The sky-high valuations of cryptocurrencies isn't lost on hackers, who are responding with increasingly sophisticated attacks that covertly harness the computers and electricity of unwitting people to generate digital coins worth large sums of money.
One example is a recently uncovered mass hack of servers that has mined about $6,000 worth of the cryptocurrency known as AEON in the past 23 days. Based on the rate the underlying cryptographic hashes are being generated, Morphus Labs Chief Research Officer Renato Marinho estimated that about 450 separate conscripted machines are participating. Marinho analyzed one of the servers and found that attackers gained control over it by exploiting CVE-2017-10271, a critical vulnerability in Oracle's WebLogic package that was patched in October. The owner of the compromised server, however, had yet to install the fix.
"The exploit is pretty simple to execute and comes with a Bash script to make it easy to scan for potential victims," Marinho wrote in a blog post published Sunday. "In this case, the campaign objective is to mine cryptocurrencies, but, of course, the vulnerability and exploit can be used for other purposes."
The post said the currency being mined is known as Monero. On Monday, however, the researcher told Ars he finally gained access to the attackers' mining pool, which showed the currency was, in fact, AEON.
The exploit used on the machine Marinho examined shut down WebLogic, presumably in an attempt to reduce the load put on the CPUs of the compromised machine. Killing WebLogic makes it easy for victims to know when they have been compromised, but the exploit the researcher reviewed could easily have been modified in later attacks to ensure WebLogic continues to operate normally. The number of coins generated over the past 23 days suggests many operators remain unaware their servers have been hacked.
Researchers from security firm F5 documented a slightly more elaborate campaign in December that, as of December 15, had generated more than $8,500 in Monero. The attack code used in that case exploited servers running outdated versions of the DotNetNuke content management system and the Apache Struts 2 Web application framework.
The latter vulnerability, by the way, was CVE-2017-5638, the same flaw that attackers used to hack Equifax and steal data for as many as 143 million US consumers.
hiveblocks