DOROS HADJIZENONOS, Country Manager of Check Point South Africa, explores why mobile ransomware has become the biggest mobile security threat, and how users can guard against it.
Imitation is a quick way to learn, which is why mobile malware is evolving so rapidly – it frequently imitates attack behaviours and trends that were first trialled and proven to work in the PC world. Mobile ransomware is following this path, with the aim of replicating the success that PC-based ransomware has had in extorting money from individuals and organisations. So it’s no surprise that the number of mobile ransomware variants detected in Q1 2016 grew 45% compared with Q4 2015.
Like its cousins that target PCs, mobile ransomware has become more complex and malicious in the way it works, too. The first mobile ransomware types were ‘screen blockers’, which displayed prominent alerts and made normal interaction with the screen impossible – similar to lock-screen PC ransomware. First seen in 2013, the malware posed as anti-virus software and informed victims their device was infected, demanding they purchased a full version of the software to ‘disinfect’ the device and make it usable again.
In 2014 the first mobile ransomware which encrypts files was detected, again following the success of Windows cryptolocker-style malware. The most recent mobile ransomware type is the Pin locker, which emerged in 2015. One example, called PornDroid, pretends to be a porn player, and tricks the user into granting it Admin privileges. Once it has these, the malware changes users’ Pin codes, locking them out of their devices and displaying a ransom message. We conducted a detailed investigation into how this type of ransomware worked, and we found one variant had infected tens of thousands of devices, with some victims paying $200 to $500 to unlock their data and regain control of the device.
The device divide
While mobile ransomware currently targets Android devices almost exclusively – largely because iOS devices need to be jailbroken in order to download apps from sources other than Apple’s App Store, making them harder to infect – there has been a case in which iOS users were extorted. In 2015, attackers exploited stolen credentials to log into users’ iCloud accounts and remotely locked their devices, and demand ransoms to release them. And in March 2016, the first ransomware targeting Apple Macs, KeRanger, was discovered, so we should expect to see ransomware targeting iOS devices soon.
Check your privilege
Currently, mobile ransomware focuses on locking users out of the device, because the mobile operating systems do not allow malware to access all the device’s areas of memory or storage. However, the privilege escalation exploits referenced earlier point clearly to the next step in ransomware evolution, using techniques to gain ‘root’ privileges on the device which effectively give the criminal complete control of the infected phone or tablet.
Most methods for rooting the device rely on exploiting vulnerabilities either in the OS, the hardware, or individual applications. Unfortunately, these vulnerabilities are widespread: over the past 6 months, over half of Android patches released by Google are for securing devices against privilege escalation exploits – so we can expect to see more ransomware targeting these flaws to gain elevated privileges over the next year.
How can I protect my devices?
The most fundamental principle of mobile device security is never to root or jailbreak your phone – in other words, to avoid deliberate privilege escalations that could then leave you open to malicious ones that may harbour ransomware. A robust security solution should also be applied. Enterprises should select a mobile device management (MDM) solution – but all MDMs are not equal. Some are able to identify when a phone has been deliberately rooted by a user, but not when it has been rooted by malware – and some more advanced malware can disguise itself against such inspection.
A more effective approach is to quarantine and inspect any suspicious apps or attachments in the cloud, before downloading them to the device. This blocks the main vector for privilege escalation, which is from rogue apps.
The mobile threat prevention solution should use a number of components working together to respond to the most common mobile attack vectors. Devices must be continually analyzed to uncover system vulnerabilities and unusual behaviour. Monitoring configuration and behaviour analysis can help identify root access attempts as outlined above. And any downloaded apps must be inspected for the unique binary signatures for known malware; they should also be captured and reverse-engineered for code-flow analysis to expose suspicious behaviour.
And don’t overlook simple steps such as regularly backing-up data on your device so that if the worst does happen, you can recover your files without having to pay.
Help! I’ve already been infected
Unfortunately, there may be little you can do, which is why it’s important to perform regular backups of the data stored on your mobile device. You should certainly avoid paying any ransom, and take your device to a mobile security specialist rather than attempting to decrypt it yourself. But ultimately, when it comes to mobile ransomware, prevention is by far the best protection.
Win a Poster Heater with Gadget and Takealot.com
This winter Gadget and Takealot.com are giving away three Poster Heaters, which look like posters but become heaters when you plug them in.
Three Gadget readers will each win a unit, valued at R550 each. To enter, follow @GadgetZA and @Takealot on Twitter and tell us on the @GadgetZA account how many Watts the heater consumes.
What’s the big deal about these heaters? Many of us are struggling to keep the balance between soaring electricity costs and the need to keep warm this winter.
However, the recently launched Poster Heater by EasyHeat and distributed in South Africa by Takealot.com is not only one of the most cost effective electric heaters currently on the market, it is also easy to setup and use.
As the name indicates, it is a poster similar to one you would hang on a wall. But, plug it in and it turns into a 300 Watt heater. The Poster Heater isn’t designed to heat hallways or large rooms, but rather smaller ones like a bedroom or a baby’s nursery or a dressing room.
It uses radiant heating, which means that it heats up in a couple of minutes and the heat is directed at the objects or people around it, quickly taking the chill out of the air and providing a comfortable ambient temperature.
The other advantage of radiant heating is that it doesn’t dry out the air like infrared or gas heaters. Users also don’t have to worry about their children or pets getting too close to it because, even though it gets hot, it can be touched.
To enter the competition follow the steps below:
Competition entry details:
3. The competition closes on 31 July 2018.
4. Winners will be notified via Twitter on 1 August and Takealot.com will be in touch to organise delivery.
5. The competition is only open to South African residents.
Happy Emoji Day! Here’s 10 reasons to be cheerful
First created by Shigetaka Kurita in 1999, the emoji has become a huge part of everyday communication. Whether you love them or hate them, flying dollar bills, applauding hands and rolling eyes are here to stay.
Scientist suggest that the use of emojis will help us gain the same satisfaction from digital interactions as we enjoy from personal contact.
Almost two decades later, and we have over 2600 unique emojis to perfectly express what we feel, thank you Mr Kurita! Join HMD, the home of Nokia phones as we celebrate World Emoji Day on the 17th of July with these interesting emoji facts:
The most popular emoji used is “Person Shrugging”
1. The Nokia 3310 was chosen as one of the first 3 “National” emojis for Finland… it represents unbreakable!
2. South Africa’s favourite emoji is the “Kiss and wink”… how sweet SA!
3. French is the only language where a ‘smiley’ does not top the list for its use
4. On average, over 60 billion emojis are sent on Facebook every day
5. For the first time ever, the Oxford Dictionaries Word of the Year was a pictograph! The “Face with Tears of Joy” was crowned word of the year in 2015
6. According to Emojipedia, some of the most requested emoji’s include afro, a bagel and hands making a heart
7. To include all races, a diversity pack was released in 2017
8. It has become so trendy that the Museum of Modern Art displays the original emoji collection on canvas
9. In 2009, Herman Melville’s classic Moby Dick was completely translated into emoji’s