2013-04-04
Abstract
Ransomware goes to extra lengths to convince victims to hand over their cash.
Copyright © 2013 Virus Bulletin
The German Federal Police (Bundeskriminalamt, or BKA) warned last month about a piece of ransomware that uses its logo and claims to have suspended use of the victim’s computer on grounds of unauthorized network activity, including the viewing of child pornography. To make its claim seem more credible, the malware displays four images of child pornography (which it alludes to having found on the machine). A fine of 100 euros is demanded (with payment to be made via digital payment service uKash or Paysafecard) in order for an unlocking code to be sent to release the machine. The BKA has been at pains to point out that the message is the result of malware and is not in any way associated with the police – and stresses that under no circumstances should users pay the fine.
Meanwhile, another piece of police ransomware, dubbed ‘Kovter’, goes to even greater lengths to make its scam seem more believable – by using information gathered from the victim’s browser history.
The malware displays a (fake) warning purporting to be from the US Dept of Justice, the US Dept of Homeland Security and the FBI, claiming that the victim’s computer has been used to download and distribute illegal content. The message contains details including the computer’s IP address, its host name, and a website from which the illegal material was allegedly downloaded. The malware checks the victim’s browser history against a list of pornography sites, and if it finds a match it will display the details of the site the user has visited in the message – thus making it seem more credible. (If no match is found, the malware simply includes the details of a random pornography site.)
Ransomware is not a new phenomenon – primitive, floppy‑disk‑based ransomware appeared as early as 1989 – but with the perpetrators constantly refining their attack mechanisms, both technically and in social engineering terms, many experts have asserted that it will be one of the top security concerns for 2013.
