[BreachExchange] Bigger than Ransomware, CryptoJacking is the new money maker

[Inga Goddijn]

https://www.itproportal.com/features/bigger-than-ransomware-cryptojacking-is-the-new-money-maker/

Cybercrime is an extremely lucrative business: a flourishing economy
generating a staggering $1.5 trillion in revenues every year, according to
a recent estimate
<https://venturebeat.com/2018/04/21/the-web-of-profit-a-look-at-the-cybercrime-economy/>.
Perfect for cybercriminals, as this is maximum ROI for minimum effort and
practically little risk of penalty.

In this scenario it comes as no surprise that cryptojacking, the
unauthorized use of someone else’s computing resources to mine
cryptocurrency, has replaced ransomware as the number one threat for
consumers and enterprises.

The fluctuations of the Bitcoin value, a problem for the business model of
ransomware that relies on quick and repeated attacks characterized by small
payments, along with the research of new attack techniques able to provide
a better pay-out ratio, have rapidly pushed cryptojacking to the top of the
infosecurity issues in 2018.

Let’s look more in detail at the factors that have driven this shift.
Higher Pay-Out Ratio

United they mine… With a cryptocurrency market cap of nearly $500 billion
<https://coinmarketcap.com/charts/>, cryptojacking is extremely attractive
for cybercriminals: it does not require high technical skills and, unlike
ransomware, offers a potential 100% pay-out ratio. Once compromised, the
infected machine can start immediately to mine cryptocurrency in in stealth
mode regardless of its processing power or geographical location: even
low-end systems are useful to the cause since it’s the size of the network
of compromised machines, and hence the total computational power, that
really matters. Additionally, if the attackers don’t get carried away and
tune the miner not to completely drain the CPU (up to the point of bricking
your Android device
<https://www.darkreading.com/mobile/new-android-cryptojacker-can-brick-phones/d/d-id/1331398>),
the attack can go on stealth and undetected for a long time.
Ubiquity of the Attack Surface

One rig to mine them all... Ubiquity of the attack surface is another
important aspect. Whatever you are, wherever you are… You can mine… It
doesn’t matter if the malicious miner component is injected into a mobile
device, a personal computer, a server, an instance in the cloud, or even an
IoT device, like a camera, a fridge, a fan. It doesn’t even matter what
operating system is being used. With any OS, the attackers can take
advantage of its CPU cycles for their illegitimate purposes. Even IoT
devices with limited processing power can be recruited: the Mirai botnet
has taught us what multiple IoT devices can do when working together
<https://thenextweb.com/security/2016/10/21/massive-ddos-attack-dyn-dns-causing-havoc-online/>,
thousands at a time. And it’s not a coincidence that a variant has been
repurposed
<https://internetofbusiness.com/mirai-malware-bitcoins-iot-devices/> to
mine cryptocurrency, and the same botnet has also spawned Satori, a variant
infecting mining rigs, hijacking the device owner's mining credentials. In
fact, hacking multiple IoT devices can be rewarding: according to a recent
estimate, 15,000 hacked internet-connected gadgets can mine $1,000 of
cryptocurrency in just four days. Not bad considering that by 2020, there
will be over 20 billion <https://www.gartner.com/newsroom/id/3598917>
internet-connected
devices.
Multiple Infection Mechanisms

All roads lead to a mine… The high pay-out ratio and the ubiquity of the
attack surface aren’t the only advantages of cryptojacking. Since malicious
miners can be injected in virtually any device, multiple infection vectors
can be utilized accordingly: brute-force attacks, unpatched
vulnerabilities, or compromised websites (drive-by cryptomining) are just
few examples of the techniques showcased so far. Have a look at the
timelines <https://www.hackmageddon.com/2018-master-table/> of cyberattacks
that I collect on a monthly basis, and you will be surprised by the
creativity of the attackers in continuously finding new ways to perpetrate
cryptojacking attacks.

Servers have been compromised in multiple ways to inject miners: from
old-school brute-force attacks with default credentials (the case of a
recent campaign targeting thousands of Magento sites), to the exploitation
of unpatched vulnerabilities such as, just to name a few, Oracle WebLogic
(CVE 2017-10271), Apache Struts (CVE-2017-5638), DotNetNuke
(CVE-2017-9822), OrientDB (CVE-2017-11467), Jenkins CI (CVE-2017-1000353),
JBoss servers (CVE-2017-12149), and Apache Solr (CVE-2017-12629).

Unpatched vulnerabilities have also been used to compromise clients, making
new slaves for the cryptominer botnets. The Smomirnu botnet and Wannamine
malware are two examples of threats exploiting the infamous EternalBlue
vulnerability (CVE-2017-144) to spread. Even existing malware can be
rewritten
<https://www.zdnet.com/article/this-ransomware-was-rewritten-to-mine-cryptocurrency-and-destroy-your-files/>to
mine cryptocurrency, or to add this “feature” to the existing ones.

