Feeds

Prison Locker: A load of überhyped malware FUD over... internet chatter

Forum posts about building a net nasty don't mean it's a live threat, folks

The Essential Guide to IT Transformation

An underground advert seeking help in developing a file-encrypting ransomware kit that might be sold for just $100 a go sparked something of a panic on the interwebs this week.

But security watchers are yet to see any samples of the so-called Prison Locker ransomware, leading at least two security firms to characterise the threat as intangible and overhyped.

Security researchers at MalwareMustDie posted a blog entry last Friday featuring screenshots from underground forums where a malign coder sought help to develop a file-encrypting ransomware creation kit.

There was no hard evidence of anything beyond a project in progress which may or may not come to fruition. Nonetheless, the post sparked plenty of excitable headlines about how the "Prison Locker virus threatens to flood the market" and how the threat is supposedly "bigger and meaner" than CryptoLocker.

CryptoLocker, the infamous Bitcoin-demanding ransomware menace, has infected as many as a quarter of a million machines since it first surfaced last September, according to research from Dell SecureWorks’ Counter Threat Unit. Earlier versions of CryptoLocker typically arrived in email as an executable file disguised as a PDF, packed into a .zip attachment, while more recent variants have gained the capability to spread like a worm across infected USB devices.

File-encrypted ransomware is a lucrative and now proven type of cybercrime and there's little doubt we'll see more copycats in this area, perhaps even strains that infect computers which aren't running Windows. But it's a leap of faith to imagine that the Prison Locker toolkit will deliver this nightmare scenario, especially at the ridiculously low prices quoted: far below the $1,000s in typical costs to buy malware creation kits through underground forums.

The Prison Locker ransomware kit plot may or may not be a genuine malware development project. MalwareMustDie only offered up the screenshots of suspicious activity on underground forums as something for security researchers to be aware of and (primarily) as something that law enforcement might want to investigate.

But in the absence of any malware created by the toolkit – or even anything much beyond a basic plan – fears about Prison Locker, cooked up by normally reliable media outlets rather than MalwareMustDie directly, are something of a phantom menace perhaps akin to worrying about a possible volcano eruption in the midst of widespread damage caused by flooding.

Researchers at security tools firm AlienVault and web and email security firm AppRiver's researchers both downplayed the threat posed by Prison Locker, which has yet to to result in any real world threat – and, perhaps, never will.

Jaime Blasco, director at AlienVault Labs, commented: "Based on the research I did on this and checking my sources, most of PowerLocker/PrisonLocker is a hype since the only information available is a guy that is supposedly developing this new ransomware – but it is not still ready. We don't know the status of the project but one thing is clear: there are no samples available of this threat."

Troy Gill, a security analyst at AppRiver, added: "I don’t think that this kit has been put into use yet, however it is quite concerning, since we have seen how widespread kits have become for cybercriminals. Of course just like Cryptolocker, the best way to protect your data is a cold back-up. As long as offline backups are made regularly, the damage inflicted by this malware will be minimal." ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.