Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

8/14/2014
05:25 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Traffic To Hosting Companies Hijacked In Crypto Currency Heist

Attacker likely a current or former ISP employee, researchers say.

A crypto currency thief hijacked traffic that was meant for large hosting companies including Amazon, Digital Ocean, OVH, and others earlier this year in a heist that earned him some $83,000 in profits in more than four months, researchers revealed last week.

Researchers with Dell SecureWorks Counter Threat Unit published the new research on the attacks in conjunction with the Black Hat USA show in Las Vegas. Dell SecureWorks says some 51 networks were compromised from 19 Internet service providers as the thief redirected crypto currency miners to his own mining pool and stole their profits -- to the tune of $9,000 per day. The crypto currency hijack also interrupted network traffic for other users in the netblocks he targeted, the researchers say, but the attacker was mainly interested in the miners.

"They were man-in-the-middle hijacking crypto currency. I found my [account] was hijacked, too," says Joe Stewart, director of malware research for Dell SecureWorks. When Stewart first heard of the crypto currency theft, he figured the attacker had hijacked Border Gateway Protocol (BGP) routes and redirected their mining to the rogue systems. The Internet's BGP routing protocol basically connects networks on the Internet.

It turns out Stewart was correct: The attacker had blasted phony BGP broadcasts that redirected the victims' crypto currency traffic to his server. "He only hijacked it for brief periods where he was able to capture and trap a large section of miners," Stewart says, so the hijack was not necessarily noticeable.

The attacker was successful in part because crypto currency miners employ a protocol called Stratum that has little or no security. "They're not using HTTPS, so any mining pool can send or reconnect to send to a different IP. [The protocol] trusts that they are talking to the real server."

It was that inherent trust that the hijacker capitalized on. But Stewart says the culprit also needed the administrative rights to pull off the BGP spoof, so it was likely an employee or former employee of an ISP. "Or a hacker hacked a router."

The researchers ultimately traced the malicious BGP announcements to a single router at an ISP in Canada. "We reported it to the ISP, and gave them large logs." The activity ultimately came to a halt, he says, and the ISP didn't provide any additional information on its resolution.

Dell SecureWorks' Pat Litke, who worked with Stewart on investigating the theft, says at the heart of the problem is the ISP not having proper oversight of its offending employee or former employee.

But even more unsettling was how the attacker was able to temporarily commandeer all of those IP addresses. The affected hosting providers "have a huge range of IP addresses," says Litke. "The addresses being hijacked were fairly negligible. It didn't impact them… They weren't losing money, and their customers didn't notice."

The only noticeable glitch would be that users wouldn't be able to ping a server, but that would have been seen as a temporary network problem. "Only the miners got trapped for a longer period of time," Stewart says. "We didn't see any big website hijacked in that."

It was when miners started talking online in a Bitcoin forum about lost funds that it become obvious something had gone awry. On March 22, a user named "caution" noted sketchy activity in the wafflepool.com mining pool. Other miners chimed in with similar observations of their mining systems being redirected to an IP address they didn't recognize, and ultimately, their loss of funds.

According to Dell SecureWorks, some $2.6 million in crypto currency mining occurs daily. The researchers suggest that ISPs use the Resource Public Key Infrastructure service, and miners use a Secure Sockets Layer (SSL) client to encrypt their traffic. "Miners should also implement server certificate validation. This validation ensures that the certificate the pool server sends when establishing the connection is valid and authorized for use with the connected domain, even if the domain's IP address changes," the researchers wrote in their report about the attacks.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/15/2014 | 9:33:10 AM
Re: Awesome
Crytpo currency mining is fraught with security risk. So I suppose the heist was not surprising given the lack of security inherent in mining. But spoofing BGP was a pretty interesting way to pull it off, for sure.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
8/15/2014 | 7:33:20 AM
Awesome
It is the demonstration of the capabilities of cybercrime ecosystem. This hack is very interesting, the crocks are also exploring with interest the opportunity offered by virtual currencies.

 
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15864
PUBLISHED: 2021-01-17
An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page.
CVE-2021-3113
PUBLISHED: 2021-01-17
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and ...
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...