Feeds

Prison Locker: A load of überhyped malware FUD over... internet chatter

Forum posts about building a net nasty don't mean it's a live threat, folks

The essential guide to IT transformation

An underground advert seeking help in developing a file-encrypting ransomware kit that might be sold for just $100 a go sparked something of a panic on the interwebs this week.

But security watchers are yet to see any samples of the so-called Prison Locker ransomware, leading at least two security firms to characterise the threat as intangible and overhyped.

Security researchers at MalwareMustDie posted a blog entry last Friday featuring screenshots from underground forums where a malign coder sought help to develop a file-encrypting ransomware creation kit.

There was no hard evidence of anything beyond a project in progress which may or may not come to fruition. Nonetheless, the post sparked plenty of excitable headlines about how the "Prison Locker virus threatens to flood the market" and how the threat is supposedly "bigger and meaner" than CryptoLocker.

CryptoLocker, the infamous Bitcoin-demanding ransomware menace, has infected as many as a quarter of a million machines since it first surfaced last September, according to research from Dell SecureWorks’ Counter Threat Unit. Earlier versions of CryptoLocker typically arrived in email as an executable file disguised as a PDF, packed into a .zip attachment, while more recent variants have gained the capability to spread like a worm across infected USB devices.

File-encrypted ransomware is a lucrative and now proven type of cybercrime and there's little doubt we'll see more copycats in this area, perhaps even strains that infect computers which aren't running Windows. But it's a leap of faith to imagine that the Prison Locker toolkit will deliver this nightmare scenario, especially at the ridiculously low prices quoted: far below the $1,000s in typical costs to buy malware creation kits through underground forums.

The Prison Locker ransomware kit plot may or may not be a genuine malware development project. MalwareMustDie only offered up the screenshots of suspicious activity on underground forums as something for security researchers to be aware of and (primarily) as something that law enforcement might want to investigate.

But in the absence of any malware created by the toolkit – or even anything much beyond a basic plan – fears about Prison Locker, cooked up by normally reliable media outlets rather than MalwareMustDie directly, are something of a phantom menace perhaps akin to worrying about a possible volcano eruption in the midst of widespread damage caused by flooding.

Researchers at security tools firm AlienVault and web and email security firm AppRiver's researchers both downplayed the threat posed by Prison Locker, which has yet to to result in any real world threat – and, perhaps, never will.

Jaime Blasco, director at AlienVault Labs, commented: "Based on the research I did on this and checking my sources, most of PowerLocker/PrisonLocker is a hype since the only information available is a guy that is supposedly developing this new ransomware – but it is not still ready. We don't know the status of the project but one thing is clear: there are no samples available of this threat."

Troy Gill, a security analyst at AppRiver, added: "I don’t think that this kit has been put into use yet, however it is quite concerning, since we have seen how widespread kits have become for cybercriminals. Of course just like Cryptolocker, the best way to protect your data is a cold back-up. As long as offline backups are made regularly, the damage inflicted by this malware will be minimal." ®

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.