A Cheating Attack on a Whitelist-based Anti-Ransomware Solution and its Countermeasure
Se-Beom Cheon, Geun-Yeong Choi, DaeYoub Kim · 2023 IEEE International Conference on Consumer Electronics (ICCE) · 2023
When proposing a whitelist-based anti-ransomware solution (WAR), it was pointed out that WAR could be vulnerable to a dynamic-link library (DLL) injection attack: An attacker can cheat the WAR using DLL injection techniques so that it can access files for which it does not have access rights. Therefore, if such an argument may be valid, it is essential to improve the vulnerability to utilize WAR securely. This paper first analyzes whether the DLL injection technique causes the vulnerability of WAR. Then, it proposes a solution to prevent a DLL injection attack on WAR.