A malicious Android app that supposedly helps track cases of the coronavirus actually locks users' phones and demands a ransom in order to restore access. (Note: a password key has since been published. See follow-up story here.)
Dubbed CovidLock, the newly discovered ransomware performs a screen-lock attack by forcing a change in the password required to unlock a phone, explains DNS threat intelligence company DomainTools today in a blog post authored by Tarik Saleh, senior security engineer and malware researcher. For Android Nougat devices and later versions, the attack only works if the user never bothers to set a password in the first place.
Victims are given a 48-hour deadline to pay a $100 ransom in bitcoin. To ratchet up the stakes, the ransomware program also threatens to erase one's contacts, photos, videos and memory, as well as leak the victim's social media accounts. "Note: Your GPS is watched and your location is known. If you try anything stupid your phone will be automatically erased," the ransom note also states.
Please register to continue.
Already registered? Log in.
Once you register, you'll receive:
The context and insight you need to stay abreast of the most important developments in cybersecurity. CISO and practitioner perspectives; strategy and tactics; solutions and innovation; policy and regulation.
Unlimited access to nearly 20 years of SC Media industry analysis and news-you-can-use.
SC Media’s essential morning briefing for cybersecurity professionals.
One-click access to our extensive program of virtual events, with convenient calendar reminders and ability to earn CISSP credits.