A low-tech but cunning malware program is worrying security researchers after it started spreading rapidly in the past week through a new attack vector: by forcibly exploiting vulnerabilities in Facebook and LinkedIn.
According to the Israeli security firm Check Point, security flaws in the two social networks allow a maliciously coded image file to download itself to a user's computer. Users who notice the download, and who then access the file, cause malicious code to install "Locky" ransomware onto their computers.
Locky has been around since early this year, and works by encrypting victims' files and demands a payment of around half a bitcoin (currently £294; $365) for the key. Previously, it had relied on a malicious macro in Word documents and spam e-mails, but Check Point says that in the past week there has been a "massive spread of the Locky ransomware via social media, particularly in its Facebook-based campaign."
Check Point won't go into detail on how the exploit works until the vulnerability is patched by LinkedIn and Facebook. However, its researchers have claimed:
The attackers have built a new capability to embed malicious code into an image file and successfully upload it to the social media website. The attackers exploit a misconfiguration on the social media infrastructure to deliberately force their victims to download the image file. This results in infection of the users’ device as soon as the end-user clicks on the downloaded file.
As more people spend time on social networking sites, hackers have turned their focus to find a way in to these platforms. Cyber criminals understand these sites are usually 'white listed,' and for this reason, they are continually searching for new techniques to use social media as hosts for their malicious activities.
Users are advised not to open any file that has automatically downloaded, especially any image file with an unusual extension such as SVG, JS, or HTA—though benign-looking images could exploit the way Windows hides file extensions by default.
"When Locky encrypts a file it will rename the file to the format [unique_id][identifier].locky," wrote security researcher Lawrence Abrams in February. "So when test.jpg is encrypted it would be renamed to something like F67091F1D24A922B1A7FC27E19A9D9BC.locky. The unique ID and other information will also be embedded into the end of the encrypted file."
Ars' own analysis at the time found that Locky's mechanics are pretty much like every other ransomware package currently floating around in malware marketplaces. It leaves a ransom note text file called "_Locky_recover_instructions.txt" in each directory that's been encrypted, pointing to servers on the Tor anonymising network (both via Tor directly and through Internet relays) where the victim can make payment, and changes the Windows background image to a graphic version of the same message. It also stores some of the data in the Windows Registry file under HKCUSoftwareLocky.
Ars has asked for comment from both Facebook and LinkedIn.
Update
Facebook responded to Ars' request for comment late on Sunday night. It said:
This analysis is incorrect. There is no connection to Locky or any other ransomware, and this is not appearing on Messenger or Facebook. We investigated these reports and discovered there were several bad Chrome extensions, which we have been blocking for nearly a week. We also reported the bad browser extensions to the appropriate parties.
Listing image by Aurich Lawson
reader comments
97