Feeds

Prison Locker: A load of überhyped malware FUD over... internet chatter

Forum posts about building a net nasty don't mean it's a live threat, folks

Reducing security risks from open source software

An underground advert seeking help in developing a file-encrypting ransomware kit that might be sold for just $100 a go sparked something of a panic on the interwebs this week.

But security watchers are yet to see any samples of the so-called Prison Locker ransomware, leading at least two security firms to characterise the threat as intangible and overhyped.

Security researchers at MalwareMustDie posted a blog entry last Friday featuring screenshots from underground forums where a malign coder sought help to develop a file-encrypting ransomware creation kit.

There was no hard evidence of anything beyond a project in progress which may or may not come to fruition. Nonetheless, the post sparked plenty of excitable headlines about how the "Prison Locker virus threatens to flood the market" and how the threat is supposedly "bigger and meaner" than CryptoLocker.

CryptoLocker, the infamous Bitcoin-demanding ransomware menace, has infected as many as a quarter of a million machines since it first surfaced last September, according to research from Dell SecureWorks’ Counter Threat Unit. Earlier versions of CryptoLocker typically arrived in email as an executable file disguised as a PDF, packed into a .zip attachment, while more recent variants have gained the capability to spread like a worm across infected USB devices.

File-encrypted ransomware is a lucrative and now proven type of cybercrime and there's little doubt we'll see more copycats in this area, perhaps even strains that infect computers which aren't running Windows. But it's a leap of faith to imagine that the Prison Locker toolkit will deliver this nightmare scenario, especially at the ridiculously low prices quoted: far below the $1,000s in typical costs to buy malware creation kits through underground forums.

The Prison Locker ransomware kit plot may or may not be a genuine malware development project. MalwareMustDie only offered up the screenshots of suspicious activity on underground forums as something for security researchers to be aware of and (primarily) as something that law enforcement might want to investigate.

But in the absence of any malware created by the toolkit – or even anything much beyond a basic plan – fears about Prison Locker, cooked up by normally reliable media outlets rather than MalwareMustDie directly, are something of a phantom menace perhaps akin to worrying about a possible volcano eruption in the midst of widespread damage caused by flooding.

Researchers at security tools firm AlienVault and web and email security firm AppRiver's researchers both downplayed the threat posed by Prison Locker, which has yet to to result in any real world threat – and, perhaps, never will.

Jaime Blasco, director at AlienVault Labs, commented: "Based on the research I did on this and checking my sources, most of PowerLocker/PrisonLocker is a hype since the only information available is a guy that is supposedly developing this new ransomware – but it is not still ready. We don't know the status of the project but one thing is clear: there are no samples available of this threat."

Troy Gill, a security analyst at AppRiver, added: "I don’t think that this kit has been put into use yet, however it is quite concerning, since we have seen how widespread kits have become for cybercriminals. Of course just like Cryptolocker, the best way to protect your data is a cold back-up. As long as offline backups are made regularly, the damage inflicted by this malware will be minimal." ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.