Cryptocurrency web mining: In union there is profit

guest · May 9, 2018

PoC Developed for CoinHive Mining In Excel Using Custom JavaScript Functions
May 8, 2018
https://www.bleepingcomputer.com/ne...g-in-excel-using-custom-javascript-functions/

Within days of Microsoft announcing that they are introducing custom JavaScript functions in Excel, a security researcher has developed a way to use this method to load the CoinHive in-browser JavaScript miner within Excel.
When we had reported about the new custom JS functions, it was quickly seen that no matter how useful this new feature may be, people felt it would also be utilized for more nefarious purposes.
Loading CoinHive in Excel
Before we go further, it is important to note that this is just a proof of concept and to even use custom functions in Excel, you first need to load it into Excel as an add-in. So in its current form, it is not a viable attack option at this time. With that said, attackers are crafty and when there is a will there is a way, so it would not be surprising to hear of an automated way to utilize this feature in the future.

When the custom JS equation is used, Excel will will create a hidden browser that loads the various files and then executes the custom JavaScript functions. After quickly researching how to do this, Dardaman was easily able make his own add-in that loaded CoinHive into this hidden browser.
As creating a custom JavaScript function was quick and easy to do , it will only be a matter of time before new attacks are developed. Dardaman agrees and could see researchers quickly finding new ways to exploit this feature.
Click to expand...

Minimalist · May 11, 2018

Malicious Traffic in Port 7001 Surges as Cryptominers Target Patched 2017 Oracle WebLogic Vulnerability

We observed a large spike in the number of devices scanning the internet for port 7001/TCP since April 27, 2018. Our analysis found that it’s increased activity was caused by cybercriminals engaging in cryptomining via exploiting CVE-2017-10271. The flaw is a patched Oracle WebLogic WLS-WSAT vulnerability that can allow remote attackers to execute arbitrary code on unpatched servers. This marks the second time attackers abused CVE-2017-10271 for cryptomining purposes this year. In February, the vulnerability was exploited to deliver 64-bit and 32-bit variants of an XMRig Monero miner.
Click to expand...

https://blog.trendmicro.com/trendla...t-patched-2017-oracle-weblogic-vulnerability/

guest · May 12, 2018

Bigger than Ransomware, CryptoJacking is the new money maker
While ransomware requires the participation of victims, cryptojacking can run almost undetected on users' systems.
May 11, 2018
https://www.itproportal.com/features/bigger-than-ransomware-cryptojacking-is-the-new-money-maker/

Cybercrime is an extremely lucrative business: a flourishing economy generating a staggering $1.5 trillion in revenues every year, according to a recent estimate. Perfect for cybercriminals, as this is maximum ROI for minimum effort and practically little risk of penalty.

In this scenario it comes as no surprise that cryptojacking, the unauthorized use of someone else’s computing resources to mine cryptocurrency, has replaced ransomware as the number one threat for consumers and enterprises.
Multiple Infection Mechanisms
All roads lead to a mine… The high pay-out ratio and the ubiquity of the attack surface aren’t the only advantages of cryptojacking. Since malicious miners can be injected in virtually any device, multiple infection vectors can be utilized accordingly: brute-force attacks, unpatched vulnerabilities, or compromised websites (drive-by cryptomining) are just few examples of the techniques showcased so far. Have a look at the timelines of cyberattacks that I collect on a monthly basis, and you will be surprised by the creativity of the attackers in continuously finding new ways to perpetrate cryptojacking attacks.
General Recommendations
There are few steps that can be done in order to mitigate the rising threat of cryptojacking. [...]
Click to expand...

guest · May 16, 2018

25% of companies affected by cloud cryptojacking
May 16, 2018
https://www.helpnetsecurity.com/2018/05/16/cloud-cryptojacking/

The mainstreaming of cryptojacking
RedLock previously uncovered hacker infiltrations of public cloud environments owned by Tesla, Aviva and Gemalto. It’s now apparent the practice of stealing cloud compute resources specifically to mine cryptocurrency has accelerated and there are signs that attackers are using advanced evasion techniques for this purpose.

