Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/20/2017
04:15 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Mobile Ransomware Hits Browsers with Old-School Techniques

Several types of malware sold on the dark Web advertise the ability to spy on Android smartphones, encrypt files, and demand payment.

Mobile devices are not immune to ransomware. Researchers anticipate smartphones and tablets increasingly will be targeted as spying and information theft capabilities are becoming more widely available in the dark Web.

Researchers from SecureWorks' Counter Threat Unit (CTU) discovered 200 new ransomware variants last year, a 122% increase from the year prior. There is potential for mobile ransomware to become a significant threat, according to the firm's new 2017 State of Cybercrime Report.

CTU researchers found several types of malware for sale, some advertising the ability to spy on all functions of an Android phone as well as to encrypt files and demand payment, the hallmark of a ransomware attack. One malicious Android package kit (APK) file, containing a bot and ransomware, sells for about $1,000 USD on Russian-speaking forums.

Android devices are at greatest risk for users downloading applications that could potentially be malicious because users can access third-party markets (not Google Android's) where anyone can upload an app. 

"By virtue of Google's decision to make a semi-open ecosystem, it's inevitable they're going to be most at risk for these types of applications," says Keith Jarvis, senior security researcher with SecureWorks' CTU. That said, most mobile ransomware threats are browser-based and affect any device with a built-in browser, he adds.

Mobile ransomware geared toward individuals is a less targeted and smaller-value approach than ransomware targeting businesses - but it could also prove more effective. Individuals don't have the security knowledge and resources businesses have to defend against ransomware.

"What a lot of people are seeing on mobile is ransomware we saw before 2013 - for example, scareware and popups in the browser saying 'You've got a virus,'" Jarvis explains. "It locks the screen, encrypts files, demands payment."

Browser-based threats can't access many facilities on the devices, which is why attackers rely on old techniques like screen freezing. Researchers also saw an increase in SMS phishing, where threats arrive via text. Banking malware Exobot, for example, is a malware/spyware combination targeting Android with SMS messages containing malicious links.

With the rise of SMS phishing and advanced exploit kits, researchers expect there could be a rise of attacks focused on encrypting Android devices and leaving victims with no access to contacts, photos, or other personal information.

While mobile ransomware is a threat to the enterprise, Jarvis says organizations should continue to focus more on desktop-based ransomware. Most employees store business-critical data on their computers and until they begin to do the bulk of their work on smartphones and tablets, their desktops and laptops will be at greatest risk.

"That shift is going to have to happen," he notes. "Corporations will ask workers to be more mobile."

Threats in your inbox

It's expensive to develop exploits for Internet Explorer or Microsoft Edge. As a result, hackers are turning to social engineering and spam, which Jarvis describes as "the most economical way to reach potential victims.

"It's more about the behavioral aspect," he explains. "People are always tempted to double-click, to view something that comes through their email."

A related finding from the report is the growth of business email compromise (BEC) and business email spoofing (BES), which generated $5 billion USD in global losses between October 2013 and December 2016. In May 2017, the FBI stated victims' losses related to BEC and BES went up 2,370% between January 2015 and December 2016.

Both types of attacks have become more prolific as attackers look for ways to defraud increasingly security-savvy employees.

BEC attacks generated $5.3 billion in global losses between 2013 and 2017, Trend Micro researchers reported earlier this year. Attackers are turning to old BEC techniques, frequently spoofing the company's CEO and sending fake emails to heads of finance to request money.

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
samairakhan917
50%
50%
samairakhan917,
User Rank: Apprentice
10/20/2017 | 8:53:21 AM
Relationship
Glorious article, it was amazingly helpful! I just began in this and   I'm ending up more comfortable with it better! Cheers, keep doing astounding! 

 
martin.george
50%
50%
martin.george,
User Rank: Apprentice
9/25/2017 | 11:15:32 AM
Cool
That is so cool written) I can't say something bad about your article 
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21620
PUBLISHED: 2021-02-24
A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims.
CVE-2021-21621
PUBLISHED: 2021-02-24
Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication details only)" information, which can include the session ID of the user creating the support bundle in some configurations.
CVE-2021-21622
PUBLISHED: 2021-02-24
Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVE-2020-28599
PUBLISHED: 2021-02-24
A stack-based buffer overflow vulnerability exists in the import_stl.cc:import_stl() functionality of Openscad openscad-2020.12-RC2. A specially crafted STL file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2020-7846
PUBLISHED: 2021-02-24
Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to a file download and execution via access to crafted web page.