What’s worse than ransomware? Ransomware that installs without any kind of user interaction. It’s a malware-maker’s holy grail — the ability to bypass users entirely and gain access to device functions, files and settings.
According to SecurityWeek, a new Android ransomware named Dogspectus does just that: Blue Coat Labs researcher Andrew Brandt has declared this the first time an infection without interaction has been successful. Here’s the rundown.
No Permission Needed
The new ransomware attack, detected by Blue Coat and confirmed by Zimperium analyst Joshua Drake, was automatically downloaded onto a test device running the Cyanogenmod 10 of Android 4.2.2 when researchers visited a Web page with malicious advertisements. The malvertisements contained JavaScript code carrying an exploit that was leaked in the Hacking Team breach; the payload included code from the 2014 futex/Towelroot exploit.
Once executed, the Android ransomware prevented the device from displaying an application permissions dialog box and then installed malware that labeled itself “Cyber.Police.” The infection then locks the device, prevents any other apps from launching and sets itself to boot first. Users get a notification from the “American national security agency” or “Nation security agency” informing them that a ransom of two $100 Apple iTunes gift cards must be paid to regain device access.
It’s worth noting that Android 4.2.2 isn’t the only vulnerable version; security experts found at least 224 models running everything from Android 4.0.3 to 4.4.4 were vulnerable. There is some good news here, however: The malware doesn’t actually encrypt files, meaning it may be possible to recover them by connecting the device to a computer and accessing both internal memory and attached storage. And while OS flashing won’t remove the infection, a factory reset will do the trick.
Android Ransomware Makes Big Money
Ransomware has become its own slice of cybercriminal industry. As noted by ZDNet, cybercriminals are now targeting sites with massive user volumes like The Pirate Bay to spread their infections as far afield as possible, while Business Insider warns that ransomware targets will shift as interconnected IoT devices — many with less-than-stellar security — become the norm.
Since many of these devices don’t require user approval for updates or even to carry out specific functions, it makes sense that attacks like the no-touch Android ransomware are just the beginning. Why try to trick users into downloading malicious content when it’s possible to bypass their approval altogether?
There’s big money in ransomware, and the growing number of connected devices makes this a growth market for any interested cybercriminal. Users looking to stay safe need to start thinking outside the email inbox; untrusted websites could now act as infection vectors for mobile attacks that don’t require a yes or no answer.