hardware-isolated NVMe over Ethernet to expand local storage capacity by transparently offloading the logs to remote cloud/servers in a secure manner. RSSD enables post-Attack analysis by building a trusted evidence chain of storage operations to assist the investigation of ransomware attacks. We develop RSSD with a real-world SSD FPGA board. Our evaluation shows that RSSD can defend against new and future ransomware attacks, while introducing negligible performance overhead.",
keywords = "NVMe over Fabrics, Ransomware Attacks and Defenses, Solid-State Drive, Storage Forensics",
author = "Benjamin Reidys and Peng Liu and Jian Huang",
note = "We thank the anonymous reviewers and our shepherd Haibo Chen for their helpful comments and feedback. We thank Yuqi Xue for his help with the study of recent ransomware attacks. We also thank the group members in the Systems Platform Research Group at UIUC for their insightful discussions on this work. This work was partially supported by the NSF grant CCF-1919044 and ARO Small Business Technology Transfer Program W911NF-20-C-0010.; 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS 2022 ; Conference date: 28-02-2022 Through 04-03-2022",
year = "2022",
month = feb,
day = "28",
doi = "10.1145/3503222.3507773",
language = "English (US)",
series = "International Conference on Architectural Support for Programming Languages and Operating Systems - ASPLOS",
publisher = "Association for Computing Machinery",
pages = "726--739",
editor = "Babak Falsafi and Michael Ferdman and Shan Lu and Wenisch, {Thomas F.}",
booktitle = "ASPLOS 2022 - Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems",
address = "United States",
}