PacNOG 23: Introduction to Crypto Jacking
•Download as PPTX, PDF•
1 like•1,863 views
Senior Network Analyst Warren Finch discussed the use of web-based crypto miners and how the crypto miners could be used maliciously for crypto jacking at PacNOG 23 in the Marshall Islands from 3 to 7 December 2018.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to PacNOG 23: Introduction to Crypto Jacking
Similar to PacNOG 23: Introduction to Crypto Jacking (20)
More from APNIC
More from APNIC (20)
Recently uploaded
Recently uploaded (20)
PacNOG 23: Introduction to Crypto Jacking
- 1. 1 Introduction to Crypto Jacking Warren Finch PacNOG 23 - 3rd Dec 2018 Marshall Islands
- 2. Agenda • Web based coin miners • What is cryptojacking • Are all cryptominers bad? • Cryptomining malware • Mitigation techniques 2
- 3. 18th Apr 2014 Monero Cryptocurrency released Timeline 3 https://arxiv.org/pdf/1803.02887.pdf - accessed 15th Nov 2018 2014 20182017 14th Sep 2017 Coinhive Miner launched 16th Oct 2017 Coinhive launches AuthedMine 11th Feb 2018 UK Information Commissioner’s Office Incident Sep 2018 Webcobra Malware discovered
- 4. Web based coin miners 5 https://alternativeto.net/software/coinhive/ - accessed 9th Nov 2018 Name URL Coinhive https://coinhive.com AuthedMine https://authedmine.com Coin-Have https://coin-have.com CoinImp https://www.coinimp.com/ Minexmr.stream https://minexmr.stream JSECoin https://jsecoin.com/ Adless https://www.adless.io/ Crypto-loot https://crypto-loot.com GridCash https://gridcash.net/ CryptoNoter https://github.com/cryptonoter
- 5. Web based coin miners 6 https://alternativeto.net/software/coinhive/ - accessed 9th Nov 2018 Name URL Coinhive https://coinhive.com AuthedMine https://authedmine.com Coin-Have https://coin-have.com CoinImp https://www.coinimp.com/ Minexmr.stream https://minexmr.stream JSECoin https://jsecoin.com/ Adless https://www.adless.io/ Crypto-loot https://crypto-loot.com GridCash https://gridcash.net/ CryptoNoter https://github.com/cryptonoter
- 6. What is Crypto Jacking 7 https://www.enisa.europa.eu/publications/info-notes/images_info_notes/cryptojacking.jpg
- 7. What is Crypto Jacking • The unauthorized use of computing resources to mine cryptocurrencies. • Using malicious tools designed to hijack vulnerable systems to mine for cryptocurrency in the background using crypto mining software without the consent or knowledge of the victims. • The technique of hijacking browsers for mining cryptocurrency (without user consent). 8
- 8. Are all crypto miners bad? 10 https://www.stfx.ca/about/news/stfx-systems-update-0 - accessed 8th Nov 2018
- 9. Are all crypto miners bad? 11 https://www.itnews.com.au/news/unicef-australia-tries-in-browser-cryptocurrency-mining-489884 - accessed 9th Nov 2018
- 11. Cryptomining malware • Leaked EternalBlue and DoublePulsar exploits are used to infect vulnerable windows servers and PCs. • Oracle’s WebLogic Server (CVE-2017-10271) flaw was also used to deliver miners onto servers. • Malware families distributed via malicious spam attachments, now have a coin miner module. • Android and Mac users are infected by trojanised apps laced with mining code. 16
- 12. Crypto-mining malware detections in 2017 17 11703 11714 13630 12654 12070 12776 15042 15698 24798 116361 77185 77242 0 20000 40000 60000 80000 100000 120000 140000 Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec https://blog.trendmicro.com/trendlabs-security-intelligence/cryptocurrency-mining-malware-2018-new-menace/ - accessed 9th Nov 2018
- 13. Javascript – Coinhive 19 https://coinhive.com – accessed 9th Nov 2018
