STE WILLIAMS

The LeakedSource data breach aggregator and look-up service has gone offline, possibly due to a police raid.

The site, which allowed visitors to look up account details that had been collected from multiple data breaches, has gone dark and its associated social media accounts have been suspended.

While no official word was given, a Pastebin post – lifted from this forum thread – made shortly after the takedown claims the site has been raided and all of its hosted data has been seized by law enforcement agencies.

“Leakedsource is down forever and won’t be coming back. Owner raided early this morning. Wasn’t arrested, but all SSD’s got taken, and Leakedsource servers got subpoena’d and placed under federal investigation,” the post claims.

“If somehow he recovers from this and launches LS again, then I’ll be wrong. But I am not wrong.”

LeakedSource did not hack sites directly, but rather found and uploaded to its database account credentials that had been dumped by others on dark web forums and site. The site brought to light a number of claimed account leaks, including those at Twitter, Dota2, and Weebly.

The service had been criticized for its policy of letting anyone look up hacked account credentials, rather than discreetly notifying account owners. ®

Sponsored:
DevOps and continuous delivery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/27/leakedsource_goes_dark/

Researchers say a piece of ransomware disguised as a battery app made its way into the Play store.

Check Point says one of its customers contracted the malware app, dubbed “Charger,” after installing what they thought was a battery monitoring tool called EnergyRescue.

Researchers with Check Point Mobile Threat Prevention say the malware activates when EnergyRescue runs, and requires admin access to the device.

Once that permission is granted, the malware checks for location (it does not attack phones in the Ukraine, Belarus, or Russia), then swipes all user contacts and SMS messages and locks down the device.

From there, the user is told that they must pay to deactivate the ransomware or they will have their full details spaffed out for various nefarious activities, including bank fraud and spam.

“You need to pay for us, otherwise we will sell portion of your personal information on black market every 30 minutes,” the ransomware tells users.

Not ones to be unprofessional, the Charger operators attempt to reassure their victims by offering a “100% guarantee” that once the 0.2 Bitcoin ransom (currently around $183) is paid, all the collected information will be deleted and the device unlocked.

“The ransom demand for 0.2 Bitcoins is a much higher ransom demand than has been seen in mobile ransomware so far,” note Check Point mobile security analysts Oren Koriat and Andrey Polkovnichenko. “By comparison, the DataLust ransomware demanded merely $15.”

Check Point says that thus far it has not spotted any payments being registered to the Bitcoin address used for the ransom collection, so it is unclear how much, if anything, has been made from this operation. The security house says it has already reported the incident to Google and had the infected app taken down.

“We appreciate Checkpoint’s efforts to raise awareness about this issue,” a Google spokesbod told El Reg. “We’ve taken the appropriate actions in Play, and will continue to work closely with the research community to help keep Android users safe.”

It is unclear exactly how the malware got into the Play Store. In the past, Android malware devs have managed to slip past Google’s checks by wrapping themselves within the install packages of otherwise legitimate apps, such as games or utilities.

Earlier this week, Check Point also spotted a software nasty dubbed HummingWhale in apps available via Google Play. ®

Sponsored:
Customer Identity and Access Management

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/26/ransomware_infiltrates_google_mobe_market/

Analysis US President Donald Trump may have undermined a critical data sharing agreement between the United States and Europe that internet giants rely on to do business overseas.

In an executive order focused on illegal immigrants that was signed by the president this week, one section specifically noted that privacy protections would not be extended past US citizens or permanent residents in America.

Section 14 of the Enhancing Public Safety order reads:

Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.

That language appears to directly contradict a critical component of the new Privacy Shield agreement between the US and Europe that provides essential legal protections for US businesses sending and receiving data across the Atlantic. In short, the agreement is supposed to ensure non-Americans are not treated as second-class citizens by US organizations, with weaker privacy safeguards than Americans are afforded.

The Privacy Shield was developed and approved in record time last year after the previous Safe Harbor arrangement was deemed illegal by Europe’s top court back in October 2015. It has only been in place for six months, it is still on probation as far as Europe’s data protection authorities are concerned, and it is almost certain to be challenged in the courts.

The language in the executive order leads to immediate concerns in Europe, with the European Parliament’s rapporteur on data protection, Jan Philipp Albrecht, tweeting: “If this is true @EU_Commission has to immediately suspend #PrivacyShield sanction the US for breaking EU-US umbrella agreement.”

