Ransomware: Analysis and Evaluation of Live Forensic Techniques and Impact on Linux-Based IoT Systems

Ransomware has been predominantly a threat to Windows systems. Recently, Linux systems have become interesting for cybercriminals, and this trend is expected to continue. This endangers IoT ecosystems, whereas many IoT systems are based on Linux (e.g. cloud infrastructure and gateways). This paper investigates how currently employed forensic techniques can be applied to Linux ransomware and evaluates the maturity as well as the impact on the system. Although Windowsbased ransomware predominantly uses RSA and AES for key management, a variety of approaches for Linux were identified. Cybercriminals appear to be deliberately moving away from RSA and AES to make Live forensic investigations more difficult. Linux ransomware is developed for a predefined goal and does not exploit the full potential of damage. It is expected to reach a potential similar to that of Windows-based malware. The results generated provide an excellent basic understanding to discuss and assess implications for the IoT industry at an early stage of development.