“We understand why there might be fatigue with endless reports on IT infrastructures that lack adequate security, and there are signs that corporations are stepping up initiatives to minimize vulnerabilities, but there’s definitely more to do,” said Gaurav Kumar, CTO of RedLock. “Cloud computing environments bring tremendous flexibility and great economies of scale, but those advantages are meaningless without top-level security. This is a constant and shared responsibility.”
Click to expand...

itman · May 16, 2018

Adware Launches In-Browser Mining Sites Pretending to be Cloudflare

FileTour is an adware bundle that is commonly spread as cracks or cheats for games and other software. This bundle is notorious for crossing the line between what is traditionally known as adware and PUPs and more dangerous computer infections such as password-stealing Trojans and miners.

This adware bundle has started to create a Windows autorun that automatically launches Chrome and connects to a in-browser mining page when a user logs into Windows. To make matters worse, it does it in a way that makes it so Chrome is invisible to the user.
Click to expand...

https://www.bleepingcomputer.com/ne...ser-mining-sites-pretending-to-be-cloudflare/

Minimalist · May 17, 2018

New Cryptominer Distributes XMRig in Aggressive Attacks

Hackers behind cryptominer attacks are growing more aggressive and ruthless. Case and point, a cryptominer malware sample dubbed WinstarNssmMiner has been tracked in 500,000 attacks in the past three days, earning the crooks $28,000, according to researchers.

What makes the cryptominer so vicious is the fact that, post infection, if a victim’s AV software identifies WinstarNssmMiner and tries to remove it (or a user tries to disable it) the malware crashes the host system. WinstarNssmMiner targets Windows systems and leeches on to a system’s processor power with a trojanized version of the XMRig mining program.
Click to expand...

https://threatpost.com/new-cryptominer-distributes-xmrig-in-aggressive-attacks

guest · May 23, 2018

How a URL shortener allows malicious actors to hijack visitors’ CPU power
May 23, 2018
https://www.helpnetsecurity.com/2018/05/23/url-shortener-cryptojacking/

“If you have an URL you’d like to forward your users to, you can create a cnhv.co shortlink to it. The user has to solves a number of hashes (adjustable by you) and is automatically forwarded to the target URL afterwards,” Coinhive explains.

Unfortunately, the shortener has also become another way for scummy site owners and attackers who have compromised websites to mine cryptocurrency while the visitors are none the wiser about what’s happening to their computers.
Cryptomining through hidden URL shorteners
In general, the miner JavaScript is loaded only if the visitors clicks on the shortened URL/link. But malicious users have found a way for the mining to be triggered without user interaction.

“The miner script is not being directly loaded from your website but rather through the cnhv[.]co website. It adds what could be viewed as an additional layer of ambiguity and thereby helps it evade detection as some major anti-virus/information security companies do not have it listed as suspicious yet, though many will detect it once the main script coinhive.min.js is loaded,” Sucuri’s Luke Leal explains.
According to Leal, some of the sites using the trick appear to have been compromised, but others seem not to be – its owners are intentionally using the iFrame to stealth cryptomine from their visitors.
Click to expand...

guest · May 25, 2018

Is Cryptojacking Replacing Ransomware as the Next Big Threat?
May 24, 2018
https://www.securityweek.com/cryptojacking-replacing-ransomware-next-big-threat

