Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Bitcoin Thefts Surge, DDoS Hackers Take Millions

Cryptographic currency's massive rise in value leads to a corresponding increase in online heists by criminals seeking easy paydays.

10 IT Job Titles We Miss
10 IT Job Titles We Miss
(Click image for larger view.)

Say you've created a cryptographic currency called bitcoin that promises users relative anonymity and untraceable transactions. What could possibly go wrong? The answer, of course, is that these virtues also appeal to hackers, malware developers, and organized crime rings who wouldn't think twice about committing virtual bank robberies.

Earlier this month, for example, Bitcoin Internet Payment System (BIPS), a Denmark-based Bitcoin payment processor, suffered a denial-of-service (DDoS) attack. Unfortunately for users of the company's free online wallets for storing bitcoins, the DDoS attack was merely a smokescreen for a digital heist that quickly drained numerous wallets, netting the attackers a reported 1,295 bitcoins -- worth nearly $1 million -- and leaving wallet users with little chance that they'd ever see their money again.

"On November 15th BIPS was the target of a massive DDoS attack, which is now believed to have been the initial preparation for a subsequent attack on November 17th," Kris Henriksen, the CEO of BIPS, said via Reddit. "Regrettably, despite several layers of protection, the attack caused vulnerability to the system, which has then enabled the attacker/s to gain access and compromise several wallets."

BIPS has been conducting a digital forensic investigation and working with authorities to try to identify the perpetrators. It said that early results showed that the attack originated "from Russia and neighboring countries."

The BIPS heist followed two separate October attacks against Australia-based Inputs.io, in which attackers netted about $1.3 million in bitcoins after stealing all 4,100 bitcoins being held by the free e-wallet service.

[Criminals are taking shelter under bitcoins. See Dutch Banking Malware Gang Busted: Bitcoin's Role.]

The value of bitcoins continues to fluctuate wildly due to a bubble created by bitcoin speculators. In 2011, for example, the currency's value fell from $33 to just $1 per bitcoin before rising to more than $900 earlier this month on MtGox, the world's biggest bitcoin exchange. But that bubble burst the next day, when the value of bitcoins fell by half. As of early Wednesday, however, the currency's value had once again skyrocketed, trading at more than $980 on MtGox.

That rise in value has driven hackers to attack online wallet services that store bitcoins. "Each of these companies had been operating officially for only a few months, yet already had entrusted to them millions of dollars that are now in the hands of cybercrooks," Paul Ducklin, head of technology for Sophos in the Asia Pacific region, said Tuesday in a blog post.

Malware writers have also taken a keen interest in bitcoins, with some -- especially Russian gangs -- modifying their crimeware tools to identify and steal any bitcoins found on infected PCs. "There are numerous malware families today that either perform Bitcoin mining or directly steal the contents of victims' Bitcoin wallets, or both," according to a blog post from Robert Lipovsky, a researcher at security firm ESET.

(Source: zcopley)
(Source: zcopley)

Other malware attacks have started closer to home. Last week, for example, the New Jersey state attorney general's office announced that it had settled a complaint it filed against Commack, N.Y.-based online gaming company E-Sports, as well company co-founder Eric Thunberg and software engineer Sean Hunczak. According to the complaint, Hunczak designed malware that infected about 14,000 computers that subscribed to the company's service, and which mined their PCs for bitcoins, which the perpetrators then sold for about $3,500. Under the terms of the state's $1 million settlement agreement, the company will pay a fine of $325,000, but the rest will be vacated, providing the company complies with a 10-year compliance program.

But not all bitcoin heists have been executed via hack attacks or malware. For example, a China-based bitcoin exchange called GBL launched in May. Almost 1,000 people used the service to deposit bitcoins worth about $4.1 million. But the exchange was revealed to be an elaborate scam after whoever launched the site shut it down on October 26 and absconded with the funds.

Given the potential spoils from a successful online heist, it's not surprising that related attacks are becoming more common. "Please be advised that attacks are not isolated to us and if you are storing larger amounts of coins with any third party you may want to find alternative storage solutions as soon as possible, preferably cold storage if you do not need immediate access to those coins," said Henriksen.

Bitcoin users have echoed that suggestion. "One note of warning: don't trust any online wallet," read a comment on a recent Guardian feature. "The two biggest ones have already been robbed. Use your own wallet on your own computer and back it up on a USB stick."

"Remember, you don't have to keep your Bitcoins online with someone else: you can store your Bitcoins yourself, encrypted and offline," said Ducklin at Sophos.

Knowing your enemy is the first step in guarding against him. In this Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, we examine the world of cybercriminals -- including their motives, resources and processes -- and recommend what enterprises should do to keep their data and computing systems safe in the face of an ever-growing and ever-more-sophisticated threat. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
<<   <   Page 3 / 3
Lorna Garey
100%
0%
Lorna Garey,
User Rank: Ninja
12/2/2013 | 11:22:07 AM
Old advice applies
My dad always told me to buy low and sell high. Seems like BitCoins are akin to junk bonds -- maybe worth buying low at $3 for the novelty, see if they appreciate. But that's not the basis for long-term success as a currency.
KashfiyaRafa
50%
50%
KashfiyaRafa,
User Rank: Apprentice
12/22/2013 | 9:15:55 AM
Myriad Development of Bitcoin Platform CryptoCafe.com

Hi,

Bitcoin going to save the global economy, Bitcoins are digital coins transferred from person to person, without using a bank or centralized service. 

Bitcoin is not a system of claims. Bitcoin is a pseudo-commodity, not a claim. People who purchase Bitcoins do not have a claim on anybody, nor does anybody have a claim on them. The biggest difference between bitcoin and other virtual currencies is that bitcoins are the only one which have speculative value. 


CryptoCafe is going to be big in the world of Bitcoin, be sure to sign up for the big  release announcement. The website is owned by a public company called Myriad Interactive, the stock symbol is MYRY and its predicted to be very big!

 

Myriad Interactive Media Begins Development of Bitcoin Platform CryptoCafe.com

Thanks :)

infinitnet
50%
50%
infinitnet,
User Rank: Apprentice
1/3/2014 | 10:51:16 AM
Bitcoin Pools/Exchangers DDoS Protection
The size and amount of DDoS attacks is constantly growing, especially when it comes to Bitcoin - be it Exchangers, Mining Pools, Forums or anything really. Especially Bitcoin mining pools are targeted by DDoS attacks lately and if you operate one, you should always consider to keep it DDoS protected from the beginning, to avoid your miners leaving as soon as a DDoS attack hits.
<<   <   Page 3 / 3
Tor Weaponized to Steal Bitcoin
Dark Reading Staff 10/18/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-9501
PUBLISHED: 2019-10-22
The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.
CVE-2019-16971
PUBLISHED: 2019-10-22
In FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized &quot;contact_uuid&quot; variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS.
CVE-2019-16972
PUBLISHED: 2019-10-22
In FusionPBX up to 4.5.7, the file app\contacts\contact_addresses.php uses an unsanitized &quot;id&quot; variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2019-16973
PUBLISHED: 2019-10-22
In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized &quot;query_string&quot; variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2015-9496
PUBLISHED: 2019-10-22
The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.