# Steric effect of water molecule clusters on electrostatic interaction and
electroosmotic transport in aqueous electrolytes: a mean-field approach

Jun-Sik Sin<EMAIL_ADDRESS>
Department of Physics,
Kim Il Sung University,
Pyongyang 999093, Democratic People’s Republic of Korea  Natural Science
Center,
Kim Il Sung University,
Pyongyang 999093, Democratic People’s Republic of Korea  Yong-Man Jang
Natural Science Center,
Kim Il Sung University,
Pyongyang 999093, Democratic People’s Republic of Korea  Chol-Ho Kim  Natural
Science Center,
Kim Il Sung University,
Pyongyang 999093, Democratic People’s Republic of Korea  Hyon-Chol Kim
Natural Science Center,
Kim Il Sung University,
Pyongyang 999093, Democratic People’s Republic of Korea

###### Abstract

We theoretically study the size effect of water molecule clusters not only on
electrostatic interaction between two charged surfaces in an aqueous
electrolyte but also on electroosmotic transport in a nanofluidic channel.
Applying a free energy based mean-field approach accounting for different
sizes of ions and water molecule clusters, we derive a set of coupled
equations to compute electrostatic and electroosmotic properties between
charged surfaces. We verify that the smaller the size of a water cluster, the
stronger the electroosmotic transport in nanofluidic channels. In addition, we
find that an increase in size of a water cluster yields a decrease in
electrostatic interaction strength between similar or oppositely charged
planar surfaces.

water molecule cluster, electroosmotic transport, electrostatic interaction

###### pacs:

82.45.Gj, 82.39.Wj, 87.17.Aa

††preprint: Preprint

Everybody will arguably say that water is the most important substance in
human life. It is justified by noting that in all living organisms, water
plays the role of a solvent as well as a medium for solute-solute interactions
and therefore is involved in important physical and chemical processes such as
transport of substances through cell membranes and interaction between charged
objects Israel_book_2011 ; Lyklema_book_2005 ; Brov_2008 .

It is a common sense that natural water exists as a dynamic and flexible water
cluster containing 14$\sim$16 molecules linked by hydrogen bonds, while small
molecules water exists as a water cluster which contains 5$\sim$7 molecules.
It is also known that hydrogen bonded network structure lowers diffusivities
and slows the biological and chemical processes. In particular, small
molecules water (also referred to as small cluster water) having fewer
hydrogen bonds can easily pass through living cell membranes Shulta_2012 ;
Symons_2001 , and has been thereby used for promoting human health Lo_2000 ;
Liu_1996  and treating human diseases Yang_2018 .

However, most of theoretical studies of small molecules water have been mainly
focused on electronic structural properties of water clusters and quantum
chemical interaction between them - not on size effect of water molecule
clusters Peet_1995 ; Gregory_1997 ; Shields_2010 ; Zhu_2014 ; Tobias_2016 .

In fact, the Poisson-Boltzmann approach Gouy_JPhysF_1910 ;
Chapman_PhilosMag_1913 , which has been widely used in order to represent
electrolyte solutions is a mean-field approach which assumes point-like ions
and constant permittivity, and neglects statistical correlations. For low
electrostatic potentials, the Poisson-Boltzmann approach has successfully
determined ionic concentration profiles close to surfaces. Unfortunately, the
Poisson-Boltzmann theory strongly overestimates ionic concentrations close to
charged surfaces for highly charged surfaces and multivalent ions.

Many researchers have been proposed various methods to include the steric
effect of ions and water molecules into the Poisson-Boltzmann approach
Bikerman_PhilosMag_1942 ; Wicke_ZEC_1952 ; Iglic_JPhys_1996 ;
Andelman_PRL_1997 ; Chu_BJ_2007 ; Kornyshev_JPCB_2007 ; Li_PRE_2012 ;
Boschitsch_JCC_2012 ; Iglic_EA_2015 ; Sin_EA_2016 ; Iglic_GP_2017 . However,
to the best of our knowledge, there is no mean-field approach based study of
steric effect of water molecule clusters.

In this communication, we extend the previous mean-field methods
Boschitsch_JCC_2012 ; Iglic_EA_2015 ; Sin_EA_2016  to the case of electrolytes
consisting of water molecule clusters. The mean-field approach clearly shows
how size of a water molecule cluster affects electroosmotic transport in
nanochannel or electrostatic interaction between similar or oppositely charged
surfaces. For the sake of clarity, we consider a symmetric electrolyte
containing negative ions of charge $-ze_{0}$ and positive ions of charge
$ze_{0}$, where $e_{0}$ is the electron charge. We assume that the elementary
unit of water being solvent of the electrolyte is a water cluster containing
$N_{wc}$ water molecules. The bulk ion number density of the negative and
positive ions is $n_{b}$. For the case of point-like ions, our approach is
reduced to the original Poisson-Boltzmann equation Gouy_JPhysF_1910 ;
Chapman_PhilosMag_1913 .

Within mean-field approximation, the total free energy, $F$, can be written in
terms of the local electrostatic potential and the ionic concentrations.

We consider the size effect of water molecule clusters on the electrostatic
interaction between two planar surfaces (similar or oppositely charged)
separated by a distance $W_{h}$ in an aqueous electrolyte. The transverse
direction is denoted by $r$; the bottom plate is placed at $r=-H$ and the top
plate $r=H$,i.e. $W_{h}=2H$. The resulting electrostatic properties between
the plates and the electrolyte solution should be addressed by setting the
total free energy as follows Bikerman_PhilosMag_1942 ; Wicke_ZEC_1952 ;
Iglic_JPhys_1996 ; Andelman_PRL_1997 ; Chu_BJ_2007 ; Kornyshev_JPCB_2007 ;
Li_PRE_2012 ; Boschitsch_JCC_2012 ; Iglic_EA_2015 ; Sin_EA_2016 ;
Iglic_GP_2017  :

$F=\int
d{\bf{r}}\left[{-\frac{{\varepsilon_{0}\varepsilon_{r}|\nabla\psi\left(\bf
r\right)|}^{2}}{2}+e_{0}z\psi\left({\bf{r}}\right)\left({n_{+}-n_{-}}\right)-\mu_{+}n_{+}-\mu_{-}n_{-}-\mu_{wc}n_{wc}-Ts}\right].$
(1)

While the local electrostatic potential is denoted by
$\psi\left({\bf{r}}\right)$, the number densities of positive and negative
ions and water molecule clusters are expressed as
$n_{i}\left({\bf{r}}\right)\left(i=+,-,wc\right)$, respectively. In Eq. (1),
the first term describes the self energy of the electrostatic field, where
$\varepsilon_{0}$ and $\varepsilon_{r}$ stand for the vacuum permittivity and
the relative permittivity of bulk aqueous electrolyte, 78.5, respectively. The
second term means the electrostatic energy of the ions. The next three terms
are needed to couple the system to a bulk reservoir, where
$\mu_{i}\left(i=+,-\right)$ means the chemical potential of the ions and
$\mu_{wc}$ corresponds to the chemical potential of water clusters. $T$ and
$s$ are the temperature and the entropy density, respectively.

In this paper, we have focused on small cluster water limited to the
magnitudes of surface charge densities smaller or equal than $0.05C/m^{2}$, so
that we can neglect a decrease in permittivity of electrolyte solution due to
orientation ordering of water dipoles Iglic_2014 ; Marcovitz_2015 . It was
shown recently by using Monte Carlo simulations Marcovitz_2015  that even for
high salt concentrations orientational ordering of water dipoles is increased
in directions towards the charged surface (without van der Waals forces) which
is in agreement with theoretical predictions Iglic_2014 . In particular, it
should be emphasized that near a charged surface, the assumption that almost
all water molecules in electrolyte solution belong to water shells around the
ions, while free water molecules are excluded, is against the results of
simulations which clearly show the increased water ordering in the direction
towards the charged surface even for high salt concentrations Marcovitz_2015 .

The change in size of water clusters due to electric field close to the
charged surface is neglected for the sake of simplicity even the electric
field near the charged surface is very large.

On the other hand, we know that due to the same reason as in Iglic_JPhys_1996
; Boschitsch_JCC_2012 ; Onuki_PRL_2017 , Eq. (2) works very well when we deal
with low bulk ionic concentration and low zeta potential:

$1=n_{+}V_{+}+n_{-}V_{-}+n_{wc}V_{wc},$ (2)

where $V_{+}$, $V_{-}$ and $V_{wc}$ are the effective volumes of a positive
ion, a negative ion and a water molecule cluster, respectively.

The Lagrangian of the electrolyte with an undetermined multiplier can be
expressed by considering the constraint condition.

$L=F-\int{\alpha\left({\bf{r}}\right)}\left({1-n_{+}V_{+}-n_{-}V_{-}-n_{wc}V_{wc}}\right)d{\bf{r}},$
(3)

where $\alpha$ is a local Lagrange parameter.

For low ionic concentrations, it is noticeable that entropy density can be
calculated by Eqs.(4) and (5) as in Boschitsch_JCC_2012 :

$s=k_{B}\ln w,$ (4)

where $k_{B}$ is the Boltzmann constant and $w$ is the number of
configurations in a unit volume of the electrolyte

$w=\frac{{(n_{wc}+n_{+}+n_{-})!}}{{n_{wc}!n_{+}!n_{-}!}}.$ (5)

From planar symmetry of the charged surfaces, the present study is reduced to
an one-dimensional problem.

Minimizing the corresponding free energy with respect to
$n_{i}\left(r\right)\left(i=+,-,wc\right)$ and $\psi\left(r\right)$, we derive
the self-consistent equations determining $n_{i}\left(r\right)$ and
$\psi\left(r\right)$. In the same way as in Boschitsch_JCC_2012 , the number
densities of ions and water molecule clusters can be obtained

$n_{+}=\frac{{n_{b}\exp\left({-V_{+}h-e_{0}z\beta\psi}\right)}}{D},$ (6)
$n_{-}=\frac{{n_{b}\exp\left({-V_{-}h+e_{0}z\beta\psi}\right)}}{D},$ (7)
$n_{wc}=\frac{{n_{wcb}\exp\left({-V_{wc}h}\right)}}{D},$ (8)

where $\beta=1/\left(k_{B}T\right)$,
$D=n_{b}V_{+}\exp\left({-V_{+}h-e_{0}z\beta\psi}\right)+n_{b}V_{-}\exp\left({-V_{-}h+e_{0}z\beta\psi}\right)+n_{wc}V_{wc}$,
$h\left(r\right)=\alpha\left(r\right)-\alpha\left(r=\infty\right)$ and
$n_{wcb}$ denotes the bulk number density of water molecule clusters.

In addition to the above ones, another equation is derived by combining Eqs.
(2), (6), (7) and (8):

$n_{b}\left({e^{-V_{+}h-\beta
ze_{0}\psi}-1}\right)+n_{b}\left({e^{-V_{-}h+\beta
ze_{0}\psi}-1}\right)+n_{wcb}\left({e^{-V_{wc}h}-1}\right)=0.$ (9)

Euler-Lagrange equation for $\psi\left({r}\right)$ yields the Poisson
equation:

$\varepsilon_{0}\varepsilon_{r}\frac{d^{2}\psi}{dr^{2}}=-e_{0}z\left({n_{+}-n_{-}}\right).$
(10)

When we consider the case of $N_{wc}$=1, our theory is reduced to one of
Boschitsch_JCC_2012 .

As proved in Andelman_JPCB_2009 , osmotic pressure between two charged
surfaces can be derived from the following expression

$f-\left({\partial
f/\partial\left(\nabla\psi\right)}\right)\nabla\psi=constant=-P,$ (11)

where the constant is the negative of the local pressure $P$ that is defined
as the sum of the osmotic pressure ($\Pi$) and the bulk pressure (
$P_{bulk}$), i.e.,$P=\Pi+P_{bulk}$. Combining Eq. (1) and Eq. (11), the
following relation is obtained:

$\begin{array}[]{l}\Pi=-\frac{{\varepsilon_{0}\varepsilon_{r}|\nabla\psi|^{2}}}{2}+k_{B}Th.\end{array}$
(12)

To derive the above formular we follow the corresponding one of Sin_JCP_2017 .
Here we introduce the following dimensionless variables for more convenient
determination of physical quantities:

$\begin{array}[]{l}\bar{r}=r/H,\bar{\psi}=e_{0}z\beta\psi,\lambda=\sqrt{\frac{{\varepsilon_{0}\varepsilon_{r}k_{B}T}}{{2n_{b}e_{0}^{2}z^{2}}}},\bar{\lambda}=\lambda/H,\bar{h}=hV_{wc},\\\
\bar{V}_{i}=V_{i}/V_{wc}\left(i=+,-\right),\theta=\frac{1}{{n_{wcb}V_{wc}}},\bar{n}_{b}=\frac{{n_{b}}}{{n_{wcb}}}.\end{array}$
(13)

The governing equations are transformed into the following equations.

$\frac{{d^{2}\bar{\psi}}}{{d\bar{r}^{2}}}=\frac{\theta}{{2\bar{\lambda}^{2}}}\frac{{\exp\left({\bar{\psi}-\bar{V}_{-}\bar{h}}\right)-\exp\left({-\bar{\psi}-\bar{V}_{+}\bar{h}}\right)}}{{\exp\left({-\bar{h}}\right)+\bar{n}_{b}\bar{V}_{-}\exp\left({\bar{\psi}-\bar{V}_{-}\bar{h}}\right)+\bar{n}_{b}\bar{V}_{+}\exp\left({-\bar{\psi}-\bar{V}_{+}\bar{h}}\right)}}$
(14)
$\frac{{d\bar{h}}}{{d\bar{r}}}=\frac{{\bar{n}_{b}\left({\exp\left({\bar{\psi}-\bar{V}_{-}\bar{h}}\right)-\exp\left({-\bar{\psi}-\bar{V}_{+}\bar{h}}\right)}\right)\frac{{d\bar{\psi}}}{{d\bar{r}}}}}{{\exp\left({-\bar{h}}\right)+\bar{n}_{b}\bar{V}_{-}\exp\left({\bar{\psi}-\bar{V}_{-}\bar{h}}\right)+\bar{n}_{b}\bar{V}_{+}\exp\left({-\bar{\psi}-\bar{V}_{+}\bar{h}}\right)}}$
(15)

In fact, the expression for osmotic pressure Eq. (12) can be also obtained by
calculating the first integral of Eq. (14) Evans_1999 ; Iglic_2014 . First,
Eq. (14) is multiplied by $d\bar{\psi}/d\bar{r}$ and considered Eq. (15) to
get the following equation:

$\frac{{d^{2}\bar{\psi}}}{{d\bar{r}^{2}}}\frac{d\bar{\psi}}{d\bar{r}}=\frac{\theta}{{2\bar{\lambda}^{2}\bar{n}_{b}}}\frac{{d\bar{h}}}{{d\bar{r}}}$
(16)

As a result, integrating Eq. (16) with use of Eq. (13) yields the same
equation as Eq. (12). We can easily know that in case of $V_{wc}=V_{+}=V_{-}$,
Eq. (12) is reduced to the corresponding expression obtained in Iglic_2014 .

