Symantec detects a first ransomware on Android

Symantec has discovered an early version of ransomware (which requires a ransom to the user) on Android devices. This gives an indication of the willingness of criminals to target more mobile with this type of malware.

A fake antivirus called Fakedefender is the first ransomware discovered by Symantec on mobile devices. This malware targeting Android was found earlier this month among several applications on an English store this in several countries including the United States. The application is not available on Google Play. The ransomware has been downloaded only a hundred times, so that the level of infection is very low, said Vikram Thakur, a researcher from Symantec Security Response. Fakedefender is an application that pretends to find malware on the terminal and ask the victim to purchase a premium version to remove. This method has been used against PC users there a few years, but this is the first time on mobile.

Given the immaturity of malware, it is unlikely that the authors believed to be of Russian origin, aimed at a wide dissemination. "The developers of this fake antivirus are still pretty young to be compatible with all Android platforms they intend to target," says the researcher. Fakedefender is still work because the malware can steal personal information and does not connect to a site to pay for the premium version. The reason for this perplexing immaturity responsible Symantec: either the authors have published for testing or when the ransomware was launched by mistake.

Remove malware hand or a hard reset

Today, this application can be particularly annoying to the user. Because of its instability, the malware can cause crashes or Android can lock the smartphone. "Even in its current form, it is quite malicious to cause migraines in people who are infected," said Vikram Thakur. To remove this application, there are two options: either to connect the smartphone to the computer and remove the software manually, or do a hard reset to restore the device to factory settings.

Symantec estimates that the number of this type of fake antivirus is low compared to other malware. However, the publisher states that this application will progress because they are very lucrative for cybercriminals. "The numbers are not going to be as high as on the PC, but we expect that it becomes a major problem when people have been infected or know someone who was," admits Vikram Takhur. The Android platform is particularly targeted because the openness and diversity of application stores make it a prime target.