- 14. Javascript – AuthedMine captcha 20 https://coinhive.com – accessed 9th Nov 2018
- 15. Locating sites with a coinhive script • https://publicwww.com/websites/"coinhive.min.js"/ 21 accessed 9th Nov 2018
- 16. Locating devices with a coinhive script • https://www.shodan.io/search?query=coinhive.min.js 22 accessed 9th Nov 2018
- 17. Locating devices with a coinhive script • https://www.shodan.io/search?query=coinhive.min.js 23 accessed 9th Nov 2018
- 19. Chrome Task Manager • Open the Chrome Task Manager by using the Shift+ESC keyboard combination • Or from the Chrome menu, then More Tools, and then Chrome Task Manager. 29
- 20. End user protection • Use the Task Manager (Windows) or Activity Monitor (Mac OS X) • Disable JavaScript in the browser • Browser extensions like “No Coin” are available on Google Chrome and Firefox. Opera has it enabled by default. • Install third-party malware detection and anti-virus software • Update and patch software 30
- 21. Opera 31
- 22. Network protection • Check vendor advisories and recommendations • Update firewall rules • Update Intrusion Detection System (IDS) rules • Update and Patch all systems • Block known crypto miner domains – https://gitlab.com/ZeroDot1/CoinBlockerLists – https://zerodot1.gitlab.io/CoinBlockerListsWeb/downloads.html – http://iplists.firehol.org 32
- 23. Confirm if site is on block list 36 https://malware-research.org/coinblockerlists/
- 24. VirusTotal • Use the search feature to find information about a threat • Search term – fba937ffc0291601_sdat.exe 39 https://www.virustotal.com/en/file/fba937ffc0291601b7b03548dac94ef6f321077b96ec561c9f595fb71fc50ccb/analysis/1504908698/
- 25. YARA – pattern matching for Malware 40 https://virustotal.github.io/yara/ - accessed 16th Nov 2018
Editor's Notes
- https://arxiv.org/pdf/1803.02887.pdf
- https://arxiv.org/pdf/1803.02887.pdf
- https://alternativeto.net/software/coinhive/
- https://alternativeto.net/software/coinhive/ https://www.virustotal.com/en/url/b6b6242a9507fcfaa11c49790e2bcb4334c03b086c87876dfd045cf02094148c/analysis/ https://urlscan.io/result/9096fd49-0a67-463f-8db4-6f362e401138
- https://www.enisa.europa.eu/publications/info-notes/images_info_notes/cryptojacking.jpg https://www.enisa.europa.eu/publications/info-notes/cryptojacking-cryptomining-in-the-browser
- https://news.softpedia.com/news/bitcoin-cryptojacking-attack-forces-university-to-disable-entire-network-523646.shtml
- https://www.stfx.ca/about/news/stfx-systems-update-0 https://news.softpedia.com/news/bitcoin-cryptojacking-attack-forces-university-to-disable-entire-network-523646.shtml
- https://www.stfx.ca/about/news/stfx-systems-update-0 https://news.softpedia.com/news/bitcoin-cryptojacking-attack-forces-university-to-disable-entire-network-523646.shtml
- https://www.itnews.com.au/news/unicef-australia-tries-in-browser-cryptocurrency-mining-489884 https://www.thehopepage.org
- https://twitter.com/Scott_Helme/status/962684239975272450/photo/1?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E962684239975272450&ref_url=https%3A%2F%2Fthenextweb.com%2Fsecurity%2F2018%2F02%2F12%2Fgovernment-websites-quietly-running-cryptocoin-mining-scripts%2F https://www.ncsc.gov.uk/news/ncsc-statement-malware-being-used-illegally-mine-cryptocurrency https://nakedsecurity.sophos.com/2018/02/12/cryptomining-script-poisons-government-websites-what-to-do/ https://thenextweb.com/security/2018/02/12/government-websites-quietly-running-cryptocoin-mining-scripts/ https://techcrunch.com/2018/02/12/browsealoud-coinhive-monero-mining-hack/
- https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/webcobra-malware-uses-victims-computers-to-mine-cryptocurrency/
- https://www.welivesecurity.com/2018/11/06/supply-chain-attack-cryptocurrency-exchange-gate-io/ https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/cryptocurrency-mining-malware-targets-linux-systems-uses-rootkit-for-stealth https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/over-200-000-mikrotik-routers-compromised-in-cryptojacking-campaign Known as CVE-2018-14847 the security flaw in MikroTik routers is being exploited with a view of installing the Coinhive cryptocurrency mining script in websites that users of the devices visit. https://www.ccn.com/monero-cryptomining-attack-affects-over-200000-isp-grade-routers-globally/ https://www.zdnet.com/article/how-much-does-the-pirate-bays-cryptocurrency-miner-make/ https://www.bleepingcomputer.com/news/security/cryptojackers-found-on-starbucks-wifi-network-github-pirate-streaming-sites/
- https://isc.sans.org/forums/diary/Crypto+Mining+in+a+Windows+Headless+Browser/24078/ https://steemit.com/mining/@ttox/headless-browser-mining
- https://blog.malwarebytes.com/cybercrime/2018/02/state-malicious-cryptomining/ https://blog.malwarebytes.com/threat-analysis/2018/02/new-mac-cryptominer-distributed-via-a-macupdate-hack/ https://publicwww.com/websites/"coinhive.min.js"/
- Cryptocurrency-mining malware detections in 2017 (based on Trend Micro Smart Protection Network) https://blog.trendmicro.com/trendlabs-security-intelligence/cryptocurrency-mining-malware-2018-new-menace/
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-quarterly-threats-sep-2018.pdf
- https://coinhive.com/documentation/miner#constructor-options
- https://badpackets.net/how-to-find-cryptojacking-malware/ Coinhive Search term = "coinhive.min.js" URL = https://publicwww.com/websites/"coinhive.min.js"/ Returned results = 13884 AuthedMine Search term = authedmine && "captcha.min.js" URL = https://publicwww.com/websites/authedmine+%26%26+"captcha.min.js"/ Returned results = 272 https://isc.sans.edu/forums/diary/Cryptominer+Delivered+Though+Compromized+JavaScript+File/23870/ Search Term = "navigator['hardwareConcurrency’]” URL = https://publicwww.com/websites/"navigator%5B%27hardwareConcurrency%27%5D"/ Returned results = 1665
- https://badpackets.net/how-to-find-cryptojacking-malware/ Coinhive Search term = "coinhive.min.js" URL = https://publicwww.com/websites/"coinhive.min.js"/ Returned results = 13884 AuthedMine Search term = authedmine && "captcha.min.js" URL = https://publicwww.com/websites/authedmine+%26%26+"captcha.min.js"/ Returned results = 272 https://isc.sans.edu/forums/diary/Cryptominer+Delivered+Though+Compromized+JavaScript+File/23870/ Search Term = "navigator['hardwareConcurrency’]” URL = https://publicwww.com/websites/"navigator%5B%27hardwareConcurrency%27%5D"/ Returned results = 1665
- https://badpackets.net/how-to-find-cryptojacking-malware/ Coinhive Search term = "coinhive.min.js" URL = https://publicwww.com/websites/"coinhive.min.js"/ Returned results = 13884 AuthedMine Search term = authedmine && "captcha.min.js" URL = https://publicwww.com/websites/authedmine+%26%26+"captcha.min.js"/ Returned results = 272 https://isc.sans.edu/forums/diary/Cryptominer+Delivered+Though+Compromized+JavaScript+File/23870/ Search Term = "navigator['hardwareConcurrency’]” URL = https://publicwww.com/websites/"navigator%5B%27hardwareConcurrency%27%5D"/ Returned results = 1665