Ransomware volume dropped in Q1 of 2018
But in spite of these continued developments threat researchers have begun to notice some recent shifts in the ransomware trend. One measure of the success of malware is the number of organizations it is able to impact.
In Q4 of 2017, for example, nine different malware varieties, including ransomware variants, had each managed to infect more than 10% of all organizations. This had been a trend for several quarters. Then suddenly, in Q1 of 2018 the number of threats that managed to crack the ‘1 in 10 organizations infected’ threshold dropped to three, and none of them were ransomware.
Cryptojacking affects more than 1 in 4 organizations
Cryptojacking malware grew from impacting 13% of all organizations in Q4 of 2017 to 28% of companies in Q1 of 2018, more than doubling its footprint.
Cryptojacking is a very different model
Cryptojackers have clearly discovered that, if done properly, leveraging the processing power of a hijacked system to mine for cryptocurrencies can be a potentially long-term profitable venture.
Click to expand...

guest · May 30, 2018

This website lets you earn cryptocurrency by picking World Cup winners
May 30, 2018
https://www.digitaltrends.com/outdoors/cryptocup-world-cup-blockchain/

A website called Cryptocup is hosting a bracket challenge of its own, with all entrants earning a digital token based 0n their picks for the outcome of the World Cup games. Those tokens are generated as part of the Ethereum blockchain, which means they will hold a certain value on cryptocurrency trading networks based on the current price of Ethereum itself. That value can — and likely will — fluctuate up and down throughout the month-long World Cup tournament.

While that tournament is taking place, the token will gain points based on the number of games that its owner has picked correctly.

The organizers of the Cryptocup tournament say that roughly 25 percent of the money collected will go toward paying the website’s overhead throughout the tournament.
Click to expand...

guest · Jun 8, 2018

Protecting your devices from cryptojacking
June 7, 2018
https://www.consumer.ftc.gov/blog/2018/06/protecting-your-devices-cryptojacking

Cryptojacking scams have continued to evolve, and they don’t even need you to install anything. Scammers can use malicious code embedded in a website or an ad to infect your device. Then they can help themselves to your device’s processor without you even knowing.

So what can you do? Try the following:
• Follow tried-and-true advice for avoiding malware: [...]
• Look for and close performance hogs: It can be hard to diagnose cryptojacking, but one common symptom is poor device performance.
• Consider playing defense: Some browser extensions and ad blockers say they help defend against cryptojacking, doing things like blocking mining code. [...]

If you think cryptojacking has happened to you, the Federal Trade Commission wants to know. Report it to www.ftc.gov/complaint.
Click to expand...

guest · Jun 11, 2018

CryptoCurrency Miner Plays Hide-and-seek with Popular Games and Tools
June 11, 2018
https://www.bleepingcomputer.com/ne...s-hide-and-seek-with-popular-games-and-tools/

When the CPU utilization on a computer is high [...] users will commonly open process manager utilities such as Task Manager, Process Explorer, or Process Hacker to determine if any processes are using too much of the CPU power.
Knowing this, the developer of this mining Trojan does something pretty clever; they terminate the miner when the processes for popular games or process managers are launched.
Miner plays hide-and-seek with popular games and utilities
When installed, a file called Iostream.exe will be created in C:\ProgramData and a scheduled task will be created called "WindowsRecoveryCleaner" to launch it using the command line: [...]
Once started, Iostream.exe will inject into the legitimate C:\Windows\system32\attrib.exe executable. Attrib is used to change certain attributes on a file and normally closes after completing. By injecting the miner into attrib.exe, though, the program will not close unless it is terminated.

The full list of monitored processes are: [...] Once a monitored process is terminated, the scheduled task will run the miner again within one minute. This allows the miner to terminate as needed and automatically start again when a blacklisted program is closed.
Click to expand...

hawki · Jun 12, 2018

"Crypto-mining Android malware is borking Amazon Fire TV devices

ADB.Miner threat slurps 100 per cent of the gadgets' processing power

CRYPTO-MINING ANDROID MALWARE is infecting Amazon Fire TV and Fire Stick devices and causing them to go to Borksville...

