Name: Android ransomware has picked up some ominous new tricks
Brand: arstechnica.com
SKU: arstechnica-com-233
Availability: OnlineOnly

critic

Android ransomware has picked up some ominous new tricks

preview

Though ransomware has been around for years, it poses an ever-increasing threat to , , and basically . But along with the in these attacks, there's another burgeoning platform for ransomware as well: Android phones. And new research from Microsoft shows that criminal hackers are investing time and resources in refining their mobile ransomware tools—a sign that their attacks are generating payouts.Released on Thursday, the , which were detected using Microsoft Defender on mobile, look at a variant of a known Android ransomware family that has added some clever tricks. That includes a new ransom note delivery mechanism, improved techniques to avoid detection, and even a machine-learning component that could be used to fine-tune the attack for different victims' devices. While mobile ransomware has been around since and still isn't a ubiquitous threat, it could be poised to take a bigger leap."It's important for all users out there to be aware that ransomware is everywhere, and it's not just for your laptops but for any device that you use and connect to the Internet," says Tanmay Ganacharya, who leads the Microsoft Defender research team. "The effort that attackers put in to compromise a user's device—their intent is to profit from it. They go wherever they believe they can make the most money."Mobile ransomware can on a device the way PC ransomware does, but it often uses a different method. Many attacks simply involve plastering your entire screen with a ransomware note that blocks you from doing anything else on your phone, even after you restart it. Attackers have typically abused an Android permission called "SYSTEM_ALERT_WINDOW" to create an overlay window that you couldn't dismiss or circumvent. Security scanners started to detect and flag apps that could produce this behavior, though, and Google added protections against it . As an alternative to the old approach, Android ransomware can still abuse accessibility features or use mapping techniques to draw and redraw overlay windows.The ransomware Microsoft observed, which it calls AndroidOS/MalLocker.B, has a different strategy. It invokes and manipulates notifications intended for use when you're receiving a phone call. But the scheme overrides the typical flow of a call eventually going to voicemail or simply ending—since there is no actual call—and instead distorts the notifications into a ransom note overlay that you can't avoid and that the system prioritizes in perpetuity.The researchers also discovered a machine-learning module in the malware samples they analyzed that could be used to automatically size and zoom a ransom note based on the size of a victim's device display. Given the diversity of Android handsets in use around the world, such a feature would be useful to attackers for ensuring that the ransom note displayed cleanly and legibly. Microsoft found, though, that this ML component wasn't actually activated within the ransomware and may still be in testing for future use.In an attempt to evade detection by Google's own security systems or other mobile scanners, the Microsoft researchers found that the ransomware was designed to mask its functions and purpose. Every Android app must include a "manifest file," that contains names and details of its software components, like a ship's manifest that lists all passengers, crew, and cargo. But aberrations in a manifest file are often an indicator of malware, and the ransomware developers managed to leave out code for numerous parts of theirs. Instead, they encrypted that code to make it even harder to assess and hid it in a different folder, so the ransomware could still run but wouldn't immediately reveal its malicious intent. The hackers also used other techniques, including what Microsoft calls "name mangling," to mislabel and conceal the malware's components."This particular threat family has existed for a while, and it has used many techniques to compromise the user, but what we saw here is that it was not doing what we expected or what it was doing in the past," Microsoft Defender's Ganacharya says.Microsoft says that it sees the ransomware mostly being distributed by attackers in online forums and through random webpages rather than official channels. They typically market the malware by making it look like other popular apps, video players, or games to entice downloads. And though there have been some of iOS ransomware, this is still far less common—similar to how is still . Microsoft shared the research with Google prior to publication, and Google emphasized to WIRED that the ransomware was not found in its Play Store.Making sure that you is the easiest way to avoid mobile ransomware and protect yourself from all sorts of other malware, too. But given PC ransomware's success targeting both big businesses and individuals, mobile ransomware may just be getting started.This story originally appeared on .You must to comment.

Though ransomware has been around for years, it poses an ever-increasing threat to , , and basically . But along with the in these attacks, there's another burgeoning platform for ransomware as well: Android phones. And new research from Microsoft shows that criminal hackers are investing time and resources in refining their mobile ransomware tools—a sign that their attacks are generating payouts.Released on Thursday, the , which were detected using Microsoft Defender on mobile, look at a variant of a known Android ransomware family that has added some clever tricks. That includes a new...

public

Lily Hay Newman

Ars Technica is a website covering news and opinions in technology, science, politics, and society, created by Ken Fisher and Jon Stokes in 1998. It publishes news, reviews, and guides on issues such as computer hardware and software, science, technology policy, and video games. Many of the site's writers are postgraduates and some work for research institutions. Articles on the website are written in a less-formal tone than those in traditional journals. Ars Technica was privately owned until May 2008, when it was sold to Condé Nast Digital, the online division of Condé Nast Publications.

Android ransomware has picked up some ominous new tricks

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS