{"id":78,"date":"2014-01-24T00:19:30","date_gmt":"2014-01-24T00:19:30","guid":{"rendered":"http:\/\/www.lapsedordinary.net\/?p=78"},"modified":"2014-01-24T00:19:30","modified_gmt":"2014-01-24T00:19:30","slug":"browser-based-ransomware","status":"publish","type":"post","link":"http:\/\/lapsed.ordinary\/2014\/01\/24\/browser-based-ransomware\/","title":{"rendered":"Browser-based ransomware"},"content":{"rendered":"

Tonight I stumbled upon some browser-based ransonmware, that pretends to be a message from the police. This is neither very advanced (it isn’t anything like Cryptolocker<\/a>), nor is it very new. It doesn’t install any malware on your machine (though this trick has been used by actual malware, such as ‘Urausy’). All it does is tell you that “your browser has been blocked up for safety reasons”, and that to prevent going to jail for anything between 5 and 11 years (for watching something very illegal), you need to pay a fine. Because of course, that is how the legal system works.
\n

\"policeransomware\"<\/a><\/center>
\nI’ll do a more detailed write-up about this later. I thought it was interesting that it was spreading via Twitter<\/i> and used some subdomains to domains hosted at a UK-based registrar, whose customers probably had their DNS hacked.
\nOne thing that is typical for this kind of scam is that based on where you access the website from, you get the message in the local language and the logo of the national police force. They typically include a photo of the head of state as well. Because that makes it a lot more real.
\nAnd since this isn’t a very advanced scam, I could grab the various logos that are used. I had seen most of these before, but I don’t know if they had ever been shown on a single site. Now they have. (Actually, just before posting I noticed these are the same images used by Urausy last summer; Kafeine<\/a> has all those images. Oh well.)
\nAustria
\n
\"AT\"<\/a><\/center>
\nAustralia
\n
\"AU\"<\/a><\/center>
\nBelgium
\n
\"BE\"<\/a><\/center>
\nBolivia
\n
\"BO\"<\/a><\/center>
\nCanada
\n
\"CA\"<\/a><\/center>
\nCyprus
\n
\"CY\"<\/a><\/center>
\nCzech Republic
\n
\"CZ\"<\/a><\/center>
\nGermany
\n
\"DE\"<\/a><\/center>
\nEcuador
\n
\"EC\"<\/a><\/center>
\nFinland
\n
\"FI\"<\/a><\/center>
\nFrance
\n
\"FR\"<\/a><\/center>
\nGreece
\n
\"GR\"<\/a><\/center>
\nHungary
\n
\"HU\"<\/a><\/center>
\nIreland
\n
\"IE\"<\/a><\/center>
\nItaly
\n
\"IT\"<\/a><\/center>
\nLatvia
\n
\"LV\"<\/a><\/center>
\nMexico
\n
\"MX\"<\/a><\/center>
\nNetherlands
\n
\"NL\"<\/a><\/center>
\nNew Zealand
\n
\"NZ\"<\/a><\/center>
\nNorway
\n
\"NO\"<\/a><\/center>
\nPoland
\n
\"PL\"<\/a><\/center>
\nPortugal
\n
\"PT\"<\/a><\/center>
\nRomania
\n
\"RO\"<\/a><\/center>
\nSlovakia
\n
\"SK\"<\/a><\/center>
\nSlovenia
\n
\"SI\"<\/a><\/center>
\nSpain
\n
\"ES\"<\/a><\/center>
\nSweden
\n
\"SE\"<\/a><\/center>
\nSwitzerland
\n
\"CH\"<\/a><\/center>
\nTurkey
\n
\"TR\"<\/a><\/center>
\nUnited Kingdom
\n
\"GB\"<\/a><\/center>
\nUnited States
\n
\"US\"<\/a><\/center><\/p>\n","protected":false},"excerpt":{"rendered":"

Tonight I stumbled upon some browser-based ransonmware, that pretends to be a message from the police. This is neither very advanced (it isn’t anything like Cryptolocker), nor is it very new. It doesn’t install any malware on your machine (though this trick has been used by actual malware, such as ‘Urausy’). All it does is […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[54,120,123],"_links":{"self":[{"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/posts\/78"}],"collection":[{"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/comments?post=78"}],"version-history":[{"count":0,"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/posts\/78\/revisions"}],"wp:attachment":[{"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/media?parent=78"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/categories?post=78"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/lapsed.ordinary\/wp-json\/wp\/v2\/tags?post=78"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}