Seyfullah Kilic - Hacking Cryptocurrency Miners with OSINT Techniques
•Download as PPTX, PDF•
2 likes•737 views
HackIT is an annual cybersecurity conference that gathers the best technical researchers and top players in the cybersecurity industry to explore cutting-edge technologies together. In 2018, HackIT focused on the use of blockchain technology. Join our community: Website - https://hacken.live/hackit-slideshare Twitter - https://hacken.live/twitter_hackit Facebook - https://hacken.live/facebook_hackit Instagram - https://hacken.live/instagram_hackit Reddit - https://hacken.live/reddit Telegram community - https://hacken.live/tg-hackit #hackit #cybersecurity #blockchain #hacking
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Seyfullah Kilic - Hacking Cryptocurrency Miners with OSINT Techniques
Similar to Seyfullah Kilic - Hacking Cryptocurrency Miners with OSINT Techniques (20)
More from Hacken_Ecosystem
More from Hacken_Ecosystem (11)
Recently uploaded
Recently uploaded (20)
Seyfullah Kilic - Hacking Cryptocurrency Miners with OSINT Techniques
- 1. Hacking Cryptocurrency Attacks on Ethereum Smart-Contract Hacking of mining devices Other Special Tactics for your security HackIT 4.0, Kyiv
- 2. ○ Who am I ? ○ OSINT and Cryptocurrency ○ Hacking Mining Devices with OSINT Techniques ○ Web Browser Mining Attacks ○ MyEtherWallet DNS Hijacking ○ Attacks on Ethereum Smart-Contract AGENDA HackIT 4.0, Kyiv
- 3. Seyfullah KILIÇ Software Engineer Security Researcher over 10 years Listed Google Hall of Fame Founder of @SwordSec HELLO! HackIT 4.0, Kyiv
- 4. ○ Information gathering from public sources ○ Gather Intelligence for both Offensive & Defensive Strategies ○ Analysis of data or attackers OSINT ? HackIT 4.0, Kyiv
- 5. ○ Tracking Wallet ○ Discovering Private Keys ○ Exploration of Mining Devices OSINT and Cryptocurrency HackIT 4.0, Kyiv
- 8. ○ REQUIREMENTS ○ A Google Cloud Account ○ Simple SQL Knowledge ○ Javascript or Python ○ Pastebin PRO Account Searching Ethereum Private Key HackIT 4.0, Kyiv
- 10. HackIT 4.0, Kyiv
- 12. HackIT 4.0, Kyiv
- 14. HackIT 4.0, Kyiv
- 16. HackIT 4.0, Kyiv
- 17. Hacking Mining Devices with OSINT Techniques
- 18. Shodan is the world's first search engine for Internet-connected devices. Censys Finding and analyzing every reachable server and device on the Internet. Shodan and Censys
- 20. Hacking “antMiner s9” Discovering antMiner mining hardware and accessing to them...
- 22. (antminer) AND protocols.raw: “80/http” AND 80.http.get.title: “401”
- 23. Default root password: root
- 25. Hacking “Claymore Miner” Discovering Ethereum mining rigs and exploit them...
- 27. “ETH - Total Speed:” “method”:”miner_getstat1”
- 30. What more can be done? You can improve search techniques with OSINT for gathering massive data You can even damage all GPUs by controlling the fans after editing the config.txt
- 31. Setup a firewall in front of Mining Rig Close write permissions Change root password Protection Method
- 32. Browser Based Web Mining Attacks
- 33. What is Browser Mining ○ Generally Used Javascript API to mine the Monero ○ Most Popular website is CoinHive.com ○ CoinHive is blocked by Turkey and other countries' ISP
- 34. Browser Mining Attack Vectors ○ MITM Attack and Injecting the Javascript Codes ○ Injecting html codes by hacking popular websites ○ DNS Hijacking
- 40. Use “Mining Blocker” Extension on Chrome Check Processes and CPU Usage Force HTTPS Protection Method
- 50. DNSSEC (Resolvers deny fake records) Use Chrome Extensions HSTS (browsers check self- signed certs.) Protection Method
- 51. Bank Robbery last 50 years
- 52. Now, Bank Robbery like this Bank Robbery
- 53. $0,57 Fee
- 54. 83,017 ETHER
- 55. ● Top 5 Ethereum Smart-Contract Attacks ○ Reentrancy ○ Access Control ○ Arithmetic Issues (Integer Overflow & Underflow) ○ Denial of Service ○ Bad Randomness Attacks on Ethereum Smart- Contract
- 56. ● LOSS: ~3.5M ETH ● Example: The DAO Hacking ● also known as recursive call vulnerability Reentrancy Attacks
- 57. ● LOSS: ~150,000 ETH ● Example: Parity Multi-Sig ● also known as multisig Vulnerability Access Control Attacks
- 58. ● LOSS: Unknown ● Example: DAO ● also known as integer overflow/underflow Arithmetic Issues
- 59. ● LOSS: ~514,874 ETH ● Example: Parity Multi-Sig wallet ● including gas limit reached, unexpected throw, unexpected kill, access control breached Denial of Service
- 60. ● LOSS: More than 400 ETH ● Example: SmartBillions Lottery ● also known as nothing is secret Bad Randomness
- 61. Your Photo Name: Seyfullah KILIÇ Company: SwordSec Position: CEO linkedin.com/in/s3yfullah facebook.com/SwordSec seyfullah@swordsec.com HackIT 4.0, Kyiv