Hackers Chronicle - Online Cyber Security News: Cryptomining

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnp2gfb-T4DnvsHXezl5oNNba6XRwuEuLIfSdCLiBD_8951TnC2rwl-U5icAfUFJTACq-v6ieYzJ7S48td97pqrXtcWOGBZKiELIxK6COmmBPKi-jlDcb5YNr38xxmHg7UHKq0Bzwntt4-/s1600/calendar-2-mining-monero.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Popular Calendar 2 app openly mines Monero by default" border="0" data-original-height="582" data-original-width="571" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnp2gfb-T4DnvsHXezl5oNNba6XRwuEuLIfSdCLiBD_8951TnC2rwl-U5icAfUFJTACq-v6ieYzJ7S48td97pqrXtcWOGBZKiELIxK6COmmBPKi-jlDcb5YNr38xxmHg7UHKq0Bzwntt4-/s640/calendar-2-mining-monero.jpg" title="Popular Calendar 2 app openly mines Monero by default" width="625" /></a></div>
A schedule application in the Mac App Store <b>Calendar 2</b> has been mining <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency">cryptocurrency </a>out of sight in return for giving clients extra highlights — and an alternative to quit mining has been broken. Up until this point, Apple has not taken the booking application Calendar 2 down, even after Ars Technica informed the organization that <a href="https://itunes.apple.com/us/app/calendar-2/id415181149?mt=12">Calendar 2</a> has been mining virtual currency. <br />
<br />
The application is a buffed-up variant of Apple's Calendar application in <a href="http://www.hackerschronicle.com/search/label/macOS">macOS</a>, yet as of late, its designer, Qbix, added additional code to mine <a href="http://www.hackerschronicle.com/search/label/Monero">monero</a>, an advanced coin propelled in April 2014 and intended to be a more unknown adaptation of bitcoin, as you can't see exchanges on an open record. That makes Calendar 2 something of an irregularity in the App Store — there don't have all the earmarks of being other mining applications in the store, not to mention applications that utilization mining as an approach to get extra an incentive from non-paying clients. <br />
<br />
The miner keeps running in return for giving the clients a chance to get to more premium highlights. Clients can quit by keeping premium highlights off or paying for them through the App Store. <br />
<br />
Be that as it may, as Ars noticed, the application had a bug that kept the digger running, regardless of whether clients endeavored to quit, and a moment bug that made the excavator expend a larger number of assets than initially proposed. A client noted on Twitter that the application "<b>ate 200% CPU until the point that I discovered it and murdered it. I didn't expect a mineworker contamination from an App Store seller. Amazing</b>." The application's present rating is two out of five in the App Store, with numerous current surveys docking stars due to the undesirable mining. Qbix expressed that it was highly involved with distributing a fix for the bugs. <br />
<br />
Mining programs tend to support Monero over <a href="http://www.hackerschronicle.com/search/label/Bitcoin">Bitcoin </a>or Ethereum, as Monero has a more CPU-friendly hashing calculation. </div>

Calendar app in Mac App Store is openly mining cryptocurrency in background

A schedule application in the Mac App Store Calendar 2 has been mining cryptocurrency out of sight in return for giving clients extra h...

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdV7v7ncahe3qwjXHcok_B73pE_DNqfje6O7Q30mp3Zo1V1TZtqUKjP9luc1VvqZjcL9DdzR6EFbGO_wBBFmTFmxdrlzDHmgnmqmGYuzhv3nT1eZGKUJLuuB-GTvK96Byo-Te-UdzKKiDq/s1600/cryptoccurency-mining-malware-RedisWannaMine.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hackers are targeting Redis and Windows servers for cryptomining " border="0" data-original-height="465" data-original-width="720" height="411" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdV7v7ncahe3qwjXHcok_B73pE_DNqfje6O7Q30mp3Zo1V1TZtqUKjP9luc1VvqZjcL9DdzR6EFbGO_wBBFmTFmxdrlzDHmgnmqmGYuzhv3nT1eZGKUJLuuB-GTvK96Byo-Te-UdzKKiDq/s640/cryptoccurency-mining-malware-RedisWannaMine.jpg" title="Hackers are targeting Redis and Windows servers for cryptomining " width="640" /></a></div>
<br />
Security researchers at Imperva have come across a new <a href="http://www.hackerschronicle.com/search/label/Cryptojacking">cryptojacking </a>worm that infects Redis and Windows servers with cryptomining <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a>.<br />
<br />
The attack, which has been dubbed <a href="http://www.hackerschronicle.com/search/label/RedisWannaMine">RedisWannaMine </a>by researchers from security firm Imperva, scans for <b>misconfigured Redis deployments and Windows Servers that are still vulnerable to the Eternal Blue SMB <a href="http://www.hackerschronicle.com/search/label/Exploits">exploit</a>.</b><br />
<br />
While investigating an attack against a web server that attempted to exploit the <b>CVE-2017-9805</b> vulnerability in Apache Struts, the Imperva researchers located a command-and-control server hosting multiple attack scripts. One of those scripts was a new cryptomining downloader that exhibited worm-like behavior.<br />
<br />
When executed, the script attempts to install a variety of packages through apt-get or yum—depending on the Linux distribution—creates entries in crontab for persistence and adds a new authorized SSH key for authentication. It then proceeds to download a tool called masscan from GitHub and compiles it.<br />
<br />
<b>Masscan is a high-performance TCP port scanner</b> and is used by <b>RedisWannaMine </b>to scan external and internal IP addresses for Redis deployments. Redis is an in-memory data store that can be used as a database, cache or message broker. It is usually deployed on internal networks, but thousands of such servers have been found exposed on the internet in the past. The project page of <a href="https://github.com/robertdavidgraham/masscan">Masscan</a> describes it as “<b>TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes</b>.”<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJMVXe1axhx_0ifPV9UQfCDbpGj7tB7CVqo97UHjD9NP-PWON8uni3Mt8IizLcBToJNJ3Zc3mHPcVqbcw_SYEPegsRg_gD2szWYtMy7mTf1mTMDI4OlM-LLyM33gKHR8POmdvnMP3Doms/s1600/mascan-TCP-Scanner.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Masscan a high-performance TCP port scanner" border="0" data-original-height="206" data-original-width="845" height="155" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJMVXe1axhx_0ifPV9UQfCDbpGj7tB7CVqo97UHjD9NP-PWON8uni3Mt8IizLcBToJNJ3Zc3mHPcVqbcw_SYEPegsRg_gD2szWYtMy7mTf1mTMDI4OlM-LLyM33gKHR8POmdvnMP3Doms/s640/mascan-TCP-Scanner.png" title="Masscan a high-performance TCP port scanner" width="640" /></a></div>
<br />
<br />
When an unprotected Redis server is discovered, the script installs cryptomining malware on it and creates crontab entries for persistence. The script then launches another scan, this time for Windows Servers that accept SMB connections.<br />
<br />
The goal of the second scan is to find servers that are vulnerable to the Eternal Blue SMB exploit used by <a href="http://www.hackerschronicle.com/search/label/WannaCry">WannaCry</a>, <a href="http://www.hackerschronicle.com/search/label/notPetya">NotPetya </a>and other malware attacks over the past year. When such a servers are identified, the script downloads and installs a different cryptomining component for Windows.<br />
<br />
Compared to past cryptojacking attacks that primarily target servers available on the internet, <b>RedisWannaMine also spreads laterally through local networks, making it much more dangerous to companies.</b><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXH9YAByWecwOsKjw_3-Hh9YEHhFJv6d1_vJ60su3ELwMZLe2IYggemN0gZj5AgFg-YHsy7XiuYUfviIo26KgUk77daHKbinqPVTKH208B9EnAWqf4wGQRsgcdyX-K9WbO6NlKtrHbzQgI/s1600/working-of-RedisWannaMine.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Working of RedisWannaMine Malware" border="0" data-original-height="570" data-original-width="1024" height="355" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXH9YAByWecwOsKjw_3-Hh9YEHhFJv6d1_vJ60su3ELwMZLe2IYggemN0gZj5AgFg-YHsy7XiuYUfviIo26KgUk77daHKbinqPVTKH208B9EnAWqf4wGQRsgcdyX-K9WbO6NlKtrHbzQgI/s640/working-of-RedisWannaMine.png" title="Working of RedisWannaMine Malware" width="640" /></a></div>
<br />
The malware “is more complex in terms of evasion techniques and capabilities,” the Imperva researchers said in a report. “It demonstrates a worm-like behavior combined with advanced exploits to increase the attackers’ infection rate and fatten their wallets. In a nutshell, cryptojacking attackers have upped their game and they are getting crazier by the minute!” </div>

Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

Cryptocurrency Cryptojacking Cryptomining CVE-2017-9805 Redis RedisWannaMine Windows Server Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

Security researchers at Imperva have come across a new cryptojacking worm that infects Redis and Windows servers with cryptomining malwa...

Calendar app in Mac App Store is openly mining cryptocurrency in background

Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

Popular

Comments

Archive