Daily Archives: May 20, 2017

Overview

On Friday, May 12, attackers spread a massive ransomware attack worldwide using the EternalBlue exploit to rapidly propagate the malware over corporate LANs and wireless networks. EternalBlue, originally exposed on April 14 as part of the Shadow Brokers dump of NSA hacking tools, leverages a vulnerability (MS17-010) in Microsoft Server Message Block (SMB) on TCP port 445 to discover vulnerable computers on a network and laterally spread malicious payloads of the attackers choice. This particular attack also appeared to use an NSA backdoor called DoublePulsar to actually install the ransomware known as WannaCry.

Over the subsequent weekend, however, we discovered another very large-scale attack using both EternalBlue and DoublePulsar to install the cryptocurrency miner Adylkuzz. Initial statistics suggest that this attack may be larger in scale than WannaCry: because this attack shuts down SMB networking to prevent further infections with other malware (including the WannaCry worm) via that same vulnerability, it may have in fact limited the spread of last weeks WannaCry infection.

Symptoms of this attack include loss of access to shared Windows resources and degradation of PC and server performance. Several large organizations reported network issues this morning that were originally attributed to the WannaCry campaign. However, because of the lack of ransom notices, we now believe that these problems might be associated with Adylkuzz activity. However, it should be noted that the Adylkuzz campaign significantly predates the WannaCry attack, beginning at least on May 2 and possibly as early as April 24. This attack is ongoing and, while less flashy than WannaCry, is nonetheless quite large and potentially quite disruptive.

The Discovery

In the course of researching the WannaCry campaign, we exposed a lab machine vulnerable to the EternalBlue attack. While we expected to see WannaCry, the lab machine was actually infected with an unexpected and less noisy guest: the cryptocurrency miner Adylkuzz. We repeated the operation several times with the same result: within 20 minutes of exposing a vulnerable machine to the open web, it was enrolled in an Adylkuzz mining botnet.

Figure 1: EternalBlue/DoublePulsar attack from one of several identified hosts, then Adylkuzz being download from another host - A hash of a pcap of this capture is available in the IOCs table

The attack is launched from several virtual private servers which are massively scanning the Internet on TCP port 445 for potential targets.

Upon successful exploitation via EternalBlue, machines are infected with DoublePulsar. The DoublePulsar backdoor then downloads and runs Adylkuzz from another host. Once running, Adylkuzz will first stop any potential instances of itself already running and block SMB communication to avoid further infection. It then determines the public IP address of the victim and download the mining instructions, cryptominer, and cleanup tools.

It appears that at any given time there are multiple Adylkuzz command and control (C&C) servers hosting the cryptominer binaries and mