Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/26/2014
07:09 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

More Than 100 Flavors Of Malware Are Stealing Bitcoins

Specialized form of malware empties electronic wallets of digital currency, and antivirus often misses it

RSA CONFERENCE 2014 -- San Francisco -- For just $35, you can buy a popular, specialized malware tool that steals Bitcoins and other such electronic currency -- and researchers have unearthed more than 100 different malware families that specialize in this form of theft.

RSA Conference 2014
Click here for more articles about the RSA Conference.

Dell SecureWorks researchers Joe Stewart and Pat Litke discovered 80 of those cryptocurrency-stealing malware families in just the past year as thieves clamor to cash in on the growing use of digital currency. Some of the malware variants are custom, while others are cranked out via malware-generator tools, but, either way, the average rate of detection across all antivirus tools is just below 50 percent, the researchers said here this week.

"[Bitcoins and digital currency] are very easy to steal," says Joe Stewart, director of malware research for SecureWorks. While some sophisticated hackers are stealing the currency, many of the thieves are novice "script kiddies" who get the cheap tools to snatch the currency from unsuspecting victims.

"In my opinion, most of them are individual actors. I don't know if you'd want a group of people doing it" due to the challenge of splitting the ruins, he says. "There's definitely big overhead in trying to launder money from credit cards and bank accounts, but there's [no overhead] in Bitcoins, so there's no risk," he says. "And there's been no single case of law enforcement with someone who stole a Bitcoin."

If banks eventually adopt Bitcoin, then law enforcement would be motivated to pursue investigations into cryptocurrency theft. These thefts are happening around the glob, according to SecureWorks, including in the U.S. and Europe.

Bitcoins and other forms of cryptocurrency are getting pilfered via wallet-stealing malware and credential-stealing malware, as well as via man-in-the browser attacks and phony currency with embedded wallet-stealing malware, Stewart and Litke found.

PredatorPain is the most pervasive flavor of this malware. It's a credential- and file-stealing Trojan that was first released in 2009, and goes for about $35 in the hacker underground. Another malware family called SovietMiner steals wallet files and forces the victim's machine to mine alternative coins for the bad guys' profit. This malware goes for about $15 per month.

Stewart says it's difficult to get a handle on the total losses being suffered by cryptocurrency owners, but he saw one case this week where the victim lost to thieves 127 Bitcoins valued at $540 apiece. "They were hacked not through malware, but a vulnerability in a third-party search engine," Stewart says.

It's difficult to assess total losses because "users are their own banks with cryptocurrency," he says. "Every day I go into these forums, someone got robbed. Their wallet was emptied and they don't know what happened. They had the latest antivirus updates," but it still didn't matter, he says.

Wallet-stealing malware is the most popular form of this crimeware, which searches for "wallet.dat" or other known wallet software key storage files. Once that file is found, the wallet gets uploaded to a remote FTP, Web, or SMTP server where the thief extracts the keys and grabs the coins, signing a transaction that transfers them to his account.

Credential-stealing malware go after the Bitcoin user's Bitcoin exchange credentials. "Many exchanges have implemented two-factor authentication using one-time PINs to combat unauthorized logins," Stewart and Litke wrote in a report released today on their findings. "However, more advanced malware can easily bypass OTP-based 2FA, by intercepting the OTP as it is used and creating a second hidden browser window in order to log the thief into the account from the user's own computer."

Man-in-the browser malware intercepts the transaction and changes the recipient address before it's signed. The malware waits for new content hitting the clipboard: If it contains a valid Bitcoin address, the malware injects its own address to get the coins.

The bottom line is that Bitcoins are a risky business. "A lot of people using Bitcoins don't understand what they are doing with them," Stewart says. "And if a Bitcoin is stolen, you don't get it back. There's no bank to back you, no insurance. Our goal with this paper is to get it out there how bit this threat has become ... [people] just have to get better security practices in storing Bitcoin wallets."

There are some ways to protect this digital currency, such as alternative wallets, like Armory and Electrum, that split up key storage. An offline computer stores the private key for signing transactions, while another machine connected to the Internet holds the master key.

Hardware wallets, meanwhile, operate in a key fob style, and transaction integrity verification is an emerging option.

The full report by SecureWorks is available here for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
mitila
50%
50%
mitila,
User Rank: Apprentice
5/22/2014 | 1:46:26 AM
Thanks
,Malware should be controlled in order to keep free the web sources to access for all of us. it is interesting to see. But people are so much unstable on these decisions. city club
[Bond007]
50%
50%
[Bond007],
User Rank: Apprentice
1/19/2020 | 5:15:16 PM
Re: Thanks
<p>from a Blockchain analytics firm Chainalysis reveals that it has traced $2.8 billion in Bitcoin sent to crypto exchanges by criminals last year. Noticeably, criminals sent major funds to Binance and Huobi. More so, Chanalysis tracked that the funds were transferred via criminal sources in 2019. Furthermore, Binance accounts for 27.5% of such funds whereas Huobi marked with 24.7% according to recent findings. This being said, over 300,000 individual accounts at both exchanges received Bitcoin from what 'Chainalysis noted' 'criminal sources in last year.</p>
https://www.visionary-finance.com/news/Report-Shows-Criminals-Transacting-Over-2-Billion-in-Bitcoin-On
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...