alt tag

Posts Tagged ‘Bitcoin’


New Threat Targets Older Android Devices

Wednesday, May 11th, 2016

phone-716965_640

Smartphone users can be broken down into two camps: those who can’t live without lining up to buy the latest and greatest model the day it hits the stores, and those who hold on to their tried-and-true phone until it suddenly dies one morning.

There’s nothing wrong with sticking with “obsolete” hardware that still serves your purposes just fine.

But if your older Android phone (or tablet) is running an older version of the Android operating system (4.4/KitKat or earlier), you’re the designated target of this month’s new cyberthreat, dubbed Dogspectus by enterprise security firm Blue Coat.

Dogspectus combines elements of two types of malware we’ve already talked about: malvertising, passively spread through online ads, and ransomware, holding the victim’s data hostage until a fee is extorted.

“They Never Saw It Coming”—A Drive-By Download

Unlike most malware, which requires action by the victim (such as clicking on a phony link), a Dogspectus infection occurs by simply landing on a legitimate web page containing a corrupted ad with an embedded exploit kit—malicious code which silently probes for a series of known vulnerabilities until it ultimately gains root access—essentially central control of the entire device.

“This is the first time, to my knowledge, an exploit kit has been able to successfully install malicious apps on a mobile device without any user interaction on the part of the victim,” wrote Blue Coat researcher Andrew Brandt after observing a Dogspectus attack on an Android test device. “During the attack, the device did not display the normal ‘application permissions’ dialog box that typically precedes installation of an Android application.”

“Hand Over the Gift Cards, and Nobody Gets Hurt!”

A Dogspectus-infected device displays an ominous warning screen from a bogus government security agency, “Cyber.Police,” accusing the victim of “illegal” mobile browsing—and suggesting an appropriate “fine” be paid. While most ransomware demands payoff in untraceable Bitcoin, Dogspectus prefers $200 in iTunes gift cards (two $100 or four $50 cards) via entering each card’s printed access code (Apple may be able to trace the users of the gift cards—unless they’re being resold on the black market).

The device’s “kidnapped” data files are not encrypted, as with traditional ransomware strains such as CryptoLocker. But hijacked root access effectively locks the device, preventing any function—apps, browser, messaging, or phone calls—other than delivering payment.

The victim is left with two choices: shop for gift cards (Dogspectus conveniently lists national retail outlets!) or reset the device to its out-of-the-box factory state—erasing all data files in the process. Apps, music, photos, videos all gone.

Short of upgrading to a newer Android device, your best defense against Dogspectus and future ad-based malware is to install an ad blocker or regularly back up all your mobile data to another computer. For more on defending against the latest emerging cyberthreats, contact us.

Are Macs “Ransomware-Proof”? Not Anymore

Wednesday, March 23rd, 2016

computer-150097_640

Since Apple famously introduced the Macintosh over three decades ago, Mac users have been confident that their computers are virtually immune to ransomware and other malware threats which plague their Windows counterparts. But those days are over.

On March 4, researchers at security firm Palo Alto Networks detected what they believe is the first “fully functional” ransomware attack aimed exclusively at Apple’s OS X operating platform.

Dubbed KeRanger, the ransomware code was discreetly piggy-backed onto a routine update of Transmission, a popular BitTorrent client (a free Mac utility enabling rapid download/sharing of large files). After lurking on an infected Mac for three days, KeRanger encrypts all or part of a Mac hard drive before demanding an untraceable payment of one Bitcoin (currently the equivalent of about $400) to restore access to the scrambled files.

Hack a Mac? Just Fool the Gatekeeper

Macs are generally less susceptible to viruses and malware thanks to Gatekeeper, a built-in OS X defense feature that rejects software downloads which don’t include an Apple Developer IDessentially Apple’s digital certification for a third-party app they declare legitimate and harmless. In the case of KeRanger, it was fraudulently coded with a Developer ID (Z7276PX673) that had been previously assigned to a software developer in Turkey, enabling it to bypass Gatekeeper and infect the Mac’s hard drive. (How the Turkish company’s Apple certificate apparently fell into the wrong hands is still under investigation.)

After isolating the bogus Developer ID on the morning of March 4, Palo Alto Networks immediately notified Apple, who quickly revoked KeRanger’s certification. The Transmission homepage has also replaced the tainted version of the app with a “clean” update. It was determined that KeRanger was only “in the wild” (at-large and uncontained) within a relatively small window between 11 a.m. March 4 and 7 p.m. March 5.

It Could Have Been Worse

In their haste to begin extorting victims as soon as possible, KeRanger’s developers didn’t complete an additional section of code that would have disabled Time Machine, an OS X feature that restores users’ backup files stored on an external drive—similar to the automated System Restore function in Windows. If they’d spent a little more time refining their “launch version” of ransomware, even backup files would have been hopelessly encrypted without that $400 payoff.

If you’re a Mac user who doesn’t use the Transmission app, you dodged a bullet. But the KeRanger incident is a serious blow to OS X’s reputation as the “hack-proof” operating system. As we’ve discussed, ransomware schemes are the fastest-growing form of cybercrime today, and it was only a matter of time before Macs became a target.

For more information on ransomware and more of the latest emerging cyberthreats, contact us today.

The Single Most Reliable Method for Preventing a Ransomware Attack

Tuesday, December 3rd, 2013

RansomwareLast week, we wrote about the rise of Cryptolocker and Ransomware viruses, the new breed of malware virus infecting host computers through malicious email attachments, and spreading rapidly through its use of commercial-grade RSA encryption and Bitcoin, a universal, virtual currency. Unfortunately, it looks as if the problem will continue to get worse before it improves, and the security industry does not yet have viable solutions to stop every one of the malware’s many variants from infiltrating networks. As the crooks hire the world’s top programmers to create hundreds of new variations on a daily basis, fighting back may seem like a truly daunting task.

(more…)