A police-themed ransomware is now able to use the browsing histories from infected computers in order to make their scams more believable, a researcher said.
For those that don’t know, ransomware is a class of malicious applications designed to extort money from users by disabling important system functionality or by encrypting their personal files. One variation will display a message that appears as if it is a notification from law enforcement agencies.
The language of the messages and the agency names used in them change depending on the location of the victims, but in almost all cases the criminals tell the victims their computers ended up locked because they accessed or downloaded illegal content. In order to regain access to their computers, users must pay a fine.
A new ransomware variant came to light over the weekend via an independent malware analyst known online as Kafeine. Dubbed Kovter, this version stands out because it uses information gathered from the victim’s browser history in order to make the scam message more credible, Kafeine said in a blog post.
Kovter displays a fake warning from the U.S. Department of Justice, the U.S. Department of Homeland Security and the FBI, that claims the victim’s computer downloaded and distributed illegal content. The message also lists the computer’s IP address, its host name and a website from where he downloaded the illegal material.
The malware checks if any of the sites already present in the computer’s browser history is present in a remote list of porn sites whose content is not necessarily illegal, and if there’s a match, it displays it in the message. By using this technique and naming a site the victim has actually visited as the source for the “illegal content,” the ransomware authors attempt to increase the credibility of their message.
If the attacker does not find a match when checking the browser history against the remote list, the malware will just use a random porn site in the message, Kafeine said.
The authors of police-themed ransomware are constantly trying to improve their success rate and this is just the latest in a long series of tricks they have added. Some variants are actually using the computer’s webcam, if one is present, to take a picture of the user and include it in the message in order to give the impression that the authorities are recording the user. Another variant gives victims a deadline of 48 hours to pay the made-up fine before their computer drive ends up reformatted and their data destroyed.
The average number of daily infection attempts with police-themed ransomware has doubled during the first months of 2013, according to Sergey Golovanov, a malware expert in the global research and analysis team at antivirus vendor Kaspersky Lab. The distribution of this threat was at an all-time high during February and March, he said.
The most important thing for ransomware victims is not to pay the cybercriminals any money, Golovanov said. “What you need to do is go to another computer and start searching for a solution, which you will always be able to find on the Internet,” he said. “All antivirus companies post free instructions and utilities to help users unblock their computers.”
“In the worst-case scenario, if you are faced with a unique blocker, you can always address the specialized forums of antivirus companies or contact tech support for expert advice and solutions,” he said. “Of course, this could take some time, but the key thing is not to pay up and fund this extortion.”