Next, we consider the electroosmotic transport in a slit-like nanochannel to
probe how biological and physicochemical processes in living organisms get
fast by small molecules water. In fact, in order to represent the ion
transport through a cell membrane, the authors of Olga_2016  addressed the
electroosmotic transport in a nanochannel between two semipermeable membranes.
We can know that electrostatics for the geometry contains the corresponding
one for the case when considering electrostatic interaction between similarly
charged surfaces. We imagine that an external axial electric field is applied
to the nanochannel in order to trigger a steady, one dimensional, and fully
developed electroosmotic flow with a little Reynolds number. The equation
governing electroosmotic transport can be simply expressed as:

$\eta\frac{d^{2}u}{dr^{2}}+e_{0}z\left({n_{+}-n_{-}}\right)E_{\bot}=0$ (17)

with $\eta$ being the dynamic viscosity of water and $E_{\bot}$ being the
employed constant axial electric field. $u$ means electroosmotic velocity
resulting from the electrostatic potential profile between two charged
surfaces. Using Eqs. (6) and (7), we can finally express Eq. (18) in
dimensionless form as

$\frac{d^{2}\bar{u}}{d\bar{r}^{2}}-\bar{E}_{\bot}\frac{\theta}{2{\bar{\lambda}^{2}}}\frac{{\exp\left({\bar{\psi}}-\bar{V}_{-}\bar{h}\right)-\exp\left(-\bar{\psi}-\bar{V}_{+}\bar{h}\right)}}{{\exp\left({-\bar{h}}\right)+\bar{n}_{b}\bar{V}_{-}\exp\left({\bar{\psi}-\bar{V}_{-}\bar{h}}\right)+\bar{n}_{b}\bar{V}_{+}\exp\left({-\bar{\psi}-\bar{V}_{+}\bar{h}}\right)}}=0,$
(18)

where $\bar{E}_{\bot}=E_{\bot}/E_{0}$($E_{0}=k_{B}T/\left(ze_{0}H\right)$ is
the electric field caused by the potential $k_{B}T/ze_{0}$ operating over half
nanochannel height $)$ and $\bar{u}=u/u_{0}$(
$u_{0}=\left({\varepsilon_{0}\varepsilon_{r}}\right)\left({k_{B}T/ze_{0}}\right)E_{0}/\eta$
$)$ is the velocity scale considered equal to the Helmholtz - Smoluchowski
velocity that results from a system zeta potential of magnitude
$k_{B}T/ze_{0}$ in the presence of an electric field $E_{0}$.

Using the corresponding electrostatic potential $\bar{\psi}$ obtained from Eq.
(14) and (15), $\bar{u}$ will be obtained by numerically solving Eq. (20) in
the presence of the following wall-boundary conditions:

$\left({\bar{u}}\right)_{\bar{r}=\pm
1}=0,\left(\frac{d{\bar{u}}}{d\bar{r}}\right)_{\bar{r}=0}=0$ (19)

For the clarity, we assume that the plane ($\bar{r}=\pm 1$) having the zeta
potential ($\bar{\zeta}$) is the plane of no slip for the axial flow velocity,
disregarding other effects such as changes in the permittivity and the
viscosity in the stern layer. Combining Eq. (10), Eq. (17) and Eq. (19) yields
the relationship between dimensionless electroosmotic velocity and
dimensionless electrostatic potential, as in Das_PRE_2008 .

$\bar{u}=-\bar{E}_{\bot}\left({\bar{\zeta}-{{\bar{\psi}}}}\right)$ (20)

Eq. (20) indicates that the electroosmotic velocity linearly varies with the
electrostatic potential, and the magnitude of the electroosmotic velocity is
proportional to the difference between electrostatic potential and zeta
potential. We take the midpoint between the two charged surfaces as the origin
of coordinates and choose the positive r-axis to point top. Electrostatic
potential and number densities of ions and water molecule clusters are
simultaneously obtained from the numerical solution of the set of coupled
equations Eqs. (6)-(10) as a function of position in between two charged
surfaces or walls. Due to the same reason as in Das_PRE_2011 , we have used
the bulk concentrations of negative and positive ions as the concentration of
ions in the reservoirs connected to the nanochannel.

For all the calculations, the temperature and the bulk ionic concentration are
$T=300K$ and $c_{b}=0.01M$ (i.e. $n_{b}=$ 0.01 $\times$ Na $\times$ 1000,
where Na is Avogadro number) while the size of a positive ion is
$V_{+}=0.03nm^{3}$. The magnitude of surface charge density is chosen as
$|\sigma|=0.05C/m^{2}$, in the range of typical values for biological membrane
surface, like in McLau_1989 ; Cevc_1990 ; Dobrzynska_2013 ; Sinha_2017 .

Figure 1: (Color online) The dimensionless electrostatic potential profiles
(a), and dimensionless electroosmotic velocity profiles (b) in a nanochannel
having $\sigma\left(x=H\right)=\sigma\left(x=-H\right)=+0.05C/m^{2}$ for
different ion sizes. $\bar{E}_{\bot}=1,H=1.5nm$. Figure 2: (Color online)
Osmotic pressure as a function of the separation distance between similarly
charged surfaces for
$\sigma\left(x=H\right)=\sigma\left(x=-H\right)=+0.05C/m^{2}$ (a) and between
oppositely charged surfaces for
$\sigma\left(x=H\right)=-\sigma\left(x=-H\right)=+0.05C/m^{2}$ (b) for
different ion sizes. Other parameters and the meanings of symbols are the same
as in Fig. 1.

In Fig. 1(a), we show the electrostatic potential profiles for different sizes
of a water cluster by using our approach. For comparison, the result of
original Poisson-Boltzmann approach is also presented. The key finding is that
for the case where finite ion size is considered, increasing the size of a
water molecule cluster $N_{wc}$ results in the lowering of the electrostatic
potential across the entire nanochannel. This contrasts with the original
Poisson-Boltzmann scheme which leads to only one electrostatic profile
regardless of the size of a water molecule cluster. In fact, as can be seen in
Eq. (5), entropy density decreases with increasing the size of a water
molecule cluster because a large size of a water molecule cluster means a
smaller number of water clusters. As a consequence, the entropy contribution
to the free energy becomes small (i.e. thermal motion of ions and water
clusters becomes weaker) and in turn counterions in the electrolyte solution
can be more easily accumulated to the charged surface. Therefore,
electrostatic potential for a small size of water cluster is larger than
corresponding ones for a larger size of water cluster.

