Attacks/Breaches

3/22/2018
04:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Criminals Using Web Injects to Steal Cryptocurrency

Man-in-the-browser attacks targeting Blockchain.info and Coinbase websites, SecurityScorecard says.

Criminals have deployed a variety of tactics in recent months to try and profit from the cryptocurrency boom.

One of them is the use of Web injects to intercept and modify traffic between user browsers and cryptocurrency sites in order to steal coins from victims and transfer it to accounts held by criminals.

Third-party risk management firm SecurityScorecard says it has seen recent evidence of threat actors using Web injects to target cryptocurrency exchange Coinbase and Bitcoin wallet Blockchain.info. Tens of thousands of bots can run the Web injects to steal cryptocurrency, making them a potent threat for investors and exchanges, according to SecurityScorecard.

A Web inject is basically code for injecting malicious content into a Web page before the page is rendered on a user's browser. This work by intercepting and modifying traffic between a Web server and user browser in such a manner that the victim typically does not notice anything amiss.

Web injects can be used to add or delete content on the Web pages that a victim sees. For instance, a Web inject can be used to add a field in the login screen for capturing the PIN a user might use to access his or her bank account, or it can be used to delete warnings that a user might normally see when viewing a particular Web page. Web injects typically have been used to steal credentials for accessing bank accounts, but recently have begun to play a role in cryptocurrency heists as well.

Bot masters can readily buy the Web injects for Coinbase and Blockchain.info and distribute them to infected computers in a botnet, says Doina Cosovan, malware researcher at SecurityScorecard. The malware installed on those infected computers receive the Web injects and inject them in the Coinbase and Blockchain.info websites if a user happens to visit either site.

These Web injects are provided as a service, so different malware families can use them. Cosovan says. "We noticed Zeus and Ramnit in particular, but these are simply examples we observed. Any other bot master controlling bots infected with a malware family which has capabilities to inject code in websites can buy and use these Web injects on their bots," she notes.

The Web inject for Coinbase that SecurityScorecard discovered is designed to change the settings on a victim's account in order to enable digital coin transfers without requiring the user's confirmation. When a user tries to log in to his or her Coinbase account, the injected JavaScript content first disables the "Enter" key for the email and password fields so the user has to actually click on the "Submit" button in order to submit the form, according to SecurityScorecard.

It also creates a new button that has mostly the same attributes as the original button, and a few additional malicious ones. It then adds the rogue "Submit" button on top of the original sign-in button so that the victim clicks on the malicious button rather than the original. The ultimate goal is to capture the victim's multifactor authentication information and then using it to change account settings so further transactions can be carried out without requiring the user's approval.

"Once this change is made, the injected content can start making transactions without the need to authorize them with [two-factor authentication]," Cosovan says. "Even more, the user's access to the settings is blocked, so that he can't enable the two-factor authentication for transactions," she adds.

The Blockchain.info Web inject has somewhat similar functionality but in this case is designed to steal from a user's Bitcoin wallet and transfer the digital currency to accounts held by threat actors. As a final touch, the Web inject presents the user with a "Service Unavailable" notice after stealing the cryptocurrency, thereby delaying the victim's ability to detect the theft, SecurityScorecard said.

The use of Web injects in cryptocurrency theft is one of many tactics that cybercriminals are employing to profit from the surging interest in Bitcoin, Monero, and other cryptocurrencies worldwide. Even as defenders have adapted their tactics to deal with threats, criminals have come up with new ways around them.

The latest, reported by security vendor Minerva this week, is a campaign it has dubbed GhostMiner, which involves the use of fileless crypto-mining malware. According to Minerva, the operators of the campaign are using PowerShell frameworks to conceal the presence of crypto-mining software on infected systems.

According to the company, the tactics employed in the campaign have been extremely effective at bypassing anti-malware tools. Some of the payloads being used in the campaign were completely undetected by products from all major security vendors, Minerva said.

Related content:

 

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry's most knowledgeable IT security experts. Check out the Interop ITX 2018 agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Lessons from My Strange Journey into InfoSec
Lysa Myers, Security Researcher, ESET,  7/12/2018
What's Cooking With Caleb Sima
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-9574
PUBLISHED: 2018-07-19
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVE-2017-2673
PUBLISHED: 2018-07-19
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
CVE-2017-7481
PUBLISHED: 2018-07-19
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templati...
CVE-2018-12911
PUBLISHED: 2018-07-19
WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and ThirdParty/xdgmime/src/xdgmimeglob.c.
CVE-2018-14404
PUBLISHED: 2018-07-19
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulne...