Android porn browsers warned to watch out for Koler.A ransomware
BitDefender claims new malware is the work of gang behind existing Reveton / IcePol network, but it's removable
Pornography users have long been targets for malware, and those using Android devices are no exception, according to a new report from security firm BitDefender.
It claims to have identified a new piece of ransomware – a category of malware that attempts to restrict victims' access to their device and/or files until they pay a ransom – called Android.Trojan.Koler.A.
It infects devices when their owners are browsing certain porn sites. "As the user browses, an application that claims to be a video player used for premium access to pornography downloads automatically," explained BitDefender in a blog post.
The company believes this new malware is the work of the gang behind the Revetol / Icepol trojan, which infected hundreds of thousands of PCs in 2012 and 2013. "It was just a matter of time until the highly prolific gang behind the Reveton / IcePol network made a move on Android," it suggests.
Android.Trojan.Koler.A isn't quite the same as Reveton / IcePol, because it can't install itself on someone's Android device: they have to have enabled sideloading in their settings, then tap an 'Install' button when prompted to install what they think is a video player.
Once installed, it identifies its victim's location and shows them a webpage with a warning in their language: "Attention! Your phone has been blocked up for safety reasons listed below. All the actions performed on this phone are fixed. All your files are encrypted. CONDUCTED AUDIO AND VIDEO".
The page also claims that they have "violated World Declaration on non-proliferation of child pornography" as well as flouting copyright infringement laws, warning of possible jail terms for both. And then it tries to charge a $300 ransom to remove the threat.
"The bad news is that by the time you see the message, the bad guys already have your IMEI on file," said BitDefender's chief security strategist Catalin Cosoi, who also noted that Koler.A doesn't have the necessary permissions to actually encrypt victims' files.
"The good news is that Koler.A can be easily removed by either pressing the home screen and navigating to the app, then dragging it on the top of the screen where the uninstall control is located, or by booting the device in safe mode and then uninstalling the app."
The blunt solution: don't visit porn sites on your Android device that ask you to download a premium video player. But if you do catch this particular strain of malware, don't be taken in by its threats.
BitDefender is concerned that there may be more to come from its developer. "The Android version of Icepol might be a test-run for cyber-criminals to see how well this type of scam can be monetised on mobile platform," said Cosoi.
"If this is the case, we should expect much more sophisticated strains of ransomware, possibly capable of encrypting files, to emerge shortly."
Android.Trojan.Koler.A is not the first example of ransomware on Android though. In June 2013, security firm Symantec discovered Android.Fakedefender, which also threatened to lock up Android devices once infected.
That September, it identified another strain from the same developers, Android.Fakedefender.B, which tried to charge victims $100 to unlock their device.
By Stuart Dredge
Screenshot: BitDefender
Source : The guardian
Android porn browsers warned to watch out for Koler.A ransomware
Click here for more : 👍