As can be seen in Fig. 1(b), a large size of a water molecule cluster produces
a lower electroosmotic velocity than that of a smaller size of a water
molecule cluster, across the entire nanochannel. This phenomenon is explained
by the following facts. First, at the charged surfaces ($\bar{r}=\pm 1$), the
difference in electrostatic potential for different sizes of a water molecule
cluster is larger than corresponding one at any position across the entire
nanochannel. Then, Eq. (20) indicates that the electroosmotic velocity at any
position across the nanochannel is proportional to the difference between zeta
potential and the electrostatic potential at the position. From the above two
facts, we can assert that increasing the size of a water molecule cluster
yields a decrease in electroosmotic velocity. The experimental results
Shulta_2012 ; Symons_2001 ; Lo_2000 ; Liu_1996  established that small
molecules water moves in and out of cell fast compared to natural water. Fig.
1(b) demonstrates that small molecules water allows electroosmotic velocity to
increase, and consequently justifies the experimental results.

The electrostatic interaction between similar or oppositely charged surfaces
can be calculated using Eq. (12). Fig. 2(a) and Fig. 2(b) depict the osmotic
pressure as a function of the distance between two charged surfaces, for two
different ion sizes, $V_{-}$. The result of Poisson-Boltzmann approach is also
shown for comparison. Furthermore, as can be seen from Fig. 2(a) and (b), the
osmotic pressure at the small distance separation depends strongly on the size
of a water molecule cluster, $N_{wc}$. For the Poisson-Boltzmann approach,
this interaction doesn’t depend on the size of water cluster. On the other
hand, Fig. 2(a) and (b) demonstrates that finite size of ions also changes the
steric effect of water clusters since ions prevents water molecule clusters
from occupying the vicinity of the charged walls.

In conclusion, we have used the previous developed mean-field model
Boschitsch_JCC_2012 ; Iglic_EA_2015 ; Sin_EA_2016  of electric double layer
for description of the effect of the size of water clusters on electrostatic
interaction between two charged surfaces and electroosmotic transport in a
nanochannel. As a result, we have demonstrated that increasing the size of a
water molecule cluster produces not only a decrease in the strength of
electrostatic interaction between similar or oppositely charged surfaces but
also a decrease in electroosmotic velocity. This fact justifies a beneficial
effect of small cluster water on electrolyte transport through a narrow
confined geometry and interaction between charged objects relevant to
fundamental physiological processes. Our results are consistent with the
experiments Shulta_2012 ; Symons_2001  involving electrolyte solutions in
living organisms.

Since the present study treats surface charge densities smaller or equal than
$0.05C/m^{2}$, we can neglect change in dielectric permittivity due to the
orientational ordering of water dipoles. However, in the case of a middle or
high surface charge density, one should consider the infuence of orientational
ordering of water dipoles on dielectric permittivity Marcovitz_2015 ;
Iglic_2014  and change in size distribution of water clusters. It should be
emphasized that the electrostatic equations were numerically solved in planar
geometry and not in cylindrical geometry. Therefore, the present approach is
appropriate only for the tubes or channels with rather large diameters. In the
future, we will further consider for which values of the diameters of the
channels our results are applicable, as in Bohinc_2005 .

## References

  * (1) J. N. Israelachvili, Intermolecular and Surface Forces (Academic, London,2011).
  * (2) J. Lyklema, Fundamentals of Interface and Colloid Science. Volume II:Solid-Liquid Interfaces (Academic, London, 2005).
  * (3) I. Brovchenko and A. Oleinikova, Interfacial and Confined Water, (Elsevier, 2008).
  * (4) M. J. Shulta, T. H. Vu , and B. Meyer, Acc. Chem. Res. 45, 15 (2012).
  * (5) M. C. R Symons, Philos. Trans. R. Soc. Lond. 359, 1631 (2001).
  * (6) S. Y. Lo, W. C. Li, and S. H. Huang, Med. Hypotheses, 54, 948-953 (2000).
  * (7) K. Liu, J. D. Cruzan, and R. J. Saykally, Science, 271, 929-933 (1996).
  * (8) Y. Li, J. Pan, Y. Zhang, Y. Chang, X. Yang, B. Yang, X. Mao, Z. Wang, B. Gao, and X. Lu, Int. Urol. Nephrol. 50, 225-230 (2018).
  * (9) D. Peeters, J. Mol. Liq. 67, 49-61 (1995).
  * (10) J. K. Gregory, D. C. Clary, K. Liu, M. G. Brown, and R. J. Saykally, Science 275, 814-817 (1997).
  * (11) M. S. Robert, T. Berhane, A. A. Kaye, E. M. Thomas, and C. S. George, J. Phys. Chem. A 114, 11725-11737 (2010).
  * (12) F. Zhu, Biophys J 106, 1229??23 (2014).
  * (13) T. Morawietz, A. Singraber, C. Dellago, and J. Behler, Proc. Natl. Acad. Sci. USA 113, 8368-8373 (2016).
  * (14) M. G. Gouy, J. Phys.(France) 9, 457 (1910).
  * (15) D. L. Chapman, Philos. Mag. 25, 475 (1913).
  * (16) J. J. Bikerman, Philos. Mag. 33, 384 (1942).
  * (17) E. Wicke and M. Eigen, Z. Elektrochem. 56, 551 (1952).
  * (18) V. Kralj-Iglič and A. Iglič, J. Phys.??France 6, 477 (1996).
  * (19) I. Borukhov, D. Andelman, and H. Orland, Phys. Rev. Lett. 79, 435 (1997).
  * (20) V. B. Chu, Y. Bai, J. Lipfert, D. Herschlag, and S. Doniach, Biophys. J. 93, 3202 (2007).
  * (21) A. A. Kornyshev, J. Phys. Chem. B 111, 5545 (2007).
  * (22) J. Wen, S. Zhou, Z. Xu, and B. Li, Phys. Rev. E. 85, 041406 (2012).
  * (23) A. H. Boschitsch and P. V. Danilov, J. Comput. Chem. 33, 1152 (2012).
  * (24) E. Gongadze and A. Iglič, Electrochim. Acta 178, 541-545 (2015).
  * (25) J.-S. Sin, K.-I. Kim, H.-C. Park and C.-S. Sin, Electrochim. Acta 207, 237-246 (2016).
  * (26) E. Gongadze, V. Kralj-Iglič and A. Iglič, Gen. Physiol. Biophys.36, 229-234, (2017)
  * (27) S. Yabunaka and A. Onuki, Phys. Rev. Lett 119, 118001 (2017).
  * (28) D. Ben-Yaakov, D. Andelman, D. Harries, and R. Podgornik, J. Phys. Chem. B 113, 6001 (2009).
  * (29) J.-S. Sin, J.Chem. Phys. 147, 214702 (2017).
  * (30) S. R. Maduar and O. I. Vinogradova, J. Chem. Phys. 145, 164703 (2016).
  * (31) S. Chakraborty and S. Das, Phys. Rev. E 77, 037303 (2008).
  * (32) S. McLaughlin, Ann. Rev. Biophys. Chem. 18, 113 (1989).
  * (33) G. Cevc, Biochim. Biophys. Acta 1031, 311??82 (1990).
  * (34) I. Dobrzynska, E. Skrzydlewska, and Z. A. Figaszewski, J. Membr. Biol. 246, 161 (2013).
  * (35) S. Sinha, H. Jing, H. S. Sachar, and S. Das, Appl. Phys. Lett. 111, 263702 (2017).
  * (36) E. Gongadze, A. Velikonja, Š. Perutkova, P. Kramar, A. Maček-Lebar, V. Kralj-Iglič and A. Iglič, Electrochim. Acta 126, 42 (2014).
  * (37) A. Marcovitz, A. Naftaly and Y. Levy, J. Chem. Phys. 142, 085102 (2015).
  * (38) D.F. Evans, H. Wennerstrom, The Colloidal Domain: Where Physics, Chemistry, Biology, and Technology Meet, 1999.
  * (39) S. Das and S. Chakraborty, Phys. Rev. E 84, 012501 (2011).
  * (40) K. Bohinc, J. Gimsa, V. Kralj-Iglič, T. Slivnik and A. Iglič, Bioelectrochemistry 67, 91 (2005).


# Ransomware: Analysis and Evaluation of Live Forensic Techniques and the
Impact on Linux based IoT Systems

Salko Korac, Leandros Maglaras, Naghmeh Moradpoor, Bill Buchanan, Berk Canberk
Edinburgh Napier University, Edinburgh EH10 5DT, UK
(40517266, l.maglaras, n.moradpoor, b.canberk<EMAIL_ADDRESS>
###### Abstract

Ransomware has been predominantly a threat to Windows systems. But, Linux
systems became interesting for cybercriminals and this trend is expected to
continue. This endangers IoT ecosystems, whereas many IoT systems are based on
Linux (e.g. cloud infrastructure and gateways). This paper researches how
currently employed forensic techniques can be applied to Linux ransomware and
evaluates the maturity as well as the impact on the system. While Windows-
based ransomware predominantly uses RSA and AES for key management, a variety
of approaches was identified for Linux. Cybercriminals appear to be
deliberately moving away from RSA and AES to make Live forensic investigations
more difficult. Linux ransomware is developed for a predefined goal and does
not exploit the full potential of damage. It appears in an early stage and is
expected to reach a similar potential to Windows-based malware. The results
generated provided an excellent basic understanding to discuss and assess
implications on the IoT industry at an early stage of development.

###### Index Terms:

Ransomware, Linux, Malware.

##  I Introduction

The advancement of low-cost computers, cloud services, big data technologies,
analytics, and mobile technologies has made it possible for small physical
devices to build networks and exchange data without the need for human
intervention. IoT device interconnection exposes users to various security
risks in addition to efficiency and accuracy issues when connecting to vital
systems. Linux systems became interesting for cybercriminals and this trend is
expected to continue. This endangers IoT ecosystems, whereas many IoT systems
are based on Linux (e.g. cloud infrastructure and gateways). As stated in
ENISA threat landscape reports, ransomware is one of the major threats against
digital systems [1].

The 1989 AIDS Trojan was the first ransomware. This ransomware claimed to
educate about the autoimmune disease and was distributed via floppy disk.
Before installation, users had to agree to a license, which required a payment
of few hundred US dollars [2].

Nowadays, ransomware has become a major threat with revenue of USD 765.6
million in 2021 [3]. The United States White House wants to take a
financially-focused approach to curbing the ransomware problem and has
launched the International Counter Ransomware Initiative (CRI). As of October
2023, 50 member countries, including the United Kingdom, have pledged not to
pay a ransom [4]. This initiative would urge member countries to take
appropriate proactive measures instead of paying the ransom.

Ransomware payments became more legally risky as some of the ransomware gangs
were linked to sanctioned organisations. According to criminal investigations
by Europol, the Ukrainian-Russian war forced cybercriminal gangs to relocate
their activities into other jurisdictions [5]. There is widespread agreement
that Russian cybercriminals do not target victims in Russia. According to
Glenny, the Russian cybercriminal group Cl0p avoids attacks on government
institutions, cities or the police [6].

####  I-1 Relevance for Linux systems.

The market share of Windows operating system for desktops decreased from
95.42% in January 2009 to 69.52% in July 2023 [7]. At the same time, the Unix-
based macOS [8] and Linux-based desktop systems increased the cumulative share
from 4.33 to 23.54%. But, Linux holds a significant server market share
estimated between 62.4% and 70.4% [9, 10]. Linux systems became more
interesting for cybercriminals. Security researchers such as Terefos have
observed Windows-based Cl0p ransomware being expanded to attack Linux systems
[11]. Also other industry actors observe that Linux systems are becoming a
prime target for ransomware [12]. And the ransomware trend for Linux is
expected to continue [13].

####  I-2 Attack chain.

The attackers improved the organisation and industrialisation of ransomware
extortion by adopting a Ransomware as a Service (RaaS) model [14]. Due to the
increasing division of tasks and industrialisation of various work steps in
the field of cybercrime, many attacks aim to gain initial access to the
victim’s network and later it will be decided how to utilise the access.
Ransomware should no longer be viewed as a stand-alone software product.
Increasingly, entire chains of attacks take place before the ransomware is
executed. Based on the professional experience and the above explanation, an
attack chain is introduced as shown in Figure 1 below.

Figure 1: Attack chain with conscious decision about further use

This attack chain model considers a conscious decision milestone by the
hackers, where further use is discussed and decided. Specialised
cybercriminals focus on searching for new victims and gaining initial access.
This is achieved through targeted attacks using individual methods and through
non-targeted attacks using automated processes (e.g. brute force techniques,
exploits, zero-day exploits).

####  I-3 The emotional aspect during a ransomware attack

It is known from professional experience that ransomware victims initially
react emotionally and categorically refuse to negotiate. After taking stock,
victims react more soberly, are more likely to consider paying the ransom and
are more open to recognising this process as a deal. Current understandings of
ransomware attacks had painted a very rational picture how the attacks happen.
Little or no consideration is given to the emotional component of both the
victim and the attacker during the literature review. Figure 2 shows the
response chain from the victim’s point of view.

Figure 2: Response chain from victim’s view

The victim undergoes an emotional phase and moves to a rational analysis after
a certain period of time. Internal power struggles and lack of cooperation
lead to a significantly longer resolution time [15]. The influence of
emotional factors on cyber incidents would be an interesting further field of
research.

The aim of this work is to examine the current maturity level of ransomware on
Linux operating systems. During the experiments, commonly used live forensic
techniques were applied and the results were compared with ransomware for
Windows operating systems.

The techniques described in this work are intended to demonstrate techniques
that can be used to mitigate an ongoing ransomware attack on Linux operating
systems. This topic was chosen because ransomware for Windows operating
systems is currently widespread, but ransomware for Linux is expected to
increase significantly.

The results allow conclusions for the protection of IoT solutions, which many
are based on Linux operating systems.

##  II Experiments design

The experiments design considered 3 dimensions: 3 ransomware sample were
executed on 2 different Linux operating systems with 2 different permission
levels. Overall 12 combinations, in 24 main executions plus 6 retests were
covered by the testplan.

Is the key in memory? This experiment runs the ransomware and creates regular
memory dumps for analysis using live forensic techniques.

A sample of the ransomware execution is shown below.
# ubuntu@server-clean: ./blackbasta.elf
The memory dumps were taken before and during test execution and after reboot.
The memory was extracted with VirtualBox internal dump functions.
# VBoxManage debugvm "Client-Debian" dumpvmcore --filename
$ransomwaresample.1st.run.5seconds.elf
Each memory dump was analyzed for the existance of the key using at least
three forensic tools.
# aeskeyfind Server-Clean-CMD-Test11-beforeRun.elf
# rsakeyfind Server-Clean-CMD-Test11-beforeRun.elf
# findaes Server-Clean-CMD-Test11-beforeRun.elf

Any keys found were documented and compared before and after. The tests were
repeated on the retest environment and before ransomware execution it was
ensured, that the memory did not contain any AES or RSA keys in memory.

