Ransomware: Cause for Alarm for Android Phone Users 0 207

  • Lock-screen Ransomware and file-encrypting “crypto-ransomware”, have been causing major financial and data losses for many years, and now it's on the Android platform.
  • In Kenya, ransomware offers a unique and differentiated threat. One out of every ten global mobile money transactions occur in Kenya.
  • Individuals without any protected handsets could be adversely compromised as the human layer of M-PESA’s networking environment is essentially vulnerable.
Ransomware Android Phone

What is Ransomware?

Ransomware is a growing problem for users of mobile devices. Lock-screen types and file-encrypting “crypto-ransomware”, both of which have been causing major financial and data losses for many years, have made their way to the Android platform.

ESET has prepared a topical white paper on the growth of this insidious Android malware.

Like other types of Android malware – SMS trojans, for example – ransomware threats have been evolving over the past few years and malware writers have been adopting many of the same techniques that have proven to be effective in regular desktop malware.

Both on Windows and on Android, lock-screens have prompts to scare the victims into paying up after (falsely) accusing them of harvesting illegal content on their devices.

Likewise, as with the infamous Windows Crypto locker ransomware family, crypto-ransomware on Android started using strong cryptography, which meant that affected users had no practical way of regaining the hijacked files.

Notably, everyday data (such as photos and texts) is at an elevated risk as this data is stored on phones rather than PCs.

The Woes of Wangari

A good hypothetical example would be Wangari, who when downloading Instagram on her handset accidentally downloaded a malicious masked application disguised to look like the official Instagram app.

The payload for that application may have been amended to have lock-screen ransomware which denies Wangari access to her phone’s interface, and consequently her M-Pesa account.

How much do you think Wangari would pay the hijackers to access her M-Pesa account?

In Kenya, ransomware offers a unique and differentiated threat. One out of every ten global mobile money transactions occur in Kenya. Essentially, a successful ransomware attack in Kenya could lead to a user being deprived access to their mobile money accounts.

Although the M-PESA system has been deemed robust, individuals without any protected handsets could be adversely compromised as the human layer of M-PESA’s networking environment is essentially vulnerable.

Types of Android Ransomware

According to Robert Lipovsky and Lukas Stefanko from ESET Research, ransomware, as the name suggests, is any type of malware that demands a sum of money from the infected user while promising to “release” a hijacked resource in exchange.

There exist two broad categories of malware that can be termed as ransomware.

  1. Lock-screen ransomware
  2. Crypto-ransomware

The difference of these types of ransomware is that: in lock-screen types of ransomware, the hijacked resource is access to the compromised system while in file-encrypting “crypto-ransomware” that hijacked resource is the user’s files.

Since ransomware first reared its ugly head when the Windows Operating System was widely adopted, it was only logical that the malware writers would similarly adopt ransomware to compromise mobile phones as they are ubiquitous in the modern day.

With consumers switching more and more from PCs to mobile, more and more valuable data are being stored on these devices that devices, which leads to the fact that more and more valuable data is being stored on those devices that all of us carry around, Android ransomware is becoming ever more worthwhile for attackers.

How to Keep Safe

1. Avoiding Unofficial App Stores:

Among the most important active measures to take are avoiding unofficial app stores and having a mobile security app installed and kept up to date.

2. Back up your Data:

In the event of a successful ransomware attack, having a back-up for all your important data enables you to retrieve vital information, such as sentimental photos and vital business information. Having a backup turns such an experience into nothing more than a nuisance.

According to ESET Research, there exist several options for removal if one is successfully infected.

3. Invest in Mobile Security:

Mobile Security includes malware protection, which can protect users from ransomware through scanning infected applications and quarantining them prior to infection of the given device.

We obviously recommend ESET Mobile Security, available at https://www.eset.com/afr/

What to do when infected

1. Boot the device into Safe Mode:

For most simple lock-screen ransomware families, booting the device into Safe Mode – so third-party applications (including the malware) will not load – will do the trick and the user can easily uninstall the malicious application.

The steps for booting into Safe Mode can vary on different device models. (Consult your manual, or ask Google – the search engine.) If the application has been granted Device Administrator privileges, these must first be revoked from the settings menu before the app can be uninstalled.

2. Use an MDM solution:

If ransomware with Device Administrator rights has locked the device using Android’s built-in PIN or password screen lock functionality, the situation gets more complicated. It should be possible to reset the lock using Google’s Android Device Manager or an alternate MDM solution.

Rooted Android phones have even more options. A factory reset, which will delete all data on the device, can be used as the last resort in case no MDM solutions are available.

3.      Contact your Security Provider’s Technical Support:

If files on the device have been encrypted by crypto-ransomware such as Android/Simplocker, we advise users to contact their security provider’s technical support. Depending on the specific ransomware variant, decrypting the files may or may not be possible.

Conclusion

In the event of a ransomware attack, never pay cybercriminals. In certain cases, ESET researchers have discussed ransomware devoid of the code necessary to decrypt malware upon payment. This essentially means that paying cybercriminals does not mean decryption of your data.

Kenyans need to be made aware of the looming ransomware threat which could significantly impact their access to essential mobile services such as M-Pesa. The largest mobile digital economy has a target on its back. We need to remain vigilant.

Previous ArticleNext Article

Why Africans should be worried about PETYA 0 296

  • The malicious software has been identified as a modified version of a previously known ransomware, called Petya or Petrwrap, that has been substantially altered.
  • Due to its unique characteristics, it has been dubbed as NotPetya and ExPetya, which is currently detected by ESET as Win32/Diskcoder.C Trojan.
  • NotPetya can be termed as a worm, which can self-replicate across multiple networks. Petya uses two primary methods to spread across networks. Execution across network shares and SMB exploits
  • The current global ransomware trend utilises the EternalBlue Exploit in order to take advantage of the vast use of the Windows Operating System.
  • More than 80% of enterprise servers and endpoints in the African Digital Economy run on the Windows Operating System.
africans-worried-petya

It all begins with the MS17-010 Exploit

The EternalBlue Exploit, otherwise known as MS17-010, developed by the NSA and pilfered by the Shadow Brokers continues to open opportunities for malicious malware authors as fresh ransomware attacks continue to ravage Europe while spreading through the globe at an alarming pace.

Notably, it has become evident that in the realm of cybersecurity, the adage of once bitten, twice shy, seldom applies as unpatched computer systems have been utilised for a second time by cybercriminals to achieve exponential infection rates, reminiscent of the WannaCry nightmare that the globe experienced only two months ago.

NotPetya

The malicious software has been identified as a modified version of a previously known ransomware, called Petya or Petrwrap, that has been substantially altered, prompting a debate among researchers over whether it is new malware.

Due to its unique characteristics, it has been dubbed as NotPetya and ExPetya, which is currently detected by ESET as Win32/Diskcoder.C Trojan. If it successfully infects the MBR (Master Boot Record), it will encrypt the whole drive itself. Otherwise, it encrypts all files, like Mischa.

How does NotPetya replicate?

In many ways, NotPetya can be termed as a worm, which can self-replicate across multiple networks. Petya uses two primary methods to spread across networks. These include:

  • Execution across network shares: It attempts to spread to the target computers by copying itself to [COMPUTER NAME]\\admin$ using the acquired credentials. It is then executed remotely using either PsExec or the Windows Management Instrumentation Command-line (WMIC) tool. Both are legitimate tools.
  • SMB exploits: It attempts to spread using variations of the EternalBlue and EternalRomance exploits.

Crucially, NotPetya seeks to gain administrator access on a machine and then leverages that power to commandeer other computers on the network: it takes advantage of the fact that far too many organizations employ flat networks in which an administrator on one endpoint can control other machines, or sniff domain admin credentials present in memory, until total control over the Windows network is achieved. It achieves primary access through using phishing techniques to trick administrators into running the malware with high privileges.

What institutions have been adversely affected?

africans-worried-petya

The most severe damage is being reported by Ukrainian businesses, with systems compromised at Ukraine’s central bank, state telecom, municipal metro, and Kiev’s Boryspil Airport. Systems were also compromised at Ukraine’s Ukrenego electricity supplier, although a spokesperson said the power supply was unaffected by the attack. The attack has even affected operations at the Chernobyl nuclear power plant, which has switched to manual radiation monitoring as a result of the attack.

Infections have also been reported in more isolated devices like point-of-sale terminals and ATMs. The virus has also spread internationally. The Danish shipping company Maersk has also reported systems down across multiple sites, including the company’s Russian logistics arm Damco.

The virus also reached servers for the Russian oil company Rosneft, although it’s unclear how much damage was incurred. There have also been several recorded cases in the United States, including the pharmaceutical company Merck, a Pittsburgh-area hospital, and the US offices of law firm DLA Piper.

The attacks have been indiscriminate across every vulnerable vertical as institution after institution falls short against the unique threat posed by NotPetya.

Why Africans should be concerned about the current global ransomware trend

The current global ransomware trend, of utilising the EternalBlue Exploit in order to take advantage of the vast use of the Windows Operating System should send chills down the spines of any executive worth his salt in the African Digital Market for the following reasons.

