Live
- IPO-bound Senores Pharma, Dr. Reddy's Labs launch ivermectin tablets in US
- PAN 2.0: What is PAN 2.0, Benefits, Impact on Business and How to Apply
- Air India optimises key domestic metro routes post Vistara merger
- Mid-Day Meal Scare in Telangana: 30 Students Hospitalized
- UN chief welcomes Israel-Lebanon ceasefire agreement
- Fishermen stranded in sea rescued by officials at Krishnapatnam Port
- iOS 18.2 brings ChatGPT and Image Playground: Apple's next AI-powered leap
- India, UK need to collaborate in AI, tele-medicine, agri tech: Piyush Goyal
- Unidentified Vehicle Rams VH’s Car in Hyderabad
- After Udaipur, dispute surfaces in erstwhile royal family of Bikaner
Just In
Microsoft discovers most dangerous mobile Android ransomware
Microsoft has discovered sophisticated mobile Android ransomware with novel techniques and behaviour, evading many available protections and registering a low detection rate against security solutions.
New Delhi: Microsoft has discovered sophisticated mobile Android ransomware with novel techniques and behaviour, evading many available protections and registering a low detection rate against security solutions.
Called AndroidOS/MalLocker.B, the mobile ransomware is the latest variant of a ransomware family that's been in the wild for a while but has been evolving non-stop.
"This ransomware family is known for being hosted on arbitrary websites and circulated on online forums using various social engineering lures, including masquerading as popular apps, cracked games, or video players," Dinesh Venkatesan from Microsoft Defender Research team said in a security blog post on Thursday.
As with most Android ransomware, this new threat doesn't actually block access to files by encrypting them.
Instead, it blocks access to devices by displaying a screen that appears over every other window, such that the user can't do anything else.
"The said screen is the ransom note, which contains threats and instructions to pay the ransom," Microsoft said.
This new mobile ransomware variant is an important discovery because the malware exhibits behaviours that have not been seen before and could open doors for other malware to follow.
"It reinforces the need for comprehensive defense powered by broad visibility into attack surfaces as well as domain experts who track the threat landscape and uncover notable threats that might be hiding amidst massive threat data and signals," Microsoft researchers explained.
In the past, Android ransomware used a special permission called "SYSTEM_ALERT_WINDOW" to display their ransom note.
Apps that have this permission can draw a window that belongs to the system group and can't be dismissed.
No matter what button is pressed, the window stays on top of all other windows.
"The notification was intended to be used for system alerts or errors, but Android threats misused it to force the attacker-controlled UI to fully occupy the screen, blocking access to the device. Attackers create this scenario to persuade users to pay the ransom so they can gain back access to the device," Microsoft explained.
To adapt, Android malware evolved to misusing other features, but these aren't as effective.
"The new Android ransomware variant overcomes these barriers by evolving further than any Android malware we've seen before".
Microsoft Defender for Endpoint on Android, now generally available, extends industry-leading endpoint protection to Android.
The company said that it detects this ransomware (AndroidOS/MalLocker.B), as well as other malicious apps and files using cloud-based protection powered by deep learning and heuristics, in addition to content-based detection.
© 2024 Hyderabad Media House Limited/The Hans India. All rights reserved. Powered by hocalwire.com