Feeds

Cryptolocker copycat ransomware emerges – but an antidote is possible

Security upstart claims it's found a file-gobbling nasty with weak encryption

SANS - Survey on application security programs

Hot on the tail of devilish Cryptolocker comes a copycat software nasty that holds victim's files to ransom – but the newcomer's encryption is potentially breakable, we're told.

Security startup IntelCrawler claims a "large-scale distribution" of the new so-called Locker malware began earlier this month.

Locker, once it has infected a PC, copies and encrypts a victim's documents, adding a ".perfect" extension, and then deletes the original data. The trojan also places a contact.txt file in each directory containing contact details of the malware author – usually a throwaway mobile phone number or an email address.

Victims are warned that if they harass or threaten the extortionist, the decryption key to unlock the files will be deleted, revealing the mindset of the scumbags behind the scam.

IntelCrawler contacted a crook listed in the contact file, and was told someone would have to pay up $150 to a Perfect Money or QIWI VISA Virtual Card number to receive the decryption key needed to restore the information on a Locker-infected machines.

In order to decrypt, you need to provide an identifying code written in the “contact.txt” file, as well as the hostname of the compromised computer.

"It seems to be the hackers just compare the list of infected IP addresses of the users together with their hostnames," according to IntelCrawler.

Locker is a rank amateur effort compared to the CryptoLocker crew, who run their scam using a network of command-and-control servers and use a combination of 256-bit AES and 2048-bit RSA crypto to hold data to ransom (the master key being held in the crims' servers).

But despite its less-advanced design, Locker has already managed to attack Windows-powered computers in the US, we're told – including Washington DC, Texas and Missouri – plus PCs in the Netherlands, Turkey, Germany and Russia. Locker also, we're told, avoids infecting machines running tools used by security researchers, a tactic undoubtedly aimed at ensuring the malware stays under the radar for as long as possible.

The software nasty spreads mostly by drive-by downloads from compromised websites. Executables disguised as MP3 files are another vector of infection.

The Locker malware uses the TurboPower LockBox library, a cryptographic toolkit for Delphi: specifically, it uses AES-CTR for encrypting the contents of files on infected devices. But shortcomings in the programming will apparently make it possible for researchers to develop skeleton keys capable of unscrambling files on compromised kit. IntelCrawler's researchers are working on a universal antidote.

"We have found a decryption method and universal strings [keys] for decryption on any infected client," Andrey Komarov, IntelCrawler's chief exec, told El Reg.

Komarov added that detection of the malware by antivirus packages is low, with only Avira able to detect the pathogen as of Thursday evening. ®

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.