Firstly, more than 80% of enterprise servers and endpoints in the African Digital Economy run on the Windows Operating System, thus exposing majority of our organisations to the next-generational strains of ransomware being designed by savvy malware authors. Moreover, a significant percentage of these Windows systems are run on legacy platforms such as XP and Windows Vista which exponentially increase the probability that these systems are probably unpatched.

Secondly, there is an astounding number of citizens who are unaware of the cybersecurity risks present within their daily lives. Kenya, serves as a key example to the plight of the African digital economy. With an 85.3% internet penetration rate, Kenya boasts a wealth of 37.7m netizens, actively contributing to their digital ecosystem.

Moreover, due to the proliferation of mobile banking, internet banking continues to rise within the region. However, contrary to logical perception, about 90% of Kenya’s netizens remain unaware of the increased cyber risks within their digital market. This poses a unique and advanced risk as ransomware’s primary source of entry is through A

In conclusion, new strains of ransomware seem to tactically replicate across networks utilising unpatched Windows systems and untrained company personnel through phishing e-mails to wreak havoc across targeted networks. The African Digital Economy is especially vulnerable to these risks as they exploit our unique weaknesses.

Our recommendations:

  1. Invest in new-school cybersecurity awareness training.
  2. Deploy reputable endpoint protection.
  3. Strengthen your business continuity capabilities.
  4. Evaluate and Patch Installed Software.
  5. Monitor access rights.

The role of Kenyan Legal Professionals in Cybersecurity 0 458

  • Over 26.7 million Kenyans are currently online and engaging in digital transactions daily.
  • According to UN Research, at least one out of ten mobile money transactions in the World occur in Kenya.
  • These statistics make Kenya a prime target for cybercriminals who, according to the National Cybersecurity Strategy, published by the Ministry of ICT, have continued to evolve in terms of the complexity and severity of their attacks.
  • Unfortunately, Kenya shows a staggering lack of awareness and investment in cybersecurity solutions wit around 96% of all organisations investing less than $5000 in cybersecurity.
Kenya cybercriminal activity

According to the words of the Honorable Warren E. Burger, lawyers and judges remain necessary to society, so long as it is a place where men and women are gathered, as they must fulfil the noble role of healing conflict and providing reason as a lubricant to the rigours of the socio-economic engine which ought to drive the development of any civilisation.

Moreover, it is the role of the legal minds of society to act as sentinels, standing guard against man’s threat unto himself, his own inclination towards self-enrichment at the detriment of the common good in its entirety.

As such, society gives the highest of legal minds the power to influence, pass or ratify policies, to ensure their safety and continuity against the overwhelming urges of vices, human wickedness and in certain cases, natural catastrophes.

The legal minds of Kenya can thus be termed as, not only stewards of conflict resolution,but also as sentinels, who wield the power of policy-making to safeguard the development and evolution of the socio-economic organs of the nation-state whose well-being remains pivotal to Her survival.

Kenya is facing an exponential increase in cybercriminal activity

The digital wave has hit Kenya, and its effect upon our economy has been immensely positive. With the development of innovative products such as Safaricom’s M-Pesa money transfer service, as well as iCow, a farming digital product that has optimized dairy farmers’ productivity, the consumer market has developed an appetite for sound, data-centric solutions in order to enhance the various socio-economic activities present within Kenya.

The effect of digitisation in our economy has been significant. Since the advent of M-PESA, more than 73.1% of Kenyans are now formally banked.

In addition, according to the Quarterly Statistics Report for the Financial Year of 2016 (April-June 2016), mobile data/ internet subscriptions stood at 26.7 million during the quarter marking an increase of 8.3 per cent from 24.7 million subscriptions posted in the preceding quarter. The number has grown remarkably by 35.0 per cent from the same period of the previous year.

This essentially means that over 26.7 million Kenyans are currently online and engaging in digital transactions daily.

Kenya also boasts the largest mobile money transaction service in the World. According to UN Research, at least one out of ten mobile money transactions in the World occur in Kenya.

These statistics make Kenya a prime target for cybercriminals who, according to the National Cybersecurity Strategy, published by the Ministry of ICT, have continued to evolve in terms of the complexity and severity of their attacks.

The evolution of cyber threats between 2006 and 2012 are an iconic example. These threats include; Advanced Persistent Threats, Botnet Threats, Converged Threats, Cyberterrorism and Next Generation DoS (inclusive of DDoS).

The socio-economic impact of cybercrime in Kenya has been immense. According to a Serianu Cybersecurity Report, Kenya’s losses as at 2016, stood at a whopping $185m, a sharp increase from the estimated $100m lost in the previous year.