How long is the key present. In this experiment memory dumps were taken in 7
time intervals with the goal to identify how long the key is present in the
memory. Memory dump is also taken before the experiment and after reboot. A
script was developed, which generated 6 dumps after 5, 35, 65, 95 and 125
seconds as well as after 15 minutes after execution of the ransomware.

Does the key decrypt the files. If keys are found in memory, they are used to
decrypt the files. The decryption experiment followed the work done and the
script developed by Davies [16]

Does the sample spread throughout the network. This experiment examines
whether and how the ransomware attempts to spread across the network. Network
communications must be captured outside the virtual machine to prevent
detection and evasion by the ransomware. To simulate a realistic attack
surface, a second server is placed on the same network providing SSH, FTP, Web
services, MySQL databases and a Samba file share. During the experiment
execution, client and server will have open connections through these
protocols.

The network communication was traced on all active virtual machines with
VirtualBox internal functions, as can be seen, for example, in the command
below.

# VBoxManage modifyvm "ubuntu" --nictrace1 on

\--nictracefile1 out.pcap

# VirtualBox -startvm "ubuntu"

What is the impact of the encryption. In this experiment the impact on the
system will be analysed. Honeypot files will be placed in /home, /root,
/var/lib/mysql, /var/www, /etc/nginx, -/apache2 and /var/log. Also a web
server with a small web page will be created as honeypot. Furthermore a server
will provide FTP, SSH and Samba file shares and will have open connections
with a client. File hashes will reveal which files were encrypted by the
ransomware.

Test plan. A multi-dimensional combination was developed that takes into
account different operating systems and permission levels.

Playbook. To ensure consistent experiment quality, a playbook was defined that
is used to prepare and conduct each experiment.

The general steps in the playbook are shown in Figure 3.

Figure 3: Playbook for experiment execution

##  III Environment design

When designing the test environment, care must be taken to ensure that it is
realistic. The design should only deviate from real conditions if necessary.
When designing a test environment, a careful balance must always be struck
between effort and the creation of realistic conditions. Virtual machine
technology was used in this project because cyber criminals have to take into
account that Linux is often operated in virtual cloud environments. This
provides a convenient way to perform external memory dumps as well as external
network capture, without noticeable risk of being discovered by the
ransomware. During execution it was found out, that the initial environment
design was too realistic. Forensic investigations took significantly more time
than planned. If unexpected or suspicious results were encountered, a retest
environment was required to validate the results and to eliminate disruptive
factors. The virtual hardware is displayed in Table III.

Machine Name | Operating System | Purpose
---|---|---
Server-Clean | Ubuntu 20.04.6 | Victim
Client | Debian 12.1.0 | Victim
Server-Clean-CMD | Ubuntu 20.04.6 | Retest

tableVirtual Hardware Configuration

It was important to protect unintended spread through the network.
sudo ifconfig vboxnet0 down .
The host network interface was deactivated with above-mentioned command on the
host machine.

##  IV Implementation

Several recent ransomware attacks were researched. Following Linux ransomware
samples were identified:

Icefire. It was primarily designed and developed for Windows, but in the
recent months also attacks on Linux operating systems have been observed
misusing IBM Aspera Faspex file transfer software [17].

Cl0p. It is known to be similar to it’s Windows variant and appears to be
still in initial development [11].

Blackbasta. This sample is linked to be a sub-variant of the Conti ransomware
group and focuses on exploiting VMware’s ESXi virtual machine technology [18].

The hashes of all samples are listed in Table IV below.

Name | SHA-256 hash
---|---
Icefire | e9cc7fdfa3cf40ff9c3db0248a79f48
| 17b170f2660aa2b2ed6c551eae1c38e0b
Cl0p | 09d6dab9b70a74f61c41eaa485b37de
| 9a40c86b6d2eae7413db11b4e6a8256ef
Blackbasta | 0d6c3de5aebbbe85939d7588150edf7
| b7bdc712fceb6a83d79e65b6f79bfc2ef

tableLinux ransomware samples

The network topology is shown in Figure 4. The main test environment was used
for the experiments. The retest environment was used to reconfirm critical
results. Some experiments showed unexpected results. Therefore, another
testing machine was needed to perform repeat testing at a strictly reduced
complexity.

Figure 4 shows two test environments. The main test environment was used for
the tests. If necessary, retests were done in a small, isolated retest
environment to validate results.

Figure 4: Environment design, including test environment

##  V Results and comparative analysis

###  V-A Is the key in memory

Davies analysed the encryption of 3 Windows ransomware samples and all samples
used RSA+AES based encryption [16]. In contrast, this project showed that
different algorithms were used in all Linux ransomware samples. Only Icefire
used AES in combination with RSA. Cl0p used a hardcoded RC4 master-key and
Blackbasta used ChaCha20. A proposal for the determination of ChaCha20 key
material in memory dumps was found [19], but reliable implementations are
pending. The results were surprising and not expected.

All ransomware samples did not display visual ransom messages, similar to the
Cl0p ransom message as seen in Figure 5.

Figure 5: Ransom Message of Cl0p Linux ransomware

A list of the identified cipher systems and the key extraction results is
displayed in Table V-A.

Sample | Cipher | Keys extracted
---|---|---
Icefire | AES | 11
Cl0p | RC4 | 0
Blackbasta | ChaCha20 | 0

tableKey Management Systems of Linux ransomware

All ransomware samples created for each file new encryption keys. During the
experiment Icefire was observed to clean the memory immediately after
finishing encryption of one file. Dynamic forensic investigation turned out to
be very ineffective and effortful and was only successful partially for
Icefire ransomware sample.

###  V-B How long is the key present

Windows-based ransomware tended to use same key for encryption and usually
cleaned up the RAM at a late point in time [16]. The key disappeared from RAM
only after a restart or after the encryption was completely finished. Thus
chances to obtain the encryption key during dynamic forensic investigation and
Live monitoring of RAM were realistic. In comparison, the Linux ransomware
generated individual keys and used various encryption methods. Dynamic
forensic methods were successful only for Icefire ransomware sample. The
Icefire Linux ransomware maintained a clean memory, the encryption key was
present during the encryption and disappeared immediately after. Tracking of
keys for Cl0p and Blackbasta ransomware samples was not successful. An
overview of the Live forensic monitoring results is shown in Table V-B.

Sample | Becomes present | Duration of presence
---|---|---
Icefire | 5 seconds | during file encryption
Cl0p | unknown | unknown
Blackbasta | unknown | unknown

tableDuration of keys in RAM

Overall, Live (dynamic) forensic techniques turned out to be ineffective and
inefficient for Linux ransomware. Static forensic methods were more successful
to obtain the key and to identify implementation errors in the ransomware
sample.

###  V-C Does the key decrypt the files

The Linux ransomware had weaknesses in key management. Mistakes in the
implementation were found for 2 Linux ransomware variants and made decryption
possible. The decryption of Blackbasta [20] and Cl0p ransomware files was
successful [21]. Often, it is no longer of any use that the data can be
decrypted for free months or years later. Victims must immediately ensure
continued operations. Ransomware attacks are therefore successful as long as
there is an operational outage that forces the victim to pay at that moment.
An overview of the decryption results is listed in Table V-C.