- https://badpackets.net/how-to-find-cryptojacking-malware/ Coinhive Search term = "coinhive.min.js" URL = https://publicwww.com/websites/"coinhive.min.js"/ Returned results = 13884 AuthedMine Search term = authedmine && "captcha.min.js" URL = https://publicwww.com/websites/authedmine+%26%26+"captcha.min.js"/ Returned results = 272 https://isc.sans.edu/forums/diary/Cryptominer+Delivered+Though+Compromized+JavaScript+File/23870/ Search Term = "navigator['hardwareConcurrency’]” URL = https://publicwww.com/websites/"navigator%5B%27hardwareConcurrency%27%5D"/ Returned results = 1665
- https://badpackets.net/how-to-find-cryptojacking-malware/ Coinhive Search term = "coinhive.min.js" URL = https://publicwww.com/websites/"coinhive.min.js"/ Returned results = 13884 AuthedMine Search term = authedmine && "captcha.min.js" URL = https://publicwww.com/websites/authedmine+%26%26+"captcha.min.js"/ Returned results = 272 https://isc.sans.edu/forums/diary/Cryptominer+Delivered+Though+Compromized+JavaScript+File/23870/ Search Term = "navigator['hardwareConcurrency’]” URL = https://publicwww.com/websites/"navigator%5B%27hardwareConcurrency%27%5D"/ Returned results = 1665
- https://badpackets.net/how-to-find-cryptojacking-malware/ Coinhive Search term = "coinhive.min.js" URL = https://publicwww.com/websites/"coinhive.min.js"/ Returned results = 13884 AuthedMine Search term = authedmine && "captcha.min.js" URL = https://publicwww.com/websites/authedmine+%26%26+"captcha.min.js"/ Returned results = 272 https://isc.sans.edu/forums/diary/Cryptominer+Delivered+Though+Compromized+JavaScript+File/23870/ Search Term = "navigator['hardwareConcurrency’]” URL = https://publicwww.com/websites/"navigator%5B%27hardwareConcurrency%27%5D"/ Returned results = 1665
- https://www.wandera.com/cryptojacking-mobile-threat/
- https://www.wandera.com/cryptojacking-mobile-threat/
- https://www.bleepingcomputer.com/news/security/using-the-chrome-task-manager-to-find-in-browser-miners/
- https://blog.malwarebytes.com/101/2018/02/how-to-protect-your-computer-from-malicious-cryptomining/
- https://community.sophos.com/kb/en-us/127988
- https://blog.talosintelligence.com/2018/07/blocking-cryptomining.html
- https://security.berkeley.edu/services/network-intrusion-detection-systems/getting-more-information-about-isp-snort-rules Install snort Log into snort.org and find snippet to update snort Download and extract update Search for SID 44692 SID: 44692 alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"INDICATOR-OBFUSCATION CoinHive cryptocurrency mining attempt"; flow:to_client,established; file_data; content:"decodeURIComponent"; fast_pattern:only; content:"function"; nocase; content:"function"; within:50; nocase; content:"split"; within:200; content:"charCodeAt"; within:200; content:"push"; within:200; content:"charAt"; within:200; metadata:policy max-detect-ips drop, service ftp-data, service http, service imap, service pop3; classtype:misc-attack; sid:44692; rev:1;)
- ####### Update Snort ####### snort --version cd ~/Downloads/ https://www.snort.org/downloads/registered/snortrules-snapshot-2983.tar.gz?oinkcode=99a52bae5af6ff719d3ecb5fdf97a6d0f618ee76 mkdir snort cd snort tar -xvf ../snortrules-snapshot-2990.tar.gz sudo mv etc /etc/snort sudo mv rules /etc/snort/rules sudo service snort restart sudo /etc/init.d/snort restart
- Get-ExecutionPolicy Set-ExecutionPolicy remotesigned
- https://youtu.be/4DjHNtKWkes
- https://www.virustotal.com/en/file/fba937ffc0291601b7b03548dac94ef6f321077b96ec561c9f595fb71fc50ccb/analysis/1504908698/
- https://virustotal.github.io/yara/
- A first look at in browser Crypto Mining - https://arxiv.org/pdf/1803.02887.pdf