Clarity?

A few hours later, a frantic European Commission put out a statement in an effort to calm the waters. “We are aware of the executive order on public safety,” noted the statement. “The US Privacy Act has never offered data protection rights to Europeans.”

It then goes on to flag two pieces of new legislation that it believes made the new Privacy Shield legal under European law: “The Commission negotiated two additional instruments to ensure that EU citizens’ data is duly protected when transferred to the US:

• The EU-US Privacy Shield, which does not rely on the protections under the US Privacy Act.
• The EU-US Umbrella Agreement, which enters into force on 1 February. To finalise this agreement the US Congress adopted a new law last year, the US Judicial Redress Act, which extends the benefits of the US Privacy Act to Europeans and gives them access to US courts.”

In addition to the Judicial Redress Act – which was signed into law by President Obama late last year – privacy experts have also spotted a notice that was signed by the outgoing Attorney General just three days before Donald Trump became president and only appeared in the Federal Register three days after the inauguration.

That notice lists 26 countries – in addition to the European Union as a whole – as being “covered countries” that benefit from the “extension of certain Privacy Act remedies.” That decision is due to become law on February 1 – the same day as the new US-EU Data Protection and Privacy Agreement.

The combination of the EU’s official statement and the discovery of the Justice Department note has led privacy experts to focus on the critical sub-clause in Trump’s executive order: that “agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons…” (our emphasis).

In theory, therefore – with the Judicial Redress Act law, the attorney general’s designations due to become law in less than a week, and the executive order including a clear carve-out for existing law – the situation should be that the Privacy Shield agreement holds. The executive order would then only apply to countries outside the European Union – although Canada and Mexico are notably absent, which may have its own political repercussions.

But the Trump Administration has been nothing if not erratic and has repeatedly shown it is willing to tear up existing agreements and protocols. Many are wondering why Trump’s team felt the need to include the section at all, especially given the fact that it serves no real purpose. As a result, the European Union’s statement concludes with some significant degree of uncertainty:

“We will continue to monitor the implementation of both instruments and are following closely any changes in the US that might have an effect on Europeans’ data protection rights,” it ends.

Ironies

It is with some degree of irony that Facebook – which was at the center of the legal case that resulted in the previous Safe Harbor agreement being found illegal – chose today to release its new “Privacy Basics” approach to data privacy, and two-factor authentication for security.

“Today we’re introducing a new Privacy Basics to make it easier for people to find tools for controlling their information on Facebook,” the company boasted. Facebook has long been criticized for its opaque and confusing policies over what level of control it grants users of the service.

While the company claims to have simplified things (again), it is notable that there are no fewer than 32 “interactive guides” to help Facebook users figure out how the company is trying to sell people’s data as much as possible while giving them the sense that their data is not being abused.

And in a second irony, in two days – January 28 – it will be the official annual Data Protection Day in Europe. President Trump has certainly given privacy advocates, government officials, and just about every major online corporation something to discuss. ®

Sponsored:
Customer Identity and Access Management

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/26/trump_blows_up_transatlantic_privacy_shield/

St. Louis Public Library system becomes latest example of growing number refusing to do so

The St. Louis Public Library (SLPL) system has become the latest to recover from a ransomware attack without paying a dime in ransom money, even as a new survey shows that organizations overall continue to be more inclined to pay up than not in a similar situation.

SLPL last Friday was hit with a ransomware attack that disrupted access to some 700 checkout systems and computers used by patrons across all 17 of its libraries.

Instead of trying to negotiate with the attackers, who wanted $35,000 in ransom, library officials immediately contacted the FBI and began work on restoring service using backup systems.

As of Thursday morning, the library has restored circulation service at all of its locations and patrons once again have full access to all reservable computers and printers across the library system, says Jen Hatton, PR manager for SLPL. 

Administrators are still working on restoring access to systems used by staff across the 17 libraries. Meanwhile, all libraries remain open, as does access to SLPL’s various databases, she adds.

Hatton did not provide details on the attack itself, citing the ongoing FBI investigation.

In a statement earlier this week, the executive director of SLPL, Waller McGuire, described the attack as very troubling. “An attempt to hold information and access to the world for ransom is deeply frightening and offensive to any public library,” he noted while reiterating his commitment to keep the library’s digital resources open and available to everyone.

For the moment at least, the number of organizations willing to pay a ransom to get their data back continues to outnumber those, like SLPL, who say they won’t.

