Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

2/20/2018
08:05 AM
Simon Marshall
Simon Marshall
Simon Marshall
50%
50%

Cryptocurrency Crime: The Internet's New Wild West

The popularity of Bitcoin and other cryptocurrencies has opened the floodgates to different cybercrimes, scams and outright theft. A pair of reports from Cisco and Digital Shadows paints a portrait of this new Wild West of the Internet.

In many ways cryptocurrency crime resembles the new Wild West, with several different gangs of rogue gunslingers looking for a haul. These bandits use new techniques to illegally harness the computer power of users, mine currency and rob wallets.

"In many ways, it's like the Gold Rush of the 1840s as people flood to the opportunities that cryptocurrencies present and are preyed on by criminals and the unscrupulous," said Rick Holland, vice president strategy at Digital Shadows, a San Francisco-based digital risk management and threat intelligence firm.

And, when ransoming their victims becomes too risky, these groups ride into town to recruit other suckers to do their bidding. Cryptojacking is growing in popularity not just because cryptocurrencies are booming, but because it's also a safer option for extorting funds than ransomware. (See Cryptomining: Paying the Price for Cryptocurrency.)

Illegal cryptocurrency mining is now on the increase because hackers can realize an excellent financial upside versus ransomware without the risk of even engaging the victim, according to the latest Cisco Talos report.

Along with a "marked increase in the volume of cryptocurrency mining software being maliciously delivered to victims," Talos notes that mining is more productive for malicious users because it is not, like ransomware, a one-off attack. (See Rogue Employees Mine Cryptocurrency Using Company Hardware.)

"IOT devices, with their lack of monitoring and lack of day-to-day user engagement, are fast becoming an attractive target for these attackers, as they offer processing power without direct victim oversight," according to Cisco Talos. The report also noted that although the processing power per device is likely relatively small, the number of publicly exposed devices is high, making the equation profitable for those looking for less risk than ransomware.

An average system can mine Monero to the equivalent of $0.25 a day, and in Cisco's estimation, someone enlisting 2,000 victims -- described as "not a hard feat" -- would generate $500 a day, or $182,500 annually -- bearing in mind that currency values are volatile at the moment.

Botnets, which perform the number crunching, are becoming easier to access thanks to "rent a bot" schemes on the Dark Web, and Talos has observed millions of infected systems which could theoretically be used to net tens of millions of dollars by groups or individuals with relatively little effort.

Not only that, but because infections can go unnoticed, mining provides a sustainable income stream, not just a one-off hit. Theft of computing power can go unnoticed by users and most mining software, such as CoinHive, JSEcoin, and Crypto-Loot is not technically considered malware.

Coinhoarder group
Cryptojacking is not the only method of stealing from everyday users. One example is the so-called Coinhoarder group, a Ukrainian hacking organization which has been mining Bitcoin since at least 2015.

Cisco has been tracking them for the last six months hand-in-hand with a specialist Ukrainian cyberpolice unit, revealing that the group has to date stolen an estimated "tens of millions" of dollars in cryptocurrency by using Google Adwords to poison everyday users' search results, and steal directly from their wallets.

The group emerged into the spotlight after a campaign in February 2017 that targeted blockchain.info, a popular Bitcoin wallet site. Alarm bells rang after about 200,000 client queries pinged the site in a single day, after the group had placed phishing links in Google Adwords such as "blockchain" and "bitcoin wallet."

These spoofed links, when clicked, would redirect to a regionalized landing page based on the user's IP address, where phishing content was served up.

Using the attackers' Bitcoin wallet address, Cisco and law enforcement spotted that between September and December last year, about $10 million was stolen. In one campaign, $2 million was netted in under a month.

Cisco estimates the Coinhoarder group has gained north of $50 million in total over three years, proving how lucrative this activity is becoming, and some would say more successful in pure money terms than ransomware.

Taking people for a ride
Like in the Pioneer Days, people do not remain fools for too long. There are no visible criminals for the population to tar and feather, but even so, hackers are staying nimble by deploying new techniques and software hybrids that take cryptocurrency crime to the next level.

These not only include a rash of cryptomining and currency value "pump and dump" schemes, but also botnet rental and fake Initial Coin Offerings (ICOs), according to a new report from Digital Shadows.

"This is a rapidly changing space and we see new scams crop up daily," said Digital Shadows' Holland. "While the future of cryptocurrencies remains somewhat uncertain, what we can be sure of is that cybercriminals will continue to find new ways of making money."

Holland emphasizes that the growth of botnets-for-rent and the weaponization of mining tools available on the black market at low price points is further accelerating crypto crime. Digital Shadows has observed one such botnet-for-rent priced at $40 which has already been rented 2,000 times.

One example of weaponization that looks particularly powerful is a new cryptojacker which combines CoinHive, Authedmine and Crypto-Loot into a Word Press plugin with added SEO functionality. Priced at $29, the software has been available illicitly since November last year and essentially clones popular websites which are then leveraged in spam campaigns.

In some instances, criminals have become as brazen as soap bar salesmen by creating their own bogus cryptocurrencies as fake ICOs, duping investors to come on board, pumping the value, and then leaving them with nothing but the detergent.

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3166
PUBLISHED: 2021-01-18
An issue was discovered on ASUS DSL-N14U-B1 1.1.2.3_805 devices. An attacker can upload arbitrary file content as a firmware update when the filename Settings_DSL-N14U-B1.trx is used. Once this file is loaded, shutdown measures on a wide range of services are triggered as if it were a real update, r...
CVE-2020-29446
PUBLISHED: 2021-01-18
Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Object References (IDOR) vulnerability in the WEB-INF directory. The affected versions are before version 4.8.5.
CVE-2020-15864
PUBLISHED: 2021-01-17
An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page.
CVE-2021-3113
PUBLISHED: 2021-01-17
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and ...
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...