Notably, when cybercriminals face justice, only about 2% of prosecutions are successful. This can be attributed to the lack of proper regulation regarding data protection and cybersecurity, and the lack of appropriate measures to collect sufficient evidence to enable criminal prosecution.

The Legal Profession and the unique risks posed to them by cybercriminals

 

Kenya cybercriminal activity

Numerous professions in Kenya are facing digitisation as well. The legal industry has not been an exception. With the incorporation of modern filing systems, the use of e-mails and digital devices such as mobile handsets and laptops within law firms and legal offices, sensitive client data is being transacted and stored at a digital level across various platforms in various forms. Cybercriminals are aware of this and can exploit the gaps present in various ways.

A staggering lack of awareness and investment in cybersecurity solutions

Notably, around 96% of all organisations in Kenya invest less than $5000 in cybersecurity. A significant percentage of these sampled organisations consist of law firms, financial institutions, NGOs and governmental bodies where legal and compliance advisors safeguard the agenda of their respective institutions.

Around 96% of all organisations in Kenya invest less than $5000 in cybersecurity Click to Tweet

This highlights how low a priority cybersecurity is for institutions who are the custodians of sensitive data which can be compromised for profit by cybercriminals.

Man-in-the Middle Attacks

Legal practitioners often handle particularly sensitive internal or external, i.e. client information to carry out their mandate. An ideal example would be where numerous clients correspond with their hired advocates via e-mail, transacting confidential documents and data over the Internet with the faith that those communication channels are encrypted or secure. This makes law firms particularly prime for man-in-the-middle attacks.

A man-in-the-middle occurs where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.

An example would be where files were intercepted over the network, and redirected to hostile parties, who then changed the details of those files and dropped them back into the firm’s filing system.

The entire scam could go on for months, until all the data is collected and collated by the criminals, and subsequently utilised in a terrible heist of client funds.

Various rights of the client had been substantially breached, such as their constitutional right to privacy and, if the law firm had no cybersecurity measures in place, a valid claim under the tort of negligence, as the advocate in question had failed to fulfil an essential duty of care in protecting the client’s information.

The loss of a client’s data integrity

The loss of a client’s data integrity remains one of the largest risks for any legal enterprise. This is due to its resultant effect which is a substantial erosion of trust and an adverse breach of the client confidentiality relationship which is part and parcel of the legal profession.

Data leaks can lead to truly disastrous results for any legal practice once their clients’ data is made public by hackers, regardless of their motivation. A prime example could be the occurrence of the Panama Papers leak in 2015.

The Panama Papers are 11.5 million leaked documents that detail financial and attorney–client information for more than 214,488 offshore entities. The documents, which belonged to the Panamanian law firm and corporate service provider Mossack Fonseca, were leaked in 2015 by an anonymous source, some dating back to the 1970s.

The leaked documents contain personal financial information about wealthy individuals and public officials that had previously been kept private.

While offshore business entities are legal, reporters found that some of the Mossack Fonseca shell corporations were used for illegal purposes, including fraud, tax evasion, and evading international sanctions.

The damage to the reputation of the legal enterprise was immeasurable and to date, their clients’ data remains available for scrutiny for members of the Press and the public.

Ransomware

Cybercriminals are also targeting legal enterprises because of the urgency of the data required. Law firms require constant updates of their: research material regarding continuing court cases, recordings of proceedings, updated legal documents and documentary evidence.

Moreover, legal enterprises must be able to quickly retrieve, edit, update and restore their work files within those particular systems. This makes them prime targets for malicious attacks which lock users out of their various digital filing and retrieval systems.

A prime example of this would be the deployment of ransomware within a law firm’s IT environment. Ransomware, as the name suggests, demands the payment of ransom in Bitcoin, upon encryption of computer files within a system.

Other variations of ransomware, known as lock-screen ransomware lock out users from accessing the computer system and demand payment in Bitcoin to unlock and gain access.

Conclusion

A joint awareness campaign

In collaboration with numerous law firms in Kenya, ESET East Africa is engaging with certain legal practitioners based in Kenya’s digital market to raise awareness regarding the numerous risks present for their enterprises as well as the nation with the advent and growth of cybercrime within Kenya.

This will be done through joint events, programs and training sessions to sensitize legal enterprises about their issues.

Policy recommendations

As a driver of thought leadership across the globe, the ESET brand is honoured to collaborate with the lawyers and cybersecurity specialists in suggesting cybersecurity policies designed to safeguard the Kenyan populace from the evolved threat of cybercrime within Kenya.