Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News

6/5/2014
02:15 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Simplocker: First-Ever Data-Encrypting Ransomware For Android

ESET has discovered the first Android ransomware that doesn't just lock screens, but encrypts files.

While all earlier ransomware for Android devices had worked by locking a device's screen, this weekend researchers at ESET spotted Simplocker, a new piece of Android malware that holds individual files for ransom by encrypting them. The researchers believe that the version they've seen is just a work in progress, because, although some of the attack techniques are rather sophisticated, the encryption itself is not.

"It's quite contradictory," says Robert Lipovsky, security intelligence team lead at ESET.

Simplocker scans the device's SD card for a wide variety of documents (including images, photos, PDFs, and Word docs). It encrypts those files and then issues this ransom note (translated from Russian):

WARNING your phone is locked!
The device is locked for viewing and distribution child pornography , zoophilia and other perversions.
To unlock you need to pay 260 UAH.
1. Locate the nearest payment kiosk.
2. Select MoneXy.
3. Enter
[REDACTED].
4. Make deposit of 260 Hryvnia, and then press pay.
Do not forget to take a receipt!
After payment your device will be unlocked within 24 hours.
In case of no PAYMENT YOU WILL LOSE ALL DATA ON your device!

On one hand, explains Lipovsky, Simplocker uses basic AES encryption, which is not very impressive alongside the double-encryption used by CryptoLocker. On the other hand, it uses a variety of techniques to protect the attacker's identity that Lipovsky says are relatively uncommon.

For example, the attack demands that payment be made via MoneXy, which is not as traceable as credit card activity.

Further, the command-and-control server is hosted on a TOR onion domain.

Simplocker also sends identifiable information about the device (model, operating system, manufacturer) back to the C&C server, but Lipovsky says that he has seen no evidence that would indicate the malware would export personally identifiable information about the user.

Being that the message is written in Russian and demands payment in Ukrainian currency, it is safe to assume that Simplocker is aimed at that region. Although recent research elsewhere has found that malware activity in this region spiked at the height of the geopolitical conflict between Russia and Ukraine, Lipovsky will not speculate upon whether or not Simplocker is at all politically motivated.

Although the ransom note states that the device has been locked because it was used to view or distribute "child pornography, zoophilia, and other perversions," Lipovsky would not categorize Simplocker as "police ransomware," exactly. The ransom does not actually claim to come from law enforcement or include any police force logos.

The ransom requested, 260 UAH, equals roughly US$21. Lipovsky does not have an estimate of how many people have paid the ransom thus far, but since the malware is "quite fresh," it is probably quite a small number.

Ransomware has been a hot topic lately. Two weeks ago, more than 90 people were arrested for their connection to the Blackshades remote access toolkit, which contains ransomware. Monday, the US Department of Justice announced a major international effort to disrupt the Gameover Zeus botnet, which is often used in tandem with the CryptoLocker ransomware. CryptoLocker is well known partly for its association with Gameover Zeus and partly because it encrypts files twice with two different encryption algorithms.

"CryptoLocker is quite sophisticated," says Lipovsky, "but it is still a bit overhyped."

Lipovsky says that ransomware wouldn't be as big a deal if people just kept better backups.

For more information about ransomware, listen to yesterday's episode of Dark Reading Radio, "Pay Up Or Never See Your Data Again: Ransomware Raises The Stakes," with DarkReading's executive editor Kelly Jackson-Higgins and Lance James, head of cyber intelligence at Deloitte & Touche.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
6/8/2014 | 10:47:32 AM
End of the Local Storage Era
Beyond the obvious common sense avoidance strategies like being careful what you install, what links you click, what attachments you open, etcetera, I think this wave of ransomware signal the beginning of an era I've always assumed we'd reach - the end of local storage; not DVDs/USB and the like, but internal hard drive.

With data stored persistently across dozens of nodes, encrypted and protected by distinct separate networks, ransomware would be innefective outside of the inital locking up of your device - easily cured by executing a factory reset which should be made easier and part of external options as we move forward to a cloud-based storage scheme.

Yes, there are a host of things "difficult" with a completely cloud storage architecture, especially network outages that block you from nodes.  Drawing board time is needed...  
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15930
PUBLISHED: 2020-09-24
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
CVE-2020-19447
PUBLISHED: 2020-09-24
SQL injection exists in the jdownloads 3.2.63 component for Joomla! com_jdownloads/models/send.php via the f_marked_files_id parameter.
CVE-2020-3560
PUBLISHED: 2020-09-24
A vulnerability in Cisco Aironet Access Points (APs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on an affected device. The vulnerability is due to improper resource management while processing specific packets. An attacker could exploit this vulnerability by s...
CVE-2020-3509
PUBLISHED: 2020-09-24
A vulnerability in the DHCP message handler of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers could allow an unauthenticated, remote attacker to cause the supervisor to crash, which could result in a denial of service (DoS) condition. The vulnerability is due to insufficient error...
CVE-2020-3510
PUBLISHED: 2020-09-24
A vulnerability in the Umbrella Connector component of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticated, remote attacker to trigger a reload, resulting in a denial of service condition on an affected device. The vulnerability is due to insufficient error h...