Johannesburg, 23 May 2018
Cyber crime is an extremely lucrative business: a flourishing economy generating a staggering $1.5 trillion in revenue every year, according to a recent estimate. Perfect for cyber criminals, as this is maximum ROI for minimum effort and practically little risk of penalty.
In this scenario, it comes as no surprise that crypto-jacking, the unauthorised use of someone else's computing resources to mine crypto-currency, has replaced ransomware as the number one threat for consumers and enterprises.
The fluctuations of the Bitcoin value, a problem for the business model of ransomware that relies on quick and repeated attacks characterised by small payments, along with the research of new attack techniques able to provide a better payout ratio, have rapidly pushed crypto-jacking to the top of the infosecurity issues in 2018.
Let's look more in detail at the factors that have driven this shift.
Higher payout ratio
United they mine... With a crypto-currency market cap of nearly $500 billion, crypto-jacking is extremely attractive for cyber criminals: it does not require high technical skills and, unlike ransomware, offers a potential 100% payout ratio.
Once compromised, the infected machine can start immediately to mine crypto-currency in stealth mode, regardless of its processing power or geographical location: even low-end systems are useful to the cause since it's the size of the network of compromised machines, and hence the total computational power that really matters. Additionally, if the attackers don't get carried away and tune the miner not to completely drain the CPU (up to the point of bricking your Android device), the attack can go on stealthily and undetected for a long time.
Ubiquity of the attack surface
One rig to mine them all... Ubiquity of the attack surface is another important aspect. Whatever you are, wherever you are, you can mine. It doesn't matter if the malicious miner component is injected into a mobile device, a personal computer, a server, an instance in the cloud, or even an IOT device, like a camera, a fridge, a fan. It doesn't even matter what operating system is being used. With any OS, the attackers can take advantage of its CPU cycles for their illegitimate purposes. Even IOT devices with limited processing power can be recruited: the Mirai botnet has taught us what multiple IOT devices can do when working together, thousands at a time.
And it's not a coincidence that a variant has been repurposed to mine crypto-currency, and the same botnet has also spawned Satori, a variant infecting mining rigs, hijacking the device owner's mining credentials. In fact, hacking multiple IOT devices can be rewarding: according to a recent estimate, 15 000 hacked Internet-connected gadgets can mine $1 000 of crypto-currency in just four days. Not bad, considering that by 2020, there will be over 20 billion Internet-connected devices.
Multiple infection mechanisms
All roads lead to a mine... The high payout ratio and the ubiquity of the attack surface aren't the only advantages of crypto-jacking. Since malicious miners can be injected in virtually any device, multiple infection vectors can be utilised accordingly: brute-force attacks, unpatched vulnerabilities, or compromised Web sites (drive-by crypto-mining) are just few examples of the techniques showcased so far. Have a look at the timelines of cyber attacks that I collect on a monthly basis, and you will be surprised by the creativity of the attackers in continuously finding new ways to perpetrate crypto-jacking attacks.
Servers have been compromised in multiple ways to inject miners: from old-school brute-force attacks with default credentials (the case of a recent campaign targeting thousands of Magento sites), to the exploitation of unpatched vulnerabilities such as, just to name a few, Oracle WebLogic (CVE 2017-10271), Apache Struts (CVE-2017-5638), DotNetNuke (CVE-2017-9822), OrientDB (CVE-2017-11467), Jenkins CI (CVE-2017-1000353), JBoss servers (CVE-2017-12149), and Apache Solr (CVE-2017-12629).
Unpatched vulnerabilities have also been used to compromise clients, making new slaves for the crypto-miner botnets. The Smomirnu botnet and Wannamine malware are two examples of threats exploiting the infamous EternalBlue vulnerability (CVE-2017-144) to spread. Even existing malware can be rewritten to mine crypto-currency, or to add this "feature" to the existing ones.
In reality, clients are even more exposed since they can mine crypto-currency simply visiting a Web page hosting a JavaScript miner like Coinhive. Coinhive mines a crypto-currency called Monero (XMR) and the main reason is that, besides being able to stay anonymous with this blockchain, the algorithm used to calculate the hashes, called Cryptonight, was designed to run well on consumer CPUs (what a coincidence).
