Security Architecture, Endpoint/Device Security, Endpoint/Device Security, Threat Management, Threat Management, Malware, Ransomware, Endpoint/Device Security, Endpoint/Device Security, Endpoint/Device Security

Coronavirus tracking app locks up Android phones for ransom

A malicious Android app that supposedly helps track cases of the coronavirus actually locks users' phones and demands a ransom in order to restore access. (Note: a password key has since been published. See follow-up story here.)

Dubbed CovidLock, the newly discovered ransomware performs a screen-lock attack by forcing a change in the password required to unlock a phone, explains DNS threat intelligence company DomainTools today in a blog post authored by Tarik Saleh, senior security engineer and malware researcher. For Android Nougat devices and later versions, the attack only works if the user never bothers to set a password in the first place.

Victims are given a 48-hour deadline to pay a $100 ransom in bitcoin. To ratchet up the stakes, the ransomware program also threatens to erase one's contacts, photos, videos and memory, as well as leak the victim's social media accounts. "Note: Your GPS is watched and your location is known. If you try anything stupid your phone will be automatically erased," the ransom note also states.

The malicious app, which purports to offer statistics on the COVID-19 pandemic and a heat map of outbreak hotspots, was found available for download at the domain coronavirusapp[.]site.

But there is good news: DomainTools has reverse engineered the decryption keys and intends to post the key publicly. The researchers also is monitoring transactions associated with the attackers' bitcoin wallet.

"Cybercriminals like to exploit people when they are at their most vulnerable. They use dramatic events that cause people to be emotional or fearful to drive their profits," said Saleh. "The coronavirus is no different. Shortly after the first cases were confirmed, DomainTools' researchers observed a minor uptick in domain names leveraging Coronavirus and COVID-19. These registrations have peaked significantly in the past few weeks and many of them are scams."

Indeed, research firms across the cyber industry have been reporting surges in cyber scams leveraging fears surrounding coronavirus. In a similar scheme, researchers recently discovered a weaponized coronavirus map app that infects victims with a variant of the information-stealing AZORult malware.

SC Media recently interviewed Saleh at the 2020 RSA conference in San Francisco, as part of its annual "Trolley Talk" cable car interviews.

Bradley Barth

As director of community content at CyberRisk Alliance, Bradley Barth develops content for SC Media online conferences and events, as well as video/multimedia projects. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.