For instance, 53% of the respondents in a recent survey of 618 individuals in small- and medium-sized organizations that the Ponemon Institute conducted on behalf of Carbonite Inc. said they would be willing to pay a ransom to get their data back.

The remaining 47% said they would never pay a ransom even if it meant losing their data. About 48% said their company had already paid a ransom that averaged $2,500 to get the decryption key to their locked data.

In a similar IBM survey late last year, 60% of over 1,000 professionals from small, medium and large organizations indicated they would be willing to pay a ransom if it meant getting their data back while 70% confessed to having paid between $10,000 and $40,000 to do so.

The slowly shifting attitudes towards ransom payments come amid signs that many companies—especially SMBs—still remain largely conflicted on how to deal with the ransomware threat.

Despite the huge increase in ransomware attacks in recent months for instance, the new Ponemon/Carbonite survey shows that 57% of SMBs continue to labor under the belief they are immune from the threat because of their size.

“We found that many small companies believe they’re too small to be a target,” says Norman Guadagno, senior vice president and chief evangelist at Carbonite. “This mentality makes you a target since you’re not appropriately preparing for such attacks,” he says.

Because they believed they were less of a target, a bare 46% in the survey rated ransomware prevention as a high priority for their organization. “Our research showed that 66 percent of businesses rate the threat of ransomware as very serious, however only 13 percent said their company’s preparedness to prevent ransomware is ‘high,’” Guadagno says. “This preparation gap is alarming and something many businesses need to consider,” he says.

SLPL is among a growing number of publicly known ransomware victims in recent months that have refused to give in to extortion demands from attackers. One example is the San Francisco Municipal Transit Agency (SFMTA), which last November chose to hand out free rides to thousands of commuters over a weekend while systems were restored, rather than pay the demanded $73,000 ransom.

E-Sports Entertainment Association League (ESEA) is another example. Earlier this month, data, including emails and phone numbers, on a reported 1.5 million ESEA users was leaked online after the company refused to pay a ransom of $100,000 to the attackers who had stolen it. “We do not give into extortion and ransom demands and we take the security of customers’ data very seriously,” ESEA had noted at the time.

Related stories:

• San Francisco Transit Agency Earns Praise For Denying Ransom Request
• FBI Official Explains What To Do In A Ransomware Attack

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/most-companies-still-willing-to-pay-ransom-to-recover-data-survey-shows/d/d-id/1327990?_mc=RSS_DR_EDT

Raspberry Pi, the inexpensive hobbyist computer beloved of makers and geeks, is gaining in brain power – Google is adding artificial intelligence (AI) to the platform.

It’s going to be achieved through the release of smart tools. If you want to influence the sort of tools Google ends up offering, you can fill in a questionnaire on the Raspberry Pi Foundation’s website. The Raspberry Pi Foundation says:

[Google’s] survey mentions face- and emotion-recognition and speech-to-text translation, to natural language processing and sentiment analysis, the firm has developed a lot of technology in the fields of machine learning and AI. The tech giant also provides powerful technology for navigation, bots, and predictive analytics.

In other words Google seems to think the community would be up for a bit of AI and it appears to admit it has no idea what it will do with it. So you have to ask: what’s in it for Google?

Senior AI consultant Andrew Burgess sees the move as a pitch to people early in their computing careers:

I believe it is a tactic to spread the use of their open-source TensorFlow platform to as many people as possible so that it becomes the de facto choice for anyone who wants to develop AI apps. AI is already being democratised by the availability of open source algorithms through companies like Google, Facebook and Amazon, with each platform will offering different approaches to create AI apps.

The “secret sauce” in AI though isn’t the software, it’s the data, which is where Google excels. More people using their AI platform means more data being consumed and created through it, which can only strengthen their position further. This is a canny move by Google.

He adds that it’s possible to put Amazon’s Alexa on to a Raspberry Pi (although this isn’t officially sanctioned), although the actual processing is actually done in the cloud, leaving the hardware as a gateway rather than an intelligent device in its own right.

There’s a good chance Burgess is right. The RPi has sold better than initial forecasts and it’s bringing a new generation of computer builders onstream; if you were a software company, wouldn’t you want a piece of that? We can only hope “security” will be among the criteria for any of the AI apps that eventually materialise.

Follow @NakedSecurity
Follow @GuyClapperton

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/TSohpEcpeFM/

Freelance security researcher Dan Melamed has done us all a solid. Last year, he figured out how to remotely delete any publicly posted video on Facebook, without permission or authentication.

Then, he did the right thing: he reported it to Facebook.

Melamed said in a blog post on Monday that he’d discovered the critical vulnerability in June. Besides finding a kill switch for any public video, he also discovered he could disable commenting on any video.

He posted a YouTube video on the exact steps that would have let a malicious actor kill any video:

Facebook fixed the vulnerability in July and awarded Melamed a $10,000 bug bounty.

Melamed had looked at the HTTP request that his browser sends to Facebook when he uploads a video. Using a program called Fiddler, he intercepted the request, swapped out his video’s ID for one belonging to a victim’s video, and then sent the modified request on its way to Facebook.

Melamed’s method is simple: first, an attacker would either create a public event on Facebook or visit any existing public event. Then, they’d go to the event’s Discussion tab and create an event post by uploading a photo or video.

He found that when you swap the value of the composer_unpublished_photo[0] parameter for the ID of the Facebook video you want to kill, the server will balk, putting out this error message:

This content is no longer available.

Error message or no error message, the video will still successfully attach itself to the created event post.

When an attacker refreshes the Events Discussion page, they’d see that the event posting had appeared with the victim’s video attached. Then, it’s just a matter of clicking a small arrow dropdown and choosing “Delete Post”.

A dialog box will warn that the video will also be removed from Photos and Videos. If you confirm in the dialog box that yes, you want to delete the video, Poof! It will be gone within 20 to 30 seconds.

Credit where credit’s due, Melamed noted that this vulnerability is similar to another video deletion bug that Indian security researcher and penetration tester Pranav Hivarekar discovered, also in June 2016.

In a nutshell: whereas Hivarekar’s flaw had to do with attaching a victim’s video to a comment, Melamed discovered a way to attach the video to an event post. Delete the bath water/event post, and that baby/video gets tossed right out with it.

Naked Security’s Mark Stockley wrote up a similar Insecure Direct Object Reference bug: one that also made an appearance in Facebook’s Bug Bounty program. This one had to do with how one man could have deleted any Facebook photo album that he could see.

Mark offers this digression: In Melamed’s attack on videos, he specifies the ID of a video he’s targeting specifically, but since video IDs are just numbers, he could have just guessed one and wiped out a video at random. … Or perhaps a hundred. … Or maybe a thousand. … Or even more.

Would Facebook have noticed if Melamed had gone full Super Villain and tried to delete Every. Single. Video? Would it have stepped in to stop the video carnage before Facebook was utterly drained of moving kittens and puppies?

I suspect the social network would have noticed long before its stash of videos was under any real threat. But even if it hadn’t, there are so many people uploading so many videos to Facebook at such frequency, an attacker would probably need some fairly major infrastructure to even scratch the surface. But, well, that’s cold comfort if it’s your video on the chopping block.

The error that Melamed found is called an Insecure Direct Object Reference (the Object Reference is that parameter, composer_unpublished_photo[0]).

When Facebook received Melamed’s request to delete a video, it should have noticed that the video he was trying to attach didn’t belong to him, and it should have denied the request. It didn’t. As a consequence, he was able to attach a video that belonged to somebody else to a post that did belong to him.

Since it was his post, it was in his power to delete it. But that shouldn’t have been the case. Facebook should have noticed that he was trying to delete a video that didn’t belong to him, and it should have stopped him in his delete-happy tracks.

At any rate, we really need to say…

Thank you, Facebook breakers!

It shouldn’t surprise anybody that Melamed was inspired by an Indian security researcher who’d been poking at Facebook around the same time. It’s worth noting that for whatever reason, bug bounty hunters in India are very, very good at breaking Facebook.

In fact, as Facebook has said, they’re hands-down the world’s leaders at it.

Hackers who find these bugs face a choice between doing something good or doing something bad. Some people try to cause mayhem, some sell their bugs to the bad guys and some work for the greater good. Those that find and responsibly disclose flaws in Facebook, Instagram, Twitter, et al. perform a valuable service and their rewards are bug bounties and kudos.

Speaking of which, thank you, Dan Melamed, from the bottom of our hearts.

