Ransomware: Cause for Alarm for Android Phone Users 0 283

  • Lock-screen Ransomware and file-encrypting “crypto-ransomware”, have been causing major financial and data losses for many years, and now it's on the Android platform.
  • In Kenya, ransomware offers a unique and differentiated threat. One out of every ten global mobile money transactions occur in Kenya.
  • Individuals without any protected handsets could be adversely compromised as the human layer of M-PESA’s networking environment is essentially vulnerable.
Ransomware Android Phone

What is Ransomware?

Ransomware is a growing problem for users of mobile devices. Lock-screen types and file-encrypting “crypto-ransomware”, both of which have been causing major financial and data losses for many years, have made their way to the Android platform.

ESET has prepared a topical white paper on the growth of this insidious Android malware.

Like other types of Android malware – SMS trojans, for example – ransomware threats have been evolving over the past few years and malware writers have been adopting many of the same techniques that have proven to be effective in regular desktop malware.

Both on Windows and on Android, lock-screens have prompts to scare the victims into paying up after (falsely) accusing them of harvesting illegal content on their devices.

Likewise, as with the infamous Windows Crypto locker ransomware family, crypto-ransomware on Android started using strong cryptography, which meant that affected users had no practical way of regaining the hijacked files.

Notably, everyday data (such as photos and texts) is at an elevated risk as this data is stored on phones rather than PCs.

The Woes of Wangari

A good hypothetical example would be Wangari, who when downloading Instagram on her handset accidentally downloaded a malicious masked application disguised to look like the official Instagram app.

The payload for that application may have been amended to have lock-screen ransomware which denies Wangari access to her phone’s interface, and consequently her M-Pesa account.

How much do you think Wangari would pay the hijackers to access her M-Pesa account?

In Kenya, ransomware offers a unique and differentiated threat. One out of every ten global mobile money transactions occur in Kenya. Essentially, a successful ransomware attack in Kenya could lead to a user being deprived access to their mobile money accounts.

Although the M-PESA system has been deemed robust, individuals without any protected handsets could be adversely compromised as the human layer of M-PESA’s networking environment is essentially vulnerable.

Types of Android Ransomware

According to Robert Lipovsky and Lukas Stefanko from ESET Research, ransomware, as the name suggests, is any type of malware that demands a sum of money from the infected user while promising to “release” a hijacked resource in exchange.

There exist two broad categories of malware that can be termed as ransomware.

  1. Lock-screen ransomware
  2. Crypto-ransomware

The difference of these types of ransomware is that: in lock-screen types of ransomware, the hijacked resource is access to the compromised system while in file-encrypting “crypto-ransomware” that hijacked resource is the user’s files.

Since ransomware first reared its ugly head when the Windows Operating System was widely adopted, it was only logical that the malware writers would similarly adopt ransomware to compromise mobile phones as they are ubiquitous in the modern day.

With consumers switching more and more from PCs to mobile, more and more valuable data are being stored on these devices that devices, which leads to the fact that more and more valuable data is being stored on those devices that all of us carry around, Android ransomware is becoming ever more worthwhile for attackers.

How to Keep Safe

1. Avoiding Unofficial App Stores:

Among the most important active measures to take are avoiding unofficial app stores and having a mobile security app installed and kept up to date.

2. Back up your Data:

In the event of a successful ransomware attack, having a back-up for all your important data enables you to retrieve vital information, such as sentimental photos and vital business information. Having a backup turns such an experience into nothing more than a nuisance.

According to ESET Research, there exist several options for removal if one is successfully infected.

3. Invest in Mobile Security:

Mobile Security includes malware protection, which can protect users from ransomware through scanning infected applications and quarantining them prior to infection of the given device.

We obviously recommend ESET Mobile Security, available at https://www.eset.com/afr/

What to do when infected

1. Boot the device into Safe Mode:

For most simple lock-screen ransomware families, booting the device into Safe Mode – so third-party applications (including the malware) will not load – will do the trick and the user can easily uninstall the malicious application.

The steps for booting into Safe Mode can vary on different device models. (Consult your manual, or ask Google – the search engine.) If the application has been granted Device Administrator privileges, these must first be revoked from the settings menu before the app can be uninstalled.

