Top

Mobile ransomware now targeting your smart TVs: report

This also appears to be the case when Trend Micro came across an Android mobile lock-screen ransomware, known as FLocker'.

As per the recent update from Trend Micro, using multiple devices on one platform makes it much easier for people to manage but can be equally dangerous if a malware preys on any one of the devices, as it will affect the other devices too.

This also appears to be the case when Trend Micro came across an Android mobile lock-screen ransomware, known as ‘FLocker’, which is capable of locking smart TVs as well.

Ever since FLocker (detected as ANDROIDOS_FLOCKER.A and short for “Frantic Locker”) first came out in May 2015, over 7,000 variants of the malicious ransomware have been gathered by the company.

According to the report, its author kept rewriting the malware to avoid detection and improve its routine. “Over the past few months, we have seen spikes and drops in the number of iterations released. The latest spike came in mid-April with over 1,200 variants,” said the company.

The latest variant of FLocker is a police Trojan that pretends to be US Cyber Police or another law enforcement agency. It accuses potential victims of crimes they didn’t commit. Then, it demands 200 USD worth of iTunes gift cards. And based on our analysis, there are no major differences between a FLocker variant that can infect a mobile device and one that affects smart TVs. Below are our analysis of FLocker’s routines.

To avoid static analysis, FLocker hides its code in raw data files inside the “assets” folder. The file it creates is named “form.html” and looks like a normal file. By doing so, the code of “classes.dex” becomes quite simple and no malicious behavior could be found there. Thus the malware has the chance to escape from static code analysis. When the malware runs, it decrypts “form.html” and executes the malicious code.

When launched for the first time, FLocker checks whether the device is located in the following Eastern European counties: Kazakhstan, Azerbaijan, Bulgaria, Georgia, Hungary, Ukraine, Russia, Armenia and Belarus. If the device detects that it is located in any of these locations, it deactivates itself.

If FLocker reaches a compatible target, it waits for 30 minutes after infecting the unit before it runs the routine. After the short waiting period, it starts the background service which requests device admin privileges immediately. We consider it as a trick to bypass dynamic sandbox. If the user denies this request, it will freeze the screen faking a system update.

FLocker runs in the background and connects to a command and control (C&C). The C&C then delivers a new payload misspelled.apk and the “ransom” HTML file with a JavaScript (JS) interface enabled. This HTML page has the ability to initiate the APK installation,take photos of the affected user using the JS interface, and display the photos taken in the ransom page.

The ransom webpage fits the screen, regardless if it infected a mobile device or a smart TV.

While the screen is locked, the C&C server collects data such as device information, phone number, contacts, real time location, and other information. These data are encrypted with a hardcoded AES key and encoded in base64.

Ransomware usually reach users via spam SMS or malicious links. This is why users should be wary when browsing the internet or when receiving messages or email from unknown sources.

( Source : Deccan Chronicle. )
Next Story