Follow @NakedSecurity
Follow @LisaVaas

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/I6GvGzGLWoo/

Your daily round-up of some of the other security stories in the news

Real-life Q is a woman, spy chief reveals

Depending on your age, you’ll either think of Q, the enthusiastic gadget maestro of the James Bond films, as Ben Whishaw (pictured) or Desmond Llewelyn. However, the real-life Q at MI6 is in fact a woman, Sir Alex Younger, the head of MI6, has revealed.

Speaking to the Women in IT awards in London, Younger said that the intelligence service was actively looking to move beyond the inaccurate Bond stereotype of posh and male: “We’ve got to get over and see through the Bond thing.”

Younger particularly appealed for more women to join the service, saying: “If any of you would like to join us … the real-life Q is looking forward to meeting you, and I’m pleased to report that the real-life Q is a woman.”

Trump ‘still using his Android phone’

President Donald Trump is still using an unsecured consumer Android phone, according to a report in the New York Times, despite the protests of his aides. That’s in spite of earlier reports that he had reluctantly turned over his personal phone for a security-approved encrypted cellphone with a new number that few people have.

Meanwhile, despite the issue made of Hillary Clinton’s email servers during the election campaign, it has also emerged that senior administration officials – including Trump’s son-in-law, Jared Kushner; presidential press spokesman Sean Spicer and adviser Kellyanne Conway – were still using private Republican National Committee email accounts for presidential business as late as Wednesday, Newsweek reported.

Although it’s not illegal for administration officials to use non-official email for party work rather than administration work, mixing the two could violate the Hatch Act, legislation dating from 1939 that limits the political activities of federal employees.

Apple set to join industry AI group

Apple is set to join other leading technology companies in the Partnership on AI, an industry consortium that works on establishing best practice with the emerging technology and co-ordinate education and outreach efforts.

Apple was one of the big names missing from the group when it was formed last autumn: the founder members were Google, Facebook, Amazon, IBM and Microsoft. Other big tech industry players that haven’t joined the group include Twitter, Baidu and Elon Musk’s OpenAI research group.

Apple has always been notoriously secretive about what it’s up to, but that started to change last year when it hired Russ Salakhutdinov, a leading AI researcher from Carnegie Mellon, who subsequently published Apple’s first ever public AI paper.

Catch up with all of today’s stories on Naked Security

Follow @NakedSecurity
Follow @katebevan

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/WYWqi2CjEXE/

The long march to obsolescence for the MD5 encryption algorithm might have been delayed a bit, but it’s still inevitable.

Oracle recently announced that any JAR (Java archive) files signed with the MD5 algorithm would instead be treated as unsigned, insecure and therefore blocked by Java as of this week’s massive security update, which included 270 fixes.

But with the update’s release came news of a delay on the ditching of MD5, because it seems some companies still need time to comply with this change — so Oracle has given a new deadline of April 18 2017.

For a long time, MD5 was the go-to hashing algorithm for JAR files, with the hash serving as a fixed-length digital fingerprint for the whole file.

After that date in April, however, developers will need to adopt a new method to sign their work, otherwise, Java will reject their applications altogether.

By running a value (like a URL) or a file through the MD5 algorithm, the function will return a unique 16-byte string, usually represented as a 32-digit hexadecimal number. You might have seen a note with a file’s MD5 hash when downloading executables, often included so you can make your own integrity comparison.

If you run your locally downloaded file through the MD5 checksum and get the same value as provided by the file’s originator, theoretically the two files should be exactly the same.

Unfortunately for MD5, during the mid 1990s, security researchers began uncovering the algorithm’s many exploitable flaws, including vulnerability to brute-force attacks. Of course, standards take some time to change, so MD5’s fall from grace came as a very slow decline. By 2008, CERT and the US Department of Homeland Security declared in no uncertain terms that MD5 “should avoid using the MD5 algorithm in any capacity…it should be considered cryptographically broken and unsuitable for further use”.

With its flaws increasingly apparent, MD5’s use has continued to drop, and organizations have been looking for alternative hashes to replace it. One of MD5’s initial successors was the SHA-1 algorithm, but it too has fallen out of favor in the past few years due to its own many security vulnerabilities. SHA-1 has proven so vulnerable that a number of organizations have dropped or will soon be dropping support for SHA-1 encrypted SSL certificates, including Google, Microsoft, Mozilla, and Apple.

The generally agreed-upon successor for MD5 and SHA-1 is the SHA-2 family of cryptographic hashes, which includes both SHA-512 and SHA-256 algorithms. The SHA-2 family of hashes is considered safer than its predecessors, and major industry leaders and standard-bearers are leading the charge in getting developers and organizations to leave SHA-1 behind. (And yes, there is also SHA-3, approved in 2012 after an extensive public competition and peer-review process.)