An opportunity too tempting (and easy) not to be exploited by criminals, who are now constantly scanning Web sites for vulnerabilities that allow them to inject Coinhive: the Los Angeles Times, and Blackberry Mobile are two noticeable examples of high-profile Web sites compromised for this purpose in 2018. Not to mention the fact the discretional opt-in controls available with Coinhive that were never respected in such cases.
But, this is only the tip of the iceberg, since drive-by crypto-mining campaigns are becoming bigger, more prevalent and more persistent while you browse the Internet. Criminals are now adopting a modus operandi similar to malvertising (minevertising), injecting the Coinhive code into advertisements supplied by platforms like AOL or Google DoubleClick (two examples occurred in 2018). It doesn't even matter if the user leaves the compromised page or closes his browser (or at least he believes to) since the malicious code can be hidden into a tiny 'pop-under' window hidden behind the Windows taskbar, making it persistent and invisible to the user. There have also been cases of malicious browser extensions injecting Coinhive directly into the browser.
Role of cloud
The sun always mines above the cloud... The list of the five most new dangerous attacks presented by the SANS Institute at the last RSA Conference includes both cloud storage data leakage and monetisation of compromised systems via crypto-miners. Data leakage in the cloud is often the consequence of misconfigurations like wrong permissions or lack of an adequate password protection. Besides stealing data, the same misconfigurations can be used by crooks to spin-up their own instances and use them to mine crypto-currency at the expense of the victim, with the concrete possibility that the latter will not detect the attack until the next bill. A deadly combination of the two attack techniques listed by the SANS Institute has already hit some high-profile victims like Tesla, whose public cloud was used to mine crypto-currency.
There are also some additional risks. Miners can use known cloud services to spread more quickly inside organisations (Netskope Threat Research Labs discovered a Coinhive miner resident in a Microsoft Office 365 OneDrive for Business instance), or also to evade detection (like in case of Zminer that downloads payloads from Amazon S3 cloud storage).
General recommendations
There are few steps that can be done in order to mitigate the rising threat of crypto-jacking:
* Govern Web use with a multi-layered threat protection platform like Netskope for Web, able to unify SaaS, IaaS, and Web security from a single pane of glass.
* Detect and remediate crypto-miners in the cloud, using a threat-aware CASB solution like Netskope: enforce policy on usage of unsanctioned services, as well as unsanctioned instances of sanctioned cloud services to block hybrid multi-stage attacks where the payload is downloaded from a cloud service.
Sample policies to enforce:
* Scan all uploads from unmanaged devices to sanctioned cloud applications for malware.
* Scan all uploads from remote devices to sanctioned cloud applications for malware.
* Scan all downloads from unsanctioned cloud applications for malware.
* Scan all downloads from unsanctioned instances of sanctioned cloud applications for malware.
* Enforce quarantine/block actions on malware detection to reduce user impact.
* Block unsanctioned instances of sanctioned/well known cloud apps, to prevent attackers from exploiting user trust in cloud. While this seems a little restrictive, it significantly reduces the risk of malware infiltration attempts via cloud.
* Deploy a CASB solution able to perform continuous security assessment and monitoring of your IaaS and PaaS configuration. This includes infrastructure misconfigurations and vulnerabilities that can lead to potential compromise and subsequent installation of crypto-miners, or set-up of malicious instances aimed to mine crypto-currency.
* Obviously, make sure an effective patch management process for clients and servers are in place.
* Ensure the corporate anti-virus is updated with the latest releases and patches.
Encourage a responsible usage of the company resources:
* Warn users to avoid executing unsigned macros and macros from an untrusted source, unless they are very sure they are benign.
* Warn users to avoid executing any files unless they are very sure they are benign.
* Warn users against opening untrusted attachments, regardless of their extensions or file names.
* Ad-blockers or browser extensions like NoScript can help to prevent drive-by crypto-mining attacks. Recently, some specific browser extensions have been published, which can block JavaScript miners like Coinhive. However, be careful to install only trusted ones, since rogue browser extensions are also a common mechanism to inject crypto-miners directly into the browser.
* Administrators can create firewall rules to block Bitcoin pools documented in the Wikipedia article.
Share