In reality clients are even more exposed since they can mine cryptocurrency
simply visiting a web-page hosting a JavaScript miner like Coinhive.
Coinhive mines a cryptocurrency called Monero (XMR) and the main reason is
that, besides being able to stay anonymous with this blockchain, the
algorithm used to calculate the hashes, called Cryptonight, was designed to
run well on consumer CPUs <https://coinhive.com/#hash-rate> (what a
coincidence!). An opportunity too tempting (and easy) not to be exploited
by criminals, who are now constantly scanning websites for vulnerabilities
that allow them to inject Coinhive: the Los Angeles Times
<https://www.techrepublic.com/article/l-a-times-website-injected-with-monero-cryptocurrency-mining-script/>,
and Blackberry Mobile
<https://www.infosecurity-magazine.com/news/monero-cryptomining-invades/> are
two noticeable examples of high-profile websites compromised for this
purpose in 2018. Not to mention the fact the discretional opt-in controls
available with Coinhive that were never respected in such cases.

But this is only the tip of the iceberg, since drive-by cryptomining
campaigns are becoming bigger, more prevalent and more persistent while you
browse the internet. Criminals are now adopting a modus operandi similar to
malvertising (minevertising), injecting the Coinhive code into
advertisements supplied by platforms like AOL or Google DoubleClick (two
examples occurred in 2018). It doesn’t even matter if the user leaves the
compromised page or closes his browser (or at least he believes to) since
the malicious code can be hidden into a tiny ‘pop-under’ window hidden
behind the Windows taskbar, making it persistent and invisible to the user.
There have also been cases of malicious browser extensions injecting
Coinhive directly into the browser.
The Role of the Cloud

The sun always mines above the cloud… The list
<https://www.infosecurity-magazine.com/news/rsac-the-five-most-dangerous/> of
the five most new dangerous attacks presented by the SANS institute at the
last RSA Conference includes both cloud storage data leakage and
monetization of compromised systems via cryptominers. Data leakage in the
cloud is often the consequence of misconfigurations like wrong permissions
or lack of an adequate password protection. Besides stealing data, the same
misconfigurations can be used by crooks to spin-up their own instances and
use them to mine cryptocurrency at the expense of the victim, with the
concrete possibility that the latter will not detect the attack until the
next bill. A deadly combination of the two attack techniques listed by the
SANS Institute has already hit some high-profile victims like Tesla, whose
public cloud was used to mine cryptocurrency.

There are also some additional risks. Miners can use known cloud services
to spread more quickly inside organizations (Netskope Threat Research Labs
discovered a Coinhive miner resident in a Microsoft Office 365 OneDrive for
Business instance
<https://www.netskope.com/blog/modern-gold-mine-rush-office-365-as-a-crypto-miners-paradise/>),
or also to evade detection (like in case of Zminer
<https://www.netskope.com/blog/coin-mining-malware-heads-cloud-zminer/> that
downloads payloads from Amazon S3 cloud storage).
General Recommendations

There are few steps that can be done in order to mitigate the rising threat
of cryptojacking.

1. Govern web use with a multi-layered threat protection platform
<https://www.netskope.com/platform/netskope-for-web/> like Netskope for
Web, able to unify SaaS, IaaS, and web security from a single pane of
glass.

2. Detect and remediate cryptominers in the cloud, using a threat-aware CASB
solution <https://www.netskope.com/company/about-casb/> like Netskope:
enforce policy on usage of unsanctioned services, as well as unsanctioned
instances of sanctioned cloud services to block hybrid multi stage attacks
where the payload is downloaded from a cloud service.

3. Sample policies to enforce:

   - Scan all uploads from unmanaged devices to sanctioned cloud
   applications for malware
   - Scan all uploads from remote devices to sanctioned cloud applications
   for malware  Scan all downloads from unsanctioned cloud applications for
   malware
   - Scan all downloads from unsanctioned instances of sanctioned cloud
   applications for malware  Enforce quarantine/block actions on malware
   detection to reduce user impact
   - Block unsanctioned instances of sanctioned/well known cloud apps, to
   prevent attackers from exploiting user trust in cloud. While this seems a
   little restrictive, it significantly reduces the risk of malware
   infiltration attempts via cloud

4. Deploy a CASB solution able to perform continuous security assessment
<https://www.netskope.com/press-releases/netskope-expands-market-leading-iaas-security-capabilities-continuous-security-assessment-monitoring-capabilities/>
 and monitoring of your IaaS & PaaS configuration. This includes
infrastructure misconfigurations and vulnerabilities that can lead to
potential compromise and subsequent installation of cryptominers, or setup
of malicious instances aimed to mine cryptocurrency.

5. Obviously, make sure that an effective patch management process for
clients and servers are in place. Ensure that the corporate antivirus is
updated with the latest releases and patches.

6. Encourage a responsible usage of the company resources:

   - Warn users to avoid executing unsigned macros and macros from an
   untrusted source, unless they are very sure that they are benign
   - Warn users to avoid executing any file unless they are very sure that
   they are benign
   - Warn users against opening untrusted attachments, regardless of their
   extensions or filenames

7. Ad-blockers or browser extensions like NoScript <https://noscript.net/> can
help to prevent drive-by cryptomining attacks. Recently some specific
browser extensions have been published, which can block JavaScript miners
like CoinHive, however be careful to install only trusted ones, since rogue
browser extensions are also a common mechanism to inject cryptominers
directly into the browser.

8. Administrators can create firewall rules to block bitcoin pools
documented in the Wikipedia article.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20180514/ba6355ae/attachment.html>