Sample | Decrypted | Reason
---|---|---
Icefire | no | RSA public key used
Cl0p | decrypted | hardcoded RC4 master-key
Blackbasta | decrypted | decryptor leaked

tableDecryption results

###  V-D Does the sample spread throughout the network.

The research showed that all Linux ransomware samples did not attempt to
spread across the network. To summarise, the ransomware samples were primarily
designed to perform the encryption step for a specific victim. Delivery,
lateral movement and feedback of successful encryption therefore occur outside
of ransomware capabilities. The results were also compared with the results
for Windows Active Directory domain services [22]. Windows ransomware was
capable to detect attached file shares and to encrypt the data inside. Linux
ransomware was not capable of doing this. WannaCry is known to contact command
and control servers (CC). If this step fails, the ransomware usually starts
the encryption immediately [22]. Communication to CC servers is also confirmed
for TeslaCrypt [23] and Jigsaw ransomware [24].

An overview of the communication and network trace results is listed in Table
V-D.

Communication detected? | Icefire | Cl0p | Blackbasta
---|---|---|---
C&C server | no | no | no
SSH | no | no | no
FTP | no | no | no
Samba | no | no | no
WebServices | no | no | no
Lateral Movement | no | no | no
Key Exchange | no | no | no
Cryptocurrency | no | no | no

tableNetwork communication & lateral movement

Windows ransomware is known to communicate to an command and control server
for key management or to automatically scan the status of cryptocurrency
wallets. Such features were not observed for the 3 Linux ransomware samples.
All samples did not communicate to external servers.

In conclusion, none of the ransomware samples communicted to external
services. To validate the results, the tests were repeated in the isolated
retest environment, allowing to communicate to the internet.

###  V-E What is the impact of the encryption

The impact of Linux ransomware was compared with the research by McDonald et
al., who analysed the impact of Windows ransomware on Windows Active Directory
Domain Services. Windows ransomware had no impact on logon services. Users
were still able to log in. For Linux, the Cl0p ransomware encrypted the user
files in such a way, that a GUI-based login was not possible anymore.

Windows ransomware was also able to move laterally to some extent, to detect
file shares and web server files (e.g. wwwroot of the IIS web server) and
encrypt them as well. The selected Linux ransomware samples were not able to
do so. Both the Linux and Windows ransomware had no impact on the basic
operation of the web server itself.

Windows ransomware tends to restart after successful encryption and to display
a visual message. For Linux such behaviour was not observed.

The impact on the Linux system was limited by the defined target of the Linux
ransomware authors. The Cl0p and Icefire ransomware encrypted files mainly in
the user directory, even when running with administrative privileges.
Blackbasta encrypted only files in /vmfs/volumes , even if run as root.

All Linux ransomware samples did not utilise the full potential of the
permissions being executed. Even when running with full permissions, important
paths were not affected. The MySQL databases, SSH data, FTP data and Samba
shares were not affected. But especially in the enterprise sector, it is
common practice to connect external databases and storage and not to store any
data under /home or /root.

An overview of the impact on the system is displayed in Table V-E.

Negative impact? |  Icefire |  Cl0p |  Blackbasta
---|---|---|---
Login |  no |  GUI login fails |  no
Network |  no |  no |  no
Applications |  Audio&store crashed |  Many apps crashed |  no
Encryption as user |  $HOME |  none, but permission |  none
|  |  manipulated |
Encryption as root |  $HOME |  $HOME |  /vmfs/volumes
|  /usr |  /root |
|  /root |  /snap |
WebServer files |  no |  no |  no
MySQL files |  no |  no |  no
Automatic reboot? |  no |  no |  no

tableDecryption results

##  VI Impact for IoT systems

The results achieved for Linux ransomware serves an execellent basic
understanding and allows to draw implications for the IoT industry [25].
Security reasearches have recently executed ransomware on Bosch IoT devices
directly, which was based on NEXO-OS Linux distribution [26]. This research
demonstrates, that ransomware on IoT devices directly is achievable.

###  VI-A IoT threat overview

Based on the findings in this research paper, it can be assumed that
cybercriminals are more likely to simply block operations for a certain,
unbearable period of time until the victim is willing to pay the ransom. While
Windows ransomware is developed generically and can be widely used, the
situation is different for Linux. Linux is individual in details. Therefore,
Linux ransomware must be individually tailored and developed for the
respective attack target. Attacks are only worthwhile if they promise
considerable financial gain for the hackers. It can be assumed that attacks on
IoT solutions are worthwhile if it is a ”low hanging fruit” due to many
vulnerabilities, or if the victim has reached such a large scale that even
complex operations promise considerable profits. In any case, the barrier and
effort for hackers is significantly higher than in comparison to Windows,
which can sometimes be assembled using a modular principle.

A lower threat is seen for IoT solutions that have good basic security and are
only averagely visible on the market. It can be assumed that costs and profit
opportunities are not present for the attackers. Medium-sized manufacturers
that meet basic IT security requirements are particularly at an advantage
here.

###  VI-B IoT attack vectors

An IoT solution can be attacked in 3 different ways: The IoT end device
directly, the IoT gateway or the IoT cloud infrastructure. Attacks on the end
device are often not scaleable and require physical or direct access, if the
end device is not directly exposed to the internet.

Attacks on IoT gateways also often lack scalability, but could be possible if
attackers gain access to the victim’s network through other means. Getting
access to the victim’s network is effortful, and the victim may not have big
willingness to pay the ransom. The other option could be to just throw-away a
low-cost device. The third attack path would target the cloud infrastructure
with the highest likelyhood for an scalable attack. In this case, the below-
mentioned recommendations in Section VII are directly applicable.

##  VII Discussion and Conclusion

In this paper, we outlined major differences between Windows and Linux
ransomware. The results enables IT responsibles to evaluate the risk in their
area and take appropriate action.

We diversified the encryption methods. The experiments demonstrated diverse
key management and encryption methods for Linux systems. Only Icefire
ransomware is confirmed to use AES encryption. Cl0p used a hardcoded RC4
symmetric master-key and Blackbasta used ChaCha20 in combination with RSA. The
results contradicted those of other researchers compared to Windows operating
systems. As a result, the different use of encryption methods poses major
practical difficulties for live forensic investigations. Previously proven
methods and tools that were mainly used for RSA and AES can no longer be used.
Suitable, ready-to-use implementations for obtaining RC4 or Chacha20 keys from
memory dumps were not found during the literature search.

Linux ransomware development appears to be in its early stages and is expected
to progress and reach a similar level of maturity to Windows-based malware.
The samples examined always serve a predefined goal and do not exploit the
full potential for damage. The following recommendations can be made to
protect Linux systems.

Avoid HOME directories. To reduce the risk of a ransomware attack, it is
recommended not to store important data under /home/user or /root.

Separate and restrict permissions and data access. It also became apparent
that the ransomware was unable to independently take over other processes or
user rights. Each application should have separate storage space and run with
different users.

Avoid using privileged users. Cl0p and Blackbasta could only encrypt the data
if they were run with admin rights. When the Icefire ransomware was run as a
normal user, the attack was only limited to the user’s specific home
directory.

Focus on identifying backdoors. All 3 ransomware variants were unable to
spread independently across the network. Other computers on the network were
unaffected. This suggests that cybercriminals are targeting the victims and
may have already created backdoors to maintain access. Therefore, forensic
resources should be focused on identifying such backdoors.

Shut down first. Weighing up the chances of forensic investigations and the
risks, it is advisable to shut down the infected Linux machine and surrounding
systems as quickly as possible and not to act hesitantly. Shutting down the
system increases the chances of obtaining the ELF ransomware binary for static
analysis. Static analysis in particular proved to be helpful in the
experiments. The chances that the key can be obtained during forensic
investigations of the RAM are slim.

IoT gateways should separate the operating system in a read-only partition.
Installation and execution should be allowed only for signed software
artifacts. The public key infrastructure and signing procedures should be
operated separately. An offline public key infrastructure for signing the
firmware and software is recommended. Regular updates of the IoT cloud
infrastructure are required to maintain low exposure to vulnerabilities and
reduce risk of lateral movement.

Security hygiene in development is essential to protect access to the IoT
cloud infrastructure. Developers should install and use only approved and
verified software and introduce secrets management solutions with secrets
rotation. Development applications and tools should not be accessible
throughout the internet.

## References

  * [1] I. Lella, C. Ciobanu, E. Tsekmezoglou, M. Theocharidou, E. Magonara, A. Malatras, R. Svetozarov Naydenov _et al._ , “Enisa threat landscape 2023: July 2022 to june 2023,” 2023.
  * [2] M. Ryan, _Ransomware Revolution: The Rise of a Prodigious Cyber Threat_. Springer, 2021.
  * [3] Chainalysis, “Ransomware revenue down as more victims refuse to pay,” 2023. [Online]. Available: https://www.chainalysis.com/blog/crypto- ransomware-revenue- down-as-victims-refuse-to-pay/
  * [4] T. W. House, “International counter ransomware initiative 2023 joint statement,” 2023. [Online]. Available: https://www.whitehouse.gov/briefing-room/ statements-releases/2023/11/01/international-counter-ransomware- initiative-2023-joint-statement/
  * [5] Europol, “Cyber-attacks: the apex of crime-as-a-service, europol spotlight report series,” 2023.
  * [6] M. Glenny, “The untold history of today’s russian-speaking hackers.” _Financial Times_ , 2023. [Online]. Available: https://www.ft.com/content/9ac188be-8bcf-4b5a-8051- 10563683b979
  * [7] Statista, “Marketshare of leading operating systems worldwide from january 2009 till july 2023.” 2023. [Online]. Available: https://de.statista.com/statistik/daten/studie/157902/umfrage/ marktanteil-der- genutzten- betriebssysteme-weltweit-seit-2009/
  * [8] A. Thaeler, Y. Yigit, L. A. Maglaras, B. Buchanan, N. Moradpoor, and G. Russell, “Enhancing mac os malware detection through machine learning and mach-o file analysis.” Institute of Electrical and Electronics Engineers, 2023.
  * [9] Statista, “Share of the global server market by operating system in 2018 and 2019,” 2019. [Online]. Available: Retrieved from https://www.statista.com/statistics/915085/global- server- share-by-os/
  * [10] F. B. Insights, “Server operating system market volume, share & covid-19 impact analysis, by operating system (windows, linux, unix, and others), by virtualization status (virtual machine, physical, and virtualized), by subscription model (non-paid subscription and paid subscription), by enterprise type (large enterprises and small & medium enterprises), and regional forecast, 2023-2030,” 2023. [Online]. Available: https://www.fortunebusinessinsights.com/serveroperating-system-market- 106601
  * [11] A. Terefos, “Cl0p ransomware targets linux systems with flawed encryption — decryptor available.” 2023. [Online]. Available: https://www.sentinelone.com/labs/cl0p-ransomware-targets-linux-systems-with-flawed-encryption-decryptor-available/
  * [12] G. D. Software, “G data threat report: Significant increase in linux ransomware.” G Data Software, Tech. Rep. [Online]. Available: https://www.gdatasoftware.co.uk/news/2022/08/37568-g-data-threat-report-significant-increase-in-linux-ransomware
  * [13] T. Micro, “Defending the expanding attack surface. trend micro 2022 midyear cybersecurity report.” Tech. Rep., 2022. [Online]. Available: https://documents.trendmicro.com/assets/rpt/rpt-defending-the-expanding- attack-surface-trend-micro-2022-midyear-cybersecurity-report.pdf
  * [14] G. Johansen, _Digital Forensics and Incident Response: Incident Response Tools and Techniques for Effective Cyber Threat Response._ , 3rd ed. Birmingham: Packt Publishing, 2022.
  * [15] M. Roth, “Internal paper of the bsi. final report: Anhalt- bitterfeld paralyzed for too long by cyber attack.” _MITTELDEUTSCHER RUNDFUNK_ , 2023. [Online]. Available: https://www.mdr.de/nachrichten/sachsen-anhalt/dessau/podcast-cyberkatastrophe-bsi-kritik-landkreis-100.html
  * [16] S. R. Davies, “Evaluation of live forensic techniques in ransomware attack mitigation,” 2020.
  * [17] A. Delamotte, “Icefire ransomware returns — now targeting linux enterprise networks,” _Sentinel LABS_ , 2023. [Online]. Available: https://www.sentinelone.com/labs/icefire-ransomware-returns-now-targeting-linux-enterprise-networks/
  * [18] J. Umawing, “Blackbasta is the latest ransomware to target esxi virtual machines on linux,” _MalwareBytes_ , 2022.
  * [19] P. McLaren, W. J. Buchanan, G. Russell, and Z. Tan, “Deriving chacha20 key streams from targeted memory analysis,” _Journal of Information Security and Applications_ , vol. 48, p. 102372, Oct. 2019. [Online]. Available: http://dx.doi.org/10.1016/j.jisa.2019.102372
  * [20] L. Lamsouber, “What is a ransomware and how does it work?” 2023.
  * [21] S. One, “Cl0p-elf-decryptor,” 2023. [Online]. Available: https://github.com/SentineLabs/Cl0p-ELF-dcryptor/blob/main/clop_linux_file_decr.py
  * [22] G. McDonald, P. Papadopoulos, N. Pitropakis, J. Ahmad, and W. J. Buchanan, “Ransomware: Analysing the impact on windows active directory domain services,” _Sensors_ , vol. 22, no. 3, p. 953, Jan. 2022. [Online]. Available: http://dx.doi.org/10.3390/s22030953
  * [23] S. Skuratovich, “Check point looking into teslacrypt v3.0.1,” _CHECK POINT_ , 2016.
  * [24] D. Ashdown, “Jigsaw ransomware analyses,” 2021. [Online]. Available: https://www.cyberdonald.com/post/jigsaw-ransomware-analyses
  * [25] A. Gerodimos, L. Maglaras, M. A. Ferrag, N. Ayres, and I. Kantzavelou, “Iot: Communication protocols and security threats,” _Internet of Things and Cyber-Physical Systems_ , 2023.
  * [26] N. N. Labs, “Vulnerabilities on bosch rexroth nutrunners may be abused to stop production lines, tamper with safety-critical tightenings,” 2024. [Online]. Available: https://www.nozominetworks.com/blog/vulnerabilities-on-bosch-rexroth-nutrunners