Cybercrime is an extremely lucrative business: a flourishing economy generating a staggering $1.5 trillion in revenues every year, according to a recent estimate. Perfect for cybercriminals, as this is maximum ROI for minimum effort and practically little risk of penalty.
In this scenario it comes as no surprise that cryptojacking, the unauthorized use of someone else’s computing resources to mine cryptocurrency, has replaced ransomware as the number one threat for consumers and enterprises.
The fluctuations of the Bitcoin value, a problem for the business model of ransomware that relies on quick and repeated attacks characterized by small payments, along with the research of new attack techniques able to provide a better pay-out ratio, have rapidly pushed cryptojacking to the top of the infosecurity issues in 2018.
Let’s look more in detail at the factors that have driven this shift.
Higher Pay-Out Ratio
United they mine… With a cryptocurrency market cap of nearly $500 billion, cryptojacking is extremely attractive for cybercriminals: it does not require high technical skills and, unlike ransomware, offers a potential 100% pay-out ratio. Once compromised, the infected machine can start immediately to mine cryptocurrency in in stealth mode regardless of its processing power or geographical location: even low-end systems are useful to the cause since it’s the size of the network of compromised machines, and hence the total computational power, that really matters. Additionally, if the attackers don’t get carried away and tune the miner not to completely drain the CPU (up to the point of bricking your Android device), the attack can go on stealth and undetected for a long time.
Ubiquity of the Attack Surface
One rig to mine them all... Ubiquity of the attack surface is another important aspect. Whatever you are, wherever you are… You can mine… It doesn’t matter if the malicious miner component is injected into a mobile device, a personal computer, a server, an instance in the cloud, or even an IoT device, like a camera, a fridge, a fan. It doesn’t even matter what operating system is being used. With any OS, the attackers can take advantage of its CPU cycles for their illegitimate purposes. Even IoT devices with limited processing power can be recruited: the Mirai botnet has taught us what multiple IoT devices can do when working together, thousands at a time. And it’s not a coincidence that a variant has been repurposed to mine cryptocurrency, and the same botnet has also spawned Satori, a variant infecting mining rigs, hijacking the device owner's mining credentials. In fact, hacking multiple IoT devices can be rewarding: according to a recent estimate, 15,000 hacked internet-connected gadgets can mine $1,000 of cryptocurrency in just four days. Not bad considering that by 2020, there will be over 20 billion internet-connected devices.
Multiple Infection Mechanisms
All roads lead to a mine… The high pay-out ratio and the ubiquity of the attack surface aren’t the only advantages of cryptojacking. Since malicious miners can be injected in virtually any device, multiple infection vectors can be utilized accordingly: brute-force attacks, unpatched vulnerabilities, or compromised websites (drive-by cryptomining) are just few examples of the techniques showcased so far. Have a look at the timelines of cyberattacks that I collect on a monthly basis, and you will be surprised by the creativity of the attackers in continuously finding new ways to perpetrate cryptojacking attacks.
Servers have been compromised in multiple ways to inject miners: from old-school brute-force attacks with default credentials (the case of a recent campaign targeting thousands of Magento sites), to the exploitation of unpatched vulnerabilities such as, just to name a few, Oracle WebLogic (CVE 2017-10271), Apache Struts (CVE-2017-5638), DotNetNuke (CVE-2017-9822), OrientDB (CVE-2017-11467), Jenkins CI (CVE-2017-1000353), JBoss servers (CVE-2017-12149), and Apache Solr (CVE-2017-12629).
Unpatched vulnerabilities have also been used to compromise clients, making new slaves for the cryptominer botnets. The Smomirnu botnet and Wannamine malware are two examples of threats exploiting the infamous EternalBlue vulnerability (CVE-2017-144) to spread. Even existing malware can be rewritten to mine cryptocurrency, or to add this “feature” to the existing ones.
In reality clients are even more exposed since they can mine cryptocurrency simply visiting a web-page hosting a JavaScript miner like Coinhive. Coinhive mines a cryptocurrency called Monero (XMR) and the main reason is that, besides being able to stay anonymous with this blockchain, the algorithm used to calculate the hashes, called Cryptonight, was designed to run well on consumer CPUs (what a coincidence!). An opportunity too tempting (and easy) not to be exploited by criminals, who are now constantly scanning websites for vulnerabilities that allow them to inject Coinhive: the Los Angeles Times, and Blackberry Mobile are two noticeable examples of high-profile websites compromised for this purpose in 2018. Not to mention the fact the discretional opt-in controls available with Coinhive that were never respected in such cases.
