Canada: Malware victims no longer have to "put up with" fake FBI notifications stating that they were "caught" trying to download illegal material and that they must pay a fine.
The latest version of Koler Android ransomware has been detected, and it's smart enough to present Canadians with a warning message purportedly from the Canadian Mounted Police, according to a report by mobile security firm Appthority.
“This is the first we have identified that is specifically targeted at Canadian citizens,” said Domingo Guerra, President and Founder of Appthority.
According to the company, criminals either create dummy or clone websites allegedly offering pornographic material, or place ads on smaller niche pornography sites.
When users visit, they think they are downloading a video viewer for their mobile device, but in reality they are installing malware.
The criminals then inform users that their phones will remain locked until they pay a fine, or threaten to spread the word to all their contacts that they are viewing pornographic material.
"This has to do not only with the security aspect, but also with the shame of being exposed," Guerra said.
Due to the potential embarrassment, users are reluctant to go to the authorities — or to their company's IT departments — if they have been infected with malware.
Criminals typically demand that payment be in the form of gift cards, something legitimate law enforcement agencies would never do.
That makes users suspicious, Guerra said. “But they’re embarrassed because it’s a pornography site, so they don’t want it to be known publicly.”
Fines started at about $100, but have recently increased to about $500, he said.
Meanwhile, the criminals themselves actually lie that the users' phone has been locked, or that they are able to send emails or text messages to the user's contacts.
"Most of the time there is a way to unlock the phone and it doesn't require paying the ransom," he said. "You put the phone in safe mode, delete the app, and then reset the phone."
And the malware doesn't actually have the ability to send the messages, he added. The malware also says the files have been encrypted.
“They claim they do, but they don’t,” Guerra said. “It was just a ruse.”
He suggests that businesses address the issue by educating their employees, advising them to download apps only from official app stores – and to turn to someone for help if something goes wrong.
“Google Play doesn’t allow adult content or pornography,” he said. “So users have to go to third-party sites. It’s a part of the market that Google doesn’t support.”
