cryptolocker
There is new piece of ransomware out there going after the players of some 40 online games in an apparent attempt to target a somewhat younger crowd of computer users.
Ransomware is a type of malware the targets and encrypts the user-files on infected machines. Once the files are securely encrypted, the people controlling the malware demand payment for the private key that can decrypt the files. After a pre-ordained period of time, the attackers destroy the decryption key.
The malware was first reported by Bleeping Computer, a technical support and user education forum that is quickly establishing itself as a go-to source for information about encryptors and ransomware schemes. Bleeping Computer has dubbed the malware TelsaCrypt, while the security firm Bromium issued a separate and completely independent report on the threat, which they are characterizing as a new variant of CryptoLocker. Bleeping Computer credits Fabian Wosar of Emsisoft for first uncovering TeslaCrypt.
According to Bleeping Computer, TeslaCrypt is targeting files associated with games and platforms like RPG Maker, League of Legends, Call of Duty, Dragon Age, StarCraft, MineCraft, World of Warcraft, World of Tanks, and other popular online games as well. This is a departure from prior schemes that tend to target documents, pictures, videos and other standard files stored on user-machines. It is deploying AES encryption in order that gamers are not able to access their gaming-related files without the decryption key. That key, by the way, is going to set victims back $500 if they choose to pay with Bitcoin and $1000 if they choose to pay via a PayPal My Cash card.
While Bleeping Computer led the way here, Bromium added to the story by determining how TeslaCrypt is being distributed. Not surprisingly, criminals are packaging the threat inside the Angler Exploit Kit. Exploit Kits are essentially software packages pre-made to compromise computer systems. They come loaded with exploits for common security vulnerabilities and, like the software-as-a-service industry, attackers can pay licensing fees in order to have access to them. Exploit kits offer easy avenues for attackers to load malware on to the machines of their victims. For years, BlackHole was the premier exploit kit. However, that kit fell out of favour after its author curbed development and was subsequently arrested in Russia. Over the year and a half or so since, Angler has emerged to fill that void, consistently integrating the newest zero days as well as the exploits for those vulnerabilities.
A new piece of #ransomware called #TeslaCrypt is targeting gamers
Tweet
After infection, the malware changes the background of their computer to a notification that the user’s files have been encrypted. The message contains instructions on how and where users need to go to buy the private key to decrypt their files. Part of the process involves downloading the Tor Browser Bundle. Interestingly, their is a hidden services site where infected users can receive technical support from the malware authors on how to make a payment and then decrypt their files. The warning also contains a deadline, after which point the private key will be destroyed and the files will be impossible to recover.
The warning is very similar to that of the infamous CryptoLocker ransomware, which may in fact be why Bromium considers the two pieces of malware to be related to one another. As Bromium notes, the technical similarities between the two are negligible, but they believe TeslaCrypt is leveraging CryptoLocker’s brand.
#CryptoLocker Variant Coming After Gamers – https://t.co/PpCEfk5bbL
— Threatpost (@threatpost) March 12, 2015
As always, we at the Kaspersky Daily cannot in good conscience advise anyone to pay for the private key. To do so would be to encourage this type of scam. The best defence against this and similar ransomware schemes is to regularly perform backups. On a Mac, Time Machine is an excellent service that performs automatic back up to attached storage devices. If you were to become infected, you could merely open up Time Machine and roll your computer back to some date before the infection occurred. Windows machines offer a similar restore feature that lets users roll their machine back as well. The best option is simply to back up all your important files and programs to an external hard drive a couple times a month. This way, you can simply delete all the encrypted files, use a strong anti-virus product to remove any malware, and then recover your files from your external hard-drive.
Of course, you also need to be installing operating system, software, application and browser updates. The vast majority of exploit kits target known and patched security vulnerabilities.
New #TeslaCrypt #Ransomware sets its scope on video gamershttp://t.co/u3cO8iMdp8 pic.twitter.com/rrhBG9HJ4x
— BleepingComputer (@BleepinComputer) February 27, 2015
We’ve said it before and we’ll say it again: crypto ransomware is here to stay and it’s bad news, so make sure you are dedicating some time to backing your machines up. Furthermore, as you can see through the deployment of technical support and branding, the people behind these schemes have an eye toward business and marketing. In other words, they are getting better at infected users and convincing them to pay to get their files back. This reality exists in a world where we are connecting more and more things to the internet, which will only exacerbate the problem.
Tips