But this is only the tip of the iceberg, since drive-by cryptomining campaigns are becoming bigger, more prevalent and more persistent while you browse the internet. Criminals are now adopting a modus operandi similar to malvertising (minevertising), injecting the Coinhive code into advertisements supplied by platforms like AOL or Google DoubleClick (two examples occurred in 2018). It doesn’t even matter if the user leaves the compromised page or closes his browser (or at least he believes to) since the malicious code can be hidden into a tiny ‘pop-under’ window hidden behind the Windows taskbar, making it persistent and invisible to the user. There have also been cases of malicious browser extensions injecting Coinhive directly into the browser.
The Role of the Cloud
The sun always mines above the cloud… The list of the five most new dangerous attacks presented by the SANS institute at the last RSA Conference includes both cloud storage data leakage and monetization of compromised systems via cryptominers. Data leakage in the cloud is often the consequence of misconfigurations like wrong permissions or lack of an adequate password protection. Besides stealing data, the same misconfigurations can be used by crooks to spin-up their own instances and use them to mine cryptocurrency at the expense of the victim, with the concrete possibility that the latter will not detect the attack until the next bill. A deadly combination of the two attack techniques listed by the SANS Institute has already hit some high-profile victims like Tesla, whose public cloud was used to mine cryptocurrency.
There are also some additional risks. Miners can use known cloud services to spread more quickly inside organizations (Netskope Threat Research Labs discovered a Coinhive miner resident in a Microsoft Office 365 OneDrive for Business instance), or also to evade detection (like in case of Zminer that downloads payloads from Amazon S3 cloud storage).
General Recommendations
There are few steps that can be done in order to mitigate the rising threat of cryptojacking.
1. Govern web use with a multi-layered threat protection platform like Netskope for Web, able to unify SaaS, IaaS, and web security from a single pane of glass.
2. Detect and remediate cryptominers in the cloud, using a threat-aware CASB solution like Netskope: enforce policy on usage of unsanctioned services, as well as unsanctioned instances of sanctioned cloud services to block hybrid multi stage attacks where the payload is downloaded from a cloud service.
3. Sample policies to enforce:
- Scan all uploads from unmanaged devices to sanctioned cloud applications for malware
- Scan all uploads from remote devices to sanctioned cloud applications for malware Scan all downloads from unsanctioned cloud applications for malware
- Scan all downloads from unsanctioned instances of sanctioned cloud applications for malware Enforce quarantine/block actions on malware detection to reduce user impact
- Block unsanctioned instances of sanctioned/well known cloud apps, to prevent attackers from exploiting user trust in cloud. While this seems a little restrictive, it significantly reduces the risk of malware infiltration attempts via cloud
4. Deploy a CASB solution able to perform continuous security assessment and monitoring of your IaaS & PaaS configuration. This includes infrastructure misconfigurations and vulnerabilities that can lead to potential compromise and subsequent installation of cryptominers, or setup of malicious instances aimed to mine cryptocurrency.
5. Obviously, make sure that an effective patch management process for clients and servers are in place. Ensure that the corporate antivirus is updated with the latest releases and patches.
6. Encourage a responsible usage of the company resources:
- Warn users to avoid executing unsigned macros and macros from an untrusted source, unless they are very sure that they are benign
- Warn users to avoid executing any file unless they are very sure that they are benign
- Warn users against opening untrusted attachments, regardless of their extensions or filenames
7. Ad-blockers or browser extensions like NoScript can help to prevent drive-by cryptomining attacks. Recently some specific browser extensions have been published, which can block JavaScript miners like CoinHive, however be careful to install only trusted ones, since rogue browser extensions are also a common mechanism to inject cryptominers directly into the browser.
8. Administrators can create firewall rules to block bitcoin pools documented in the Wikipedia article.
Paolo Passeri, Cyber Intelligence Principal at Netskope
- Also check out our list for the best ransomware protection
