- Jan 24, 2011
- 9,378
Naked Security came across an intriguing phishing campaign that combines two feared products of the information age.
Gatsos (speed cameras) and ransomware, rolled into one attack!
It all started with a phishing email claiming to be from the Office of State Revenue in New South Wales, Australia.
The subject matter is a speeding fine you are alleged to have clocked up:
Details are scant, notably that the location is identified only by a code number and your registration number (a.k.a. licence plate or tag) is not given.
But the time of the alleged offence is stated as 11.21pm, presumably a time at which most people wouldn't be driving, giving a glimmer of hope that some sort of mistake was made.
(Or someone else was driving your car. Wouldn't you love to see if the speed camera could tell you who it was?)
You ought to smell a rat, of course, not least because the word "offence" is spelled in two different ways in the email, and the penalty notice number is inconsistent:
But, as we said, Gatsos get many people's knees a-knocking, so you might be inclined to click on ACT NOW anyway.
→ Did you know that the name Gatso comes from a Dutch rally driver called Maurice Gatsonides, who ironically came up with the idea of a speed camera so he could learn to drive faster?
The next step in the phish takes you to a what looks like a download portal page belonging to the State Debt Recovery Office (SDRO).
To add a touch of realism, the crooks have made it harder, not easier, to access your penalty notice by making you solve a CAPTCHA first:
The real SRDO portal looks vaguely similar, but has one important difference:
There's a warning entitled SCAM ALERT posted across the top of the real page, advising you about just this sort of scam.
Interestingly, we regularly see scams that try to add a veneer of legitimacy by incorporating real warnings and anti-phishing advice from the very sites they are impersonating – advice you would be well-advised to take!
The ransomware download
Once you solve the CAPTCHA shown above, you are redirected to a download site that serves up a file called offence_id_37984264.zip.
Again, you ought to smell a rat, especially if you unzip the file and notice it contains an undisguised program called offence_id_37984264.exe.
Sophos Anti-Virus will block this file with the name Troj/Ransom-ANH, and with good reason: it's ransomware, that dastardly brand of malware that scrambles your data and offers to sell it back to you.
This one calls itself CryptoLocker, borrowing the "brand name" of one of the best known ransomware variants ever distributed:
The original CryptoLocker reached its peak of notoriety towards the end of 2013, giving you three days to come up with $300 if you wanted to see your data again.
By March 2014 it was estimated that in the UK alone, about 1 in 30 users had their system hit by CryptoLocker, and 40% of those paid up.
The original CryptoLocker was neutralised after a US-led takedown operationmanaged to confiscate the servers it used to generate and store the decryption keys.
→ CryptoLocker took care never to have a copy of the decryption key on your computer (not even in memory), where you might be able to intercept it without paying the ransom. That meant generating a public-private key pair on its own servers, and then releasing only the public key, used for encryption. In other words, if the malware couldn't call home, it couldn't get an encryption key, so it didn't scramble your data. Taking the servers offline therefore had the handy side-effect of preventing further ransoms from being demanded.
The Troj/Ransom-ANH ransomware even has a handy Frequently Asked Questions page:
This explains that the only way to get your data back is to pay up, and refers you to a website accessible via the anonymising service Tor:
The fee is the BitCoin equivalent of US$500 if you pay up within five days (120 hours), or US$1000 if you wait.
Read more: http://nakedsecurity.sophos.com/201...phish-leads-to-cryptolocker-ransomware-clone/
Gatsos (speed cameras) and ransomware, rolled into one attack!
It all started with a phishing email claiming to be from the Office of State Revenue in New South Wales, Australia.
The subject matter is a speeding fine you are alleged to have clocked up:
Details are scant, notably that the location is identified only by a code number and your registration number (a.k.a. licence plate or tag) is not given.
But the time of the alleged offence is stated as 11.21pm, presumably a time at which most people wouldn't be driving, giving a glimmer of hope that some sort of mistake was made.
(Or someone else was driving your car. Wouldn't you love to see if the speed camera could tell you who it was?)
You ought to smell a rat, of course, not least because the word "offence" is spelled in two different ways in the email, and the penalty notice number is inconsistent:
But, as we said, Gatsos get many people's knees a-knocking, so you might be inclined to click on ACT NOW anyway.
→ Did you know that the name Gatso comes from a Dutch rally driver called Maurice Gatsonides, who ironically came up with the idea of a speed camera so he could learn to drive faster?
The next step in the phish takes you to a what looks like a download portal page belonging to the State Debt Recovery Office (SDRO).
To add a touch of realism, the crooks have made it harder, not easier, to access your penalty notice by making you solve a CAPTCHA first:
The real SRDO portal looks vaguely similar, but has one important difference:
There's a warning entitled SCAM ALERT posted across the top of the real page, advising you about just this sort of scam.
Interestingly, we regularly see scams that try to add a veneer of legitimacy by incorporating real warnings and anti-phishing advice from the very sites they are impersonating – advice you would be well-advised to take!
The ransomware download
Once you solve the CAPTCHA shown above, you are redirected to a download site that serves up a file called offence_id_37984264.zip.
Again, you ought to smell a rat, especially if you unzip the file and notice it contains an undisguised program called offence_id_37984264.exe.
Sophos Anti-Virus will block this file with the name Troj/Ransom-ANH, and with good reason: it's ransomware, that dastardly brand of malware that scrambles your data and offers to sell it back to you.
This one calls itself CryptoLocker, borrowing the "brand name" of one of the best known ransomware variants ever distributed:
The original CryptoLocker reached its peak of notoriety towards the end of 2013, giving you three days to come up with $300 if you wanted to see your data again.
By March 2014 it was estimated that in the UK alone, about 1 in 30 users had their system hit by CryptoLocker, and 40% of those paid up.
The original CryptoLocker was neutralised after a US-led takedown operationmanaged to confiscate the servers it used to generate and store the decryption keys.
→ CryptoLocker took care never to have a copy of the decryption key on your computer (not even in memory), where you might be able to intercept it without paying the ransom. That meant generating a public-private key pair on its own servers, and then releasing only the public key, used for encryption. In other words, if the malware couldn't call home, it couldn't get an encryption key, so it didn't scramble your data. Taking the servers offline therefore had the handy side-effect of preventing further ransoms from being demanded.
The Troj/Ransom-ANH ransomware even has a handy Frequently Asked Questions page:
This explains that the only way to get your data back is to pay up, and refers you to a website accessible via the anonymising service Tor:
The fee is the BitCoin equivalent of US$500 if you pay up within five days (120 hours), or US$1000 if you wait.
Read more: http://nakedsecurity.sophos.com/201...phish-leads-to-cryptolocker-ransomware-clone/
