Android Users Beware: MalLocker.B Ransomware Activates when You Press the Home Button!
- By Dawna M. Roberts
- Published: Oct 12, 2020
- Last Updated: Mar 18, 2022
Android users are under attack by a new type of mobile ransomware that activates and locks your screen when you get an incoming call or push the home button.
MalLocker.B Ransomware
A very sophisticated strain of ransomware started showing up on the Android platform, and when users push the home button, the phone locks up and displays a ransom note.
Microsoft reported that this newest threat is being distributed through malicious websites (many that appear to be legitimate gaming sites) and online forums. Unfortunately, this new ransomware is so ingenious it avoids detection by many of the top anti-malware software programs running on the mobile platform. That makes this a very dangerous threat to Android users.
How it Works
Once activated, the malware locks the phone with an overlay screen showing a ransom note. The user is prevented from pushing any buttons or doing anything with the device. However, the good news is unlike computer-based ransomware; this variant does not encrypt any data. What makes this variant unique is that it exploits certain features of the Android operating system and includes open-source machine learning, so it fits the overlay screen perfectly to the device. However, despite any action taken, the user cannot dismiss the message or use the device.
Hackers who created MalLocker attached the ransom note to Android permission called “SYSTEM_ALERT_WINDOW.” Whenever a user opens an app that is tied to that permission, the ransom note activates and cannot be removed.
The ransom note itself is designed to look like it came from law enforcement and informs users that they have committed a crime and must pay a fine. This type of ransomware is not new; however, this particular weapon is quite effective by using a two-part system.
The Technical Details
It works by exploiting the call notification function within AndroidOS, which already displays an overlay screen to show who is calling and details about the caller. The malware also exploits the “onUserLeaveHint()” function, which is activated when the user presses the Home or Recents button. Once pressed, this brings the ransom note back to the foreground and prevents the user from dismissing it. Used together, this technique is new and impressive but also very damaging to the victims.
According to Microsoft, “The malware overrides the onUserLeaveHint() callback function and triggers the automatic pop-up of the ransomware screen without…posing as system window.” The threat researcher also noted that “The malware creates a notification builder [and builds] a very important notification that needs special privilege. The setFullScreenIntent()…API wires the notification to a GUI so that it pops up when the user taps on it.”
The most interesting thing about this latest threat is the evolution of it. MalLocker uses a machine-learning module to resize the screen. Microsoft threat analysts impressed by the technique were quoted as saying, “This ransomware is the latest variant of a malware family that has undergone several stages of evolution,” researchers said. “We expect it to churn out new variants with even more sophisticated techniques. In fact, recent variants contain code forked from an open-source machine-learning module used by developers to automatically resize and crop images based on screen size, a valuable function given the variety of Android devices.” They also added a warning “This new mobile ransomware variant is an important discovery because the malware exhibits behaviors that have not been seen before and could open doors for other malware to follow.”
How to Avoid this Threat
MalLocker is programmed using a very simple code that is undetectable by the Google Play Store and other antivirus/anti-malware software options. However, experts know that it is being distributed through third-party websites and online forums. Therefore the best way to stay clear of this one is to avoid installing any apps from anywhere other than the Google Play Store.
No matter how tempting, avoid downloading apps from websites that appear to be legitimate gaming websites or online forums or chat resources that offer free goodies. Some other tips for mobile device safety are:
- Keep your mobile device updated with the latest OS and any security patches.
- Install good, strong antivirus/anti-malware software on your phone. Run deep scans often.
- Never click links in an email; your phone can be infected through phishing emails.
- Review your security and privacy settings on the device and set them to maximum protection.
- Do not share passwords or other personal information with anyone.
- Do not reuse passwords on multiple websites.
- Never install any software from unknown sources.
- Turn on multi-factor authentication when it’s available.
Blocking this most recent threat and others is a chore of common sense. Always be on the lookout for scams or things that look too good to be true, like free downloads or software.