2. Use an MDM solution:

If ransomware with Device Administrator rights has locked the device using Android’s built-in PIN or password screen lock functionality, the situation gets more complicated. It should be possible to reset the lock using Google’s Android Device Manager or an alternate MDM solution.

Rooted Android phones have even more options. A factory reset, which will delete all data on the device, can be used as the last resort in case no MDM solutions are available.

3.      Contact your Security Provider’s Technical Support:

If files on the device have been encrypted by crypto-ransomware such as Android/Simplocker, we advise users to contact their security provider’s technical support. Depending on the specific ransomware variant, decrypting the files may or may not be possible.

Conclusion

In the event of a ransomware attack, never pay cybercriminals. In certain cases, ESET researchers have discussed ransomware devoid of the code necessary to decrypt malware upon payment. This essentially means that paying cybercriminals does not mean decryption of your data.

Kenyans need to be made aware of the looming ransomware threat which could significantly impact their access to essential mobile services such as M-Pesa. The largest mobile digital economy has a target on its back. We need to remain vigilant.

Previous ArticleNext Article

Malware alert for Android phone users 0 268

Malware alert for Android

Internet security company ESET East Africa has issued an alert to mobile phone users running on the Android platfom to be wary of alternative app stores’ potential to spread malware such as screen locking malware.

According to Teddy Njoroge, Kenya Country Manager for ESET, ransomware is a fast growing problem for users of mobile devices.  “Just like SMS trojans, ransomware threats have evolved over the past few years with hackers  adopting techniques that have proven effective in regular desktop malware to develop lock-screen types and file-encrypting ransomware. These have been causing major financial and data losses for years and which have now made their way to the Android platform“, he said.

The alert comes after Cyber-crime researchers at ESET discovered that www.CepKutusu.com, a Turkish alternative Android app store was spreading malware under the guise of all the offered Android apps on the site

When users browsed the Turkish alternative app store CepKutusu.com and proceeded to downloading an app, the “Download now” button led to banking malware detected as Android/Spy.Banker.IE instead of the desired app.

After ESET researchers turned to the store’s operator with the discovery of the attack, the store ceased the malicious activity. ESET Android malware researcher, Lukas Stefanko said this was an entrirely new tactic by cybercrimnals.

“This is the first time I’ve seen an entire Android market infected like that. Within the Windows ecosystem and in browsers, this technique is known to have been used for some time but in the Android ecosystem, it’s really a new attack vector“, he said.

Athough the misdirection on www.CepKutusu.com was from a legitimate app to the malicious banking malware, the crooks behind the campaign added an exception, a tactic commonly used to increase the chances of staying longer under the radar.

The hackers introduced a seven-day window of not serving malware after a malicious download, thus falsely serving the user with clean download links, only to be redirected to the malware once they try to download any application from the store after the period lapses.

Although focused in Turkey and parts of Europe, the incident points to the growing appetite for mobile malware by hackers using masking tactics to hoodwink users and which could soon become the biggest cybersecurity problem yet.

To protect yourself, Njoroge advises that you should always download apps from official app stores and also practice caution when downloading any content from the internet. Always pay attention to anything suspicious in file name, size and extension.

Lastly is to use a reliable mobile security solution to protect you from the latest threats.

Why Africans should be worried about PETYA 0 368

  • The malicious software has been identified as a modified version of a previously known ransomware, called Petya or Petrwrap, that has been substantially altered.
  • Due to its unique characteristics, it has been dubbed as NotPetya and ExPetya, which is currently detected by ESET as Win32/Diskcoder.C Trojan.
  • NotPetya can be termed as a worm, which can self-replicate across multiple networks. Petya uses two primary methods to spread across networks. Execution across network shares and SMB exploits
  • The current global ransomware trend utilises the EternalBlue Exploit in order to take advantage of the vast use of the Windows Operating System.
  • More than 80% of enterprise servers and endpoints in the African Digital Economy run on the Windows Operating System.
africans-worried-petya

It all begins with the MS17-010 Exploit

The EternalBlue Exploit, otherwise known as MS17-010, developed by the NSA and pilfered by the Shadow Brokers continues to open opportunities for malicious malware authors as fresh ransomware attacks continue to ravage Europe while spreading through the globe at an alarming pace.

Notably, it has become evident that in the realm of cybersecurity, the adage of once bitten, twice shy, seldom applies as unpatched computer systems have been utilised for a second time by cybercriminals to achieve exponential infection rates, reminiscent of the WannaCry nightmare that the globe experienced only two months ago.

NotPetya

The malicious software has been identified as a modified version of a previously known ransomware, called Petya or Petrwrap, that has been substantially altered, prompting a debate among researchers over whether it is new malware.

Due to its unique characteristics, it has been dubbed as NotPetya and ExPetya, which is currently detected by ESET as Win32/Diskcoder.C Trojan. If it successfully infects the MBR (Master Boot Record), it will encrypt the whole drive itself. Otherwise, it encrypts all files, like Mischa.

How does NotPetya replicate?

In many ways, NotPetya can be termed as a worm, which can self-replicate across multiple networks. Petya uses two primary methods to spread across networks. These include:

  • Execution across network shares: It attempts to spread to the target computers by copying itself to [COMPUTER NAME]\\admin$ using the acquired credentials. It is then executed remotely using either PsExec or the Windows Management Instrumentation Command-line (WMIC) tool. Both are legitimate tools.
  • SMB exploits: It attempts to spread using variations of the EternalBlue and EternalRomance exploits.

Crucially, NotPetya seeks to gain administrator access on a machine and then leverages that power to commandeer other computers on the network: it takes advantage of the fact that far too many organizations employ flat networks in which an administrator on one endpoint can control other machines, or sniff domain admin credentials present in memory, until total control over the Windows network is achieved. It achieves primary access through using phishing techniques to trick administrators into running the malware with high privileges.

What institutions have been adversely affected?

africans-worried-petya

The most severe damage is being reported by Ukrainian businesses, with systems compromised at Ukraine’s central bank, state telecom, municipal metro, and Kiev’s Boryspil Airport. Systems were also compromised at Ukraine’s Ukrenego electricity supplier, although a spokesperson said the power supply was unaffected by the attack. The attack has even affected operations at the Chernobyl nuclear power plant, which has switched to manual radiation monitoring as a result of the attack.

Infections have also been reported in more isolated devices like point-of-sale terminals and ATMs. The virus has also spread internationally. The Danish shipping company Maersk has also reported systems down across multiple sites, including the company’s Russian logistics arm Damco.

The virus also reached servers for the Russian oil company Rosneft, although it’s unclear how much damage was incurred. There have also been several recorded cases in the United States, including the pharmaceutical company Merck, a Pittsburgh-area hospital, and the US offices of law firm DLA Piper.

The attacks have been indiscriminate across every vulnerable vertical as institution after institution falls short against the unique threat posed by NotPetya.

Why Africans should be concerned about the current global ransomware trend

The current global ransomware trend, of utilising the EternalBlue Exploit in order to take advantage of the vast use of the Windows Operating System should send chills down the spines of any executive worth his salt in the African Digital Market for the following reasons.

Firstly, more than 80% of enterprise servers and endpoints in the African Digital Economy run on the Windows Operating System, thus exposing majority of our organisations to the next-generational strains of ransomware being designed by savvy malware authors. Moreover, a significant percentage of these Windows systems are run on legacy platforms such as XP and Windows Vista which exponentially increase the probability that these systems are probably unpatched.

Secondly, there is an astounding number of citizens who are unaware of the cybersecurity risks present within their daily lives. Kenya, serves as a key example to the plight of the African digital economy. With an 85.3% internet penetration rate, Kenya boasts a wealth of 37.7m netizens, actively contributing to their digital ecosystem.

Moreover, due to the proliferation of mobile banking, internet banking continues to rise within the region. However, contrary to logical perception, about 90% of Kenya’s netizens remain unaware of the increased cyber risks within their digital market. This poses a unique and advanced risk as ransomware’s primary source of entry is through A

In conclusion, new strains of ransomware seem to tactically replicate across networks utilising unpatched Windows systems and untrained company personnel through phishing e-mails to wreak havoc across targeted networks. The African Digital Economy is especially vulnerable to these risks as they exploit our unique weaknesses.

Our recommendations:

  1. Invest in new-school cybersecurity awareness training.
  2. Deploy reputable endpoint protection.
  3. Strengthen your business continuity capabilities.
  4. Evaluate and Patch Installed Software.
  5. Monitor access rights.