Generally speaking, lockscreen ransomware ranks on the not-so-sophisticated end of the malware spectrum. As noted by Information Age, this type of ransomware can be a mere “nuisance” when confined to a single PC or laptop. When it comes to mobile devices, however, lockscreen attacks can be devastating since users are effectively stonewalled, kept away from contacts, photographs and other digital assets that have become a key part of the bring-your-own-device (BYOD) revolution.

While some variants of lockscreen malware have been relatively easy to reverse engineer, HackRead described a newly updated version of Android.Lockscreen that ups the annoyance factor by making it almost impossible to recover original passcodes. Here’s a look at the new lock on the block.

Lucrative Locks

According to Softpedia, the original version of Android.Lockscreen wasn’t especially complex. Once a device was infected, the malware created a custom PIN code to lock the user out. An on-screen message advised the device owner to call “technical support.” The victim was then compelled to pay for the privilege of having his or her password reset.

Infection vectors were typical — infected third-party apps and malicious links — but the resolution was also straightforward, since the malware source code included the new PIN. This made it possible to extract the code, hand it over to users and avoid paying cybercriminals anything.

Soon enough, however, malware-makers realized their mistake and set about creating a new and improved version of this lockscreen ransomware. The result: pseudorandom number generation and a big headache for Android users.

Pseudorandom PINs

Using the Math.Random() function, attackers were able to design a piece of malware that skipped hard-coded PINs in favor of randomly generated six- or eight-digit numbers to replace existing user passcodes. They’re called pseudorandom because they’re limited in size and therefore occupy a finite set. Still, it’s enough to make the device virtually unlockable since every smartphone or tablet infection generates its own random code.

It doesn’t stop there: The new lockscreen ransomware also uses device admin privileges to modify the user’s existing PIN. It displays a system error screen on every visible user interface, prompting the user to contact the attackers for the new passcode. So far, attempts to deconstruct this attack have been unsuccessful, leaving owners to either wait for a fix or pony up the cash.

Avoiding Lockscreen Ransomware

Thankfully, there are ways to avoid the new lockscreen ransomware. First, get Nougat. The newest Android release prevents calls for PIN or passcode changes from any other apps if the PIN was previously set by the user. While lockscreen larcenists will likely find a way around this protection eventually, for the moment it is a foolproof way to solve the problem.

For users who can’t get Nougat or don’t want the new iteration, staying safe means sticking to reputable app stores, avoiding shady links and, most importantly, paying attention to the permissions requested by a new install. Any app carrying this malware needs permission to lock the screen, change device settings and overlay messages above other applications — a sure sign something isn’t above board.

Lockscreen malware isn’t new and it isn’t always a surefire payday for cybercriminals. The combination of vulnerable mobile devices and pseudorandom number generation, however, makes this ransomware one to watch. For the moment, locked Androids mean lost data and big ransom revenues.