Given we’ve known about MD5’s flaws for a while now, Oracle’s delay in dropping support for the hash seems strange. Let’s hope there aren’t too many developers still scrambling for an alternative, though it appears we’ll find out for sure in April 2017.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/vDPTDayccSs/

Facebook is upgrading its login defenses by rolling out support for hardware security keys.

The move means that Facebook addicts can make their logins far more resistant to phishing and account hijackings – and makes the site more secure than banks’ online services that provide just single-factor authentication.

Users can log into Facebook by tapping on a USB key connected to their computer after entering their password. That key is paired with the netizen’s Facebook account and emits a special string to the social network, via the browser, that authorizes the login.

So if a crook learns your password, that information is no good without your physical two-factor authentication key. Facebook offers two-factor authentication via text messages, but this isn’t as reliable or secure as a separate hardware token.

FIDO-compliant Universal 2nd Factor (U2F) keys cost £16.00 ($20) from the likes of Amazon’s marketplace and Yubico. NFC-capable keys can be paired with compatible mobile devices for mobile logins.

The same technology can be used to securely log into other services that support physical security keys for authentication, including Google, Dropbox, GitHub, Salesforce and others.

Press to confirm: hardware security keys for Facebook

Facebook’s blog post on adding security keys to accounts can be found here.

Facebook’s security team has previously estimated that 0.06 per cent of Facebook’s one billion-plus logins per day are compromised. It’s a small percentage, but it adds up to 600,000 dodgy logins per day.

Brad Hill, security engineer at Facebook, said: “We’re excited to offer people the additional option of using a security key to make logging into Facebook even more secure.”

The need for two-factor authentication is growing in part because of the growing prevalence of security breaches. Recent security threats have shown that mobile push apps and SMS-based authentication do not offer enough protection against the latest sophisticated phishing and man-in-the-middle attacks.

Brett McDowell, executive director of the Fast IDentity Online (FIDO) Alliance, added: “By adding FIDO authentication to its security portfolio, Facebook gives their users the option to enable unphishable strong authentication that is no longer vulnerable to social engineering and replay attacks using stolen shared ’secrets’ like passwords and one-time-passcodes.” ®

Sponsored:
DevOps and continuous delivery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/26/facebook_upgrading_login_security/

Researchers say a piece of ransomware disguised as a battery app made its way into the Play store.

Check Point says one of its customers contracted the malware app, dubbed “Charger,” after installing what they thought was a battery monitoring tool called EnergyRescue.

Researchers with Check Point Mobile Threat Prevention say the malware activates when EnergyRescue runs, and requires admin access to the device.

Once that permission is granted, the malware checks for location (it does not attack phones in the Ukraine, Belarus, or Russia), then swipes all user contacts and SMS messages and locks down the device.

From there, the user is told that they must pay to deactivate the ransomware or they will have their full details spaffed out for various nefarious activities, including bank fraud and spam.

“You need to pay for us, otherwise we will sell portion of your personal information on black market every 30 minutes,” the ransomware tells users.

Not ones to be unprofessional, the Charger operators attempt to reassure their victims by offering a “100% guarantee” that once the 0.2 Bitcoin ransom (currently around $183) is paid, all the collected information will be deleted and the device unlocked.

“The ransom demand for 0.2 Bitcoins is a much higher ransom demand than has been seen in mobile ransomware so far,” note Check Point mobile security analysts Oren Koriat and Andrey Polkovnichenko. “By comparison, the DataLust ransomware demanded merely $15.”

Check Point says that thus far it has not spotted any payments being registered to the Bitcoin address used for the ransom collection, so it is unclear how much, if anything, has been made from this operation. The security house says it has already reported the incident to Google and had the infected app taken down.

“We appreciate Checkpoint’s efforts to raise awareness about this issue,” a Google spokesbod told El Reg. “We’ve taken the appropriate actions in Play, and will continue to work closely with the research community to help keep Android users safe.”

It is unclear exactly how the malware got into the Play Store. In the past, Android malware devs have managed to slip past Google’s checks by wrapping themselves within the install packages of otherwise legitimate apps, such as games or utilities. ®

Sponsored:
DevOps and continuous delivery

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/01/26/ransomware_infiltrates_google_mobe_market/