|
|
|
SLocker Android Ransomware Communicates Via TOR And SMS |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Présentation : A little over two weeks ago, we found a new family of Android ransomware SLocker. We have no evidence that SLocker is related to Koler, the most recently discovered Android ransomware. It does however carry through on the threat Koler made. Unlike Koler which pretended to, but didn't actually encrypt files SLocker will actually scan the device's SD card for specific file types slocker 3k image When the SLocker app is launched, it encrypts these files and then displays a ransom message Ukraine ransom The message informs the user they must transfer a payment via an online money transfer service in order to recover the files. The phone number listed in the message on the left is based in Ukraine. Currently there are two versions of this family. The first version uses the TOR anonymizing network to communicate between infected phones and the malware's C C-server. We suspect this version might be a testing revision because all debug information is available. The second SLocker version appeared at the same time as the TOR-enabled version but is simplified. This version shares much the same code including encryption and the same hardcoded decryption key but the debugging parts are no longer present. The main difference though is that this version doesn't use TOR. Instead, it takes its commands via SMS messages SLocker permission Also notable is that unlike the TOR-enabled version, this one lists a Russian phone number and demands Russian currency in the ransom message Russia ransom Digging deeper into retracing the C C server, we found its IP address had been registered as far back to 2005 to a private person. Currently, a Russian-based webhosting service is running there. Though this version of SLocker is less sophisticated in that it does not use TOR for its C C communications, it still seems to be under active development, as the latest sample we have of this version now includes capability to take photographs using the device's camera. It seems likely that SLocker's author s will continue to develop it in the future. Post by Mikko Hyykoski On 16 06 14 At 07 10 AM
Les mots clés de la revue de presse pour cet article : android
Les videos sur SecuObs pour les mots clés : android ransomware
Les éléments de la revue Twitter pour les mots clé : android
Les derniers articles du site "F Secure Antivirus Research Weblog" :
- OnionDuke APT Attacks Via the Tor Network
- What grade does your favorite app get
- Remember, Remember the Fifth of November
- Vote For Freedome Beta
- Multi-language support Not your everyday spam
- It's Not a Game - It's a Violation of Human Dignity
- 101 Bad Android Apps
- A Tale of Two Powerpoint Vulnerabilities
- Wanted Testers For The Greatest Android App Ever
- RATs threatening democracy activists in Hong Kong
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
