Android users need to be careful about many things on the web, especially if they have decided to root their devices to perform actions that the manufacturer doesn't allow by design. This precarious balance between freedom and security is constantly being attacked by unscrupulous elements seeking to steal all kinds of data, and one of the most recent examples is Lockerpin. What does this ransomware do in particular? Among other things, it changes the PIN number to prevent access to the device.
Last year, several security companies detected Simplocker, the first example of Android ransomware with the ability to encrypt personal files. Initial ransomware developments basically kept the window with ransom details in the foreground, regardless of what the user tried to do. However, a brief session with ADB could remove them at the root. As expected, malicious developers improved their techniques, leading to much more advanced ransomware variants capable of resisting specific cleaning methods. One of the most recent has been named Lockerpin.
In its latest versions, Lockerpin presents itself as an update for an app, but what it really does is hide a request that elevates privileges. Once installed, Lockerpin presents the user with a fake FBI warning demanding the payment of 500 dollars as a fine for possessing "prohibited" adult content on the device. At this point, the next step for the user is to eliminate the ransomware via safe mode or ADB session, although there is an extra detail: Lockerpin randomly changes the PIN number (or the unlock pattern) so that neither the attacker nor the user can access the device. The irony here is that if the device wasn't previously rooted, the only way to regain access is to perform a factory reset, which erases all stored information.
As if that weren't enough, Lockerpin has a defense mechanism that allows it to restore its elevated privileges if someone tries to remove them, and it also attacks known antivirus processes, such as Avast and Dr. Web. How is Lockerpin being distributed these days? The answer is simple: social engineering, and a fake app that promises free adult content. According to ESET statistics, 77 percent of infected users are in the United States, so the creator of Lockerpin knew exactly which region to target. If the infected device was rooted and USB Debugging is enabled, removing this last barrier of Lockerpin is a matter of minutes; otherwise... I think it's a good time to remember the value of backups.
