Though ransomware has been around for years, it poses an ever-increasing threat to hospitals, municipal governments, and basically any institution that can't tolerate downtime. But along with the various types of PC malware that are typically used in these attacks, there's another burgeoning platform for ransomware as well: Android phones. And new research from Microsoft shows that criminal hackers are investing time and resources in refining their mobile ransomware tools—a sign that their attacks are generating payouts.
Released on Thursday, the findings, which were detected using Microsoft Defender on mobile, look at a variant of a known Android ransomware family that has added some clever tricks. That includes a new ransom note delivery mechanism, improved techniques to avoid detection, and even a machine-learning component that could be used to fine-tune the attack for different victims' devices. While mobile ransomware has been around since at least 2014 and still isn't a ubiquitous threat, it could be poised to take a bigger leap.
Mobile ransomware can encrypt files on a device the way PC ransomware does, but it often uses a different method. Many attacks simply involve plastering your entire screen with a ransomware note that blocks you from doing anything else on your phone, even after you restart it. Attackers have typically abused an Android permission called "SYSTEM_ALERT_WINDOW" to create an overlay window that you couldn't dismiss or circumvent. Security scanners started to detect and flag apps that could produce this behavior, though, and Google added protections against it last year in Android 10. As an alternative to the old approach, Android ransomware can still abuse accessibility features or use mapping techniques to draw and redraw overlay windows.
The ransomware Microsoft observed, which it calls AndroidOS/MalLocker.B, has a different strategy. It invokes and manipulates notifications intended for use when you're receiving a phone call. But the scheme overrides the typical flow of a call eventually going to voicemail or simply ending—since there is no actual call—and instead distorts the notifications into a ransom note overlay that you can't avoid and that the system prioritizes in perpetuity.
The researchers also discovered a machine-learning module in the malware samples they analyzed that could be used to automatically size and zoom a ransom note based on the size of a victim's device display. Given the diversity of Android handsets in use around the world, such a feature would be useful to attackers for ensuring that the ransom note displayed cleanly and legibly. Microsoft found, though, that this ML component wasn't actually activated within the ransomware and may still be in testing for future use.
“Name mangling”
In an attempt to evade detection by Google's own security systems or other mobile scanners, the Microsoft researchers found that the ransomware was designed to mask its functions and purpose. Every Android app must include a "manifest file," that contains names and details of its software components, like a ship's manifest that lists all passengers, crew, and cargo. But aberrations in a manifest file are often an indicator of malware, and the ransomware developers managed to leave out code for numerous parts of theirs. Instead, they encrypted that code to make it even harder to assess and hid it in a different folder, so the ransomware could still run but wouldn't immediately reveal its malicious intent. The hackers also used other techniques, including what Microsoft calls "name mangling," to mislabel and conceal the malware's components.
"This particular threat family has existed for a while, and it has used many techniques to compromise the user, but what we saw here is that it was not doing what we expected or what it was doing in the past," Microsoft Defender's Ganacharya says.
Microsoft says that it sees the ransomware mostly being distributed by attackers in online forums and through random webpages rather than official channels. They typically market the malware by making it look like other popular apps, video players, or games to entice downloads. And though there have been some early examples of iOS ransomware, this is still far less common—similar to how Mac ransomware is still relatively rare. Microsoft shared the research with Google prior to publication, and Google emphasized to WIRED that the ransomware was not found in its Play Store.
Making sure that you download Android apps only from trusted app stores like Google Play is the easiest way to avoid mobile ransomware and protect yourself from all sorts of other malware, too. But given PC ransomware's success targeting both big businesses and individuals, mobile ransomware may just be getting started.
This story originally appeared on wired.com.
"Android" - Google News
October 10, 2020 at 05:16PM
https://ift.tt/2FjwSCx
Android ransomware has picked up some ominous new tricks - Ars Technica
"Android" - Google News
https://ift.tt/336ZsND
https://ift.tt/2KSW0PQ
Bagikan Berita Ini
0 Response to "Android ransomware has picked up some ominous new tricks - Ars Technica"
Post a Comment