New Android Ransomware out: Pay $500 or Forced factory rest!

Post Reply New Topic

http://arstechnica.com/security/2015/09/new-android-ransomware-locks-out-victims-by-changing-lock-screen-pin/

Dubbed Android/Lockerpin.A, the app first tricks inexperienced users into granting it device administrator privileges. To achieve this, it overlays a bogus patch installation window on top of an activation notice. When targets click on the continue button, they really grant the malicious app elevated rights that allow it to make changes to the Android settings. From there, Lockerpin sets or resets the PIN that unlocks the screen lock, effectively requiring users to perform a factory reset to regain control over the device. By contrast, earlier forms of Android ransomware generally were thwarted, usually by deactivating administrator privileges and then uninstalling the app after the infected device is booted into safe mode.

"After clicking on the button, the user's device is doomed," Lukas Stefanko, a researcher with antivirus provider Eset, wrote in a blog post published Thursday. "The trojan app has obtained administrator rights silently and now can lock [the] device—and even worse, it set[s] a new PIN for the lock screen. Not long after, the user will be prompted to pay a $US500 ransom for allegedly viewing and harboring forbidden pornographic material."

There has got to be a way around that with adb or something...

Well, frankly, you'd have to be pretty stupid to give a porn app special privileges to your phone, I'm assuming it tries to get 'device manager' privs. The screenshot shows a "patching" screen that it overlays over the settings screen apparently. I know that at least in android lollipop it does not let you make any security changes while there is any kind of overlay for this very reason. Someone who would fall for that would most likely not have a clue how to fix it...