...a malware worm variant dubbed 'ADB.Miner', is installing itself on Amazon gadgets as an app called 'Test' under the package name 'com.google.time.time.'..."

https://www.theinquirer.net/inquire...oid-malware-is-borking-amazon-fire-tv-devices

Minimalist · Jun 12, 2018

Cryptojacking malware proves a big winner for web crooks

In theory, most users aren't going to think much about why their computer is suddenly working harder, so won't uncover how they've been infected with a cryptojacker.

However, it's big business: at least five percent of the Monero cryptocurrency in circulation has been mined via cryptojacking activity, the research claims, as criminals increasingly turn to the cryptocurrency mining as means of making illicit profit.
Click to expand...

https://www.zdnet.com/article/cryptojacking-malware-proves-a-big-winner-for-web-crooks/

guest · Jun 13, 2018

Cryptojacking invades cloud. How modern containerization trend is exploited by attackers
June 12, 2018
https://kromtech.com/blog/security-...tainerization-trend-is-exploited-by-attackers

Kromtech Security Center found 17 malicious docker images stored on Docker Hub for an entire year. Even after several complaints on GitHub and Twitter, research made by sysdig.com and fortinet.com, cybercriminals continued to enlarge their malware armory on Docker Hub. With more than 5 million pulls, the docker123321 registry is considered a springboard for cryptomining containers

Containers are a way of packaging software. You can think of running a container like running a virtual machine, without the overhead of spinning up an entire operating system.
Docker helps you create and deploy software within containers. With Docker, you create a special file called a Dockerfile. Dockerfiles define a build process, which, when fed to the ‘docker build’ command, will produce an immutable docker image
Conclusions
For ordinary users, just pulling a Docker image from the DockerHub is like pulling arbitrary binary data from somewhere, executing it, and hoping for the best without really knowing what’s in it.
Click to expand...

itman · Jun 13, 2018

Crypto-Mining Malware Tops Charts, Targets Apps

For organizations that were hoping to see a decline in malware threats, there is no sign that crypto-mining malware will be going away anytime soon. In fact, crypto-mining malware continues to dominate among hackers while also sneaking its way into more mobile apps.

According to Check Point’s most recent Global Threat Index, the Coinhive crypto-miner impacted 22% of organizations in May 2018, reflecting an increase of nearly 50% during the month.

“May 2018 marked the fifth consecutive month where crypto-mining malware dominated Check Point’s Top Ten Most Wanted Malware Index. Coinhive retained the top spot as the most prevalent malware as another crypto-mining malware, Cryptoloot, ranked second with a global reach of 11%,” Check Point wrote.

Cyber-crooks around the world are reportedly leveraging unpatched server vulnerabilities in Microsoft Windows Server and Oracle Web Logic in order to mine crypto-currency. The research also found that despite these patches being available for at least six months, organizations continue to be vulnerable.
Click to expand...

https://www.infosecurity-magazine.com/news/cryptomining-malware-tops-charts/

guest · Jun 15, 2018

Syscoin Developers Github Account Compromised
June 15, 2018
https://cryptovest.com/news/syscoin-developers-github-account-compromised/

Syscoin has released a security notice to their community today, advising them that a malicious copy of the Syscoin 3.0.4.1 Windows based installer has been made available by a compromised Syscoin developer account.

The notice explains that on Wednesday, the Blockchain Foundry received a series of user reports that the latest Syscoin core 3.0.4 windows installer was triggering Windows Defender, AVG and Kaspersky anti-virus software, stating that the setup was from an “unknown publisher”.
[...] Windows Syscoin installer had been modified and released on the Syscoin Github page, containing trojan malware.

Further preventative measure have also been assured by the Syscoin and Blockchain Foundry team to stop a breach like this happening again, including mandatory use of 2FA authentication on all developer accounts and ‘routine verifications of signature hashes’.
Click to expand...

guest · Jun 20, 2018

Internet Cafes Hacked to Mine $800k in Siacoin Cryptocurrency
June 19, 2018
https://www.coindesk.com/internet-cafes-hacked-to-mine-800000-in-siacoin-cryptocurrency/

A group of hackers has allegedly colluded with computer maintenance firms in China to hack into computers owned by internet cafes to mine cryptocurrency.

The report said the hackers first developed a piece of malware that can specifically mine the siacoin cryptocurrency on an affected device, then marketed it to computer maintenance firms who allegedly helped to inject the malware to computers at internet cafes whilst carrying out routine checkups.

Notably, it was also at a time when the price of siacoin jumped by 400 percent from $0.002 in May to over $0.01 in July, data from CoinMarketCap shows.

Currently, the investigation is still ongoing, since the malware has now spread across more than 30 cities in China, with over 100 computer maintenance firms in the country being allegedly involved.
Click to expand...

guest · Jun 21, 2018

No-Coin for Kodi: Cryptojacking Detection and Prevention for Kodi Addons
June 20, 2018
https://www.tvaddons.co/no-coin-kodi/

[...] we have pushed an update to our Indigo tool which includes an anti-cryptojacking scanner, meant to prevent this ever increasing security hazard from victimizing our users in the future.

We based our anti-cryptojacking scanner on a popular web browser plugin known as No-Coin. This script will scan your entire Kodi folder, as well as compressed files, for anything that has been identified as a known cryptojacking domain by the No-Coin community.
For now the script requiries user intervention, meaning it will not run on its own, nor will it delete or disable anything without the user’s explicit orders. Anyone who has our Indigo tool and updated repository installed will automatically be able to take advantage of this new function.

We are already working on improving and automating the detection of cryptojacking and other malicious scripts. For almost a decade, TV ADDONS has done as that is possible in order to protect the unofficial Kodi addon community from bad actors.
Click to expand...

guest · Jun 28, 2018

How polite: Fun-bucks coin miners graciously ease off CPU pounding
Conniving crypto creeps caught covertly concealing coin-crafting computer crime code
June 29, 2018
https://www.theregister.co.uk/2018/06/29/coin_miners_cpu_throttling/

Cryptocurrency-mining malware writers are dialing back their use of your compute cycles in order to avoid detection.

This is according to Johannes Ullrich, head of research at SANS, who today pointed out that malicious mining apps are scaling down activity and employing built-in encryption to make them harder for antivirus packages to detect.
"They also take better advantage of some newer CPU features like AES support."

This particular coin-mining malware, however, is noteworthy for its limits on CPU activity, restraining itself to only access half of the threads available on the host processors.
Click to expand...

Minimalist · Jul 5, 2018

Crooks leverage obfuscated Coinhive shortlink in a large crypto-mining operation

Crooks leverage an alternative scheme to mine cryptocurrencies, they don’t inject the CoinHive JavaScript miner directly into compromised websites.
Click to expand...

https://securityaffairs.co/wordpress/74177/cyber-crime/coinhive-mining-campaign.html

Minimalist · Jul 6, 2018

The Pirate Bay is plundering your CPU for cryptocash, again

Popular file sharing site The Pirate Bay seems to have returned to its old tricks again by mining cryptocurrency in visitors’ browsers without telling them.
Click to expand...

https://nakedsecurity.sophos.com/20...-is-plundering-your-cpu-for-cryptocash-again/

guest · Jul 13, 2018

42% of organizations globally hit by cryptomining attacks
July 13, 2018
https://www.helpnetsecurity.com/2018/07/13/global-cryptomining-attacks/

Cybercriminals are aggressively targeting organizations using cryptomining malware to develop illegal revenue streams, according to Check Point. Meanwhile, cloud infrastructures appear to be the growing target among threat actors.

Between January and June 2018, the number of organizations impacted by cryptomining malware doubled to 42%, compared to 20.5% in the second half of 2017.

“The first half of this year saw criminals continue the trend we observed at the end of 2017, and take full advantage of stealthy cryptomining malware to maximize their revenues. We’ve also seen increasingly sophisticated attacks against cloud infrastructures and multi-platform environments emerging. [...]" said Maya Horowitz, Threat Intelligence Group Manager at Check Point.

In 2018, cryptominers have been upgraded with vastly improved capabilities, becoming more sophisticated and even destructive.
Click to expand...

guest · Jul 31, 2018

Steam game Abstractism accused of cryptojacking players' PCs
Valve has now pulled it from the store
July 30, 2018
https://www.techspot.com/news/75725-steam-game-abstractism-accused-cryptojacking-players-pcs.html

Several people are alleging that a game on the Steam Store secretly turns your PC into a cryptominer for its developer. It is a cheap ($0.99) shovelware title called Abstractism.

Upon installation, several antivirus suites are flagging two files in the game. The first file (abstractismlauncher.exe) is pegged as malware and the second (steamservice.exe) is listed as containing the Win32/Zpevdo.A trojan. Users report high resource usage while playing the game.

The developers claim that the two files in question are launchers. They claim the reason antivirus is being triggered is that Abstractism is built on the Clickteam Fusion 2.5 engine which is apparently unsigned and unoptimized. However, that does not explain why the admittedly "minimalistic" game requires so many resources.

Okalo Union is also being accused of designing the game's rewards around long gameplay sessions to keep the miners running. [...] SidAlpha believes the devs are encouraging long playtimes so they can have their miners running "24/7."
Click to expand...

guest · Aug 1, 2018

How Cryptojacking Can Corrupt the Internet of Things
IoT devices often have weak security, making them prime targets for criminals looking to score digital cash
July 31, 2018
https://www.scientificamerican.com/article/how-cryptojacking-can-corrupt-the-internet-of-things/

Cyber criminals steal that power by sneaking malicious software containing cryptomining code onto PCs, smartphones and other internet-connected devices that, once infected, divert some of their processors’ capacity into solving the aforementioned calculations.

The latest trend is for criminals to infect appliances and other internet-connected devices with unwanted cryptomining software, Sherri Davidoff, CEO of cyber security firm LMG Security, said during a recent IoT cryptojacking webinar. “Many of these devices are unmonitored and highly vulnerable to simple attacks that exploit weak passwords and unpatched vulnerabilities,” Davidoff said.

“For financially-motivated cybercriminals, cryptojacking a large number of inadequately protected IoT devices could be highly lucrative,” [...] In addition to degrading battery life, cryptojacking can strain or possibly burn out a device’s processor.

People can protect their devices primarily by keeping their operating systems and software up to date, Bajpai says.
Click to expand...

guest · Aug 14, 2018

Browser mining is generating over $250K worth of cryptocurrency every month
Most of the profits go to less than a dozen people
August 14, 2018
https://thenextweb.com/hardfork/2018/08/14/coinhive-mining-monero-profits/

New academic research has discovered that embedded cryptocurrecy miner CoinHive is generating $250,000 worth of Monero every month – most of it going to just 10 individuals.

The research, released by RWTH Aachen University in Germany, provides an extensive overview of browser-mining activity across the internet. Among other things, it reveals that Monero accounts for 75 percent of all browser-based cryptocurrency mining.

Through an extensive scrape of the CoinHive’s link database, they found almost two million active short links currently forcing Monero mining. Most link to video streams or dodgy filesharing sites, indicating just how sneaky crypto-jackers can be.

Oh – and the research found that “most crypto miners are present on adult websites,” so no matter what, it’s probably best to quickly protect yourself against crypto-jacking.
Click to expand...

research: https://arxiv.org/pdf/1808.00811.pdf

Log in or Sign up

Cryptocurrency web mining: In union there is profit

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

itman Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

Minimalist Registered Member

guest Guest

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Cryptocurrency web mining: In union there is profit

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

itman Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

Minimalist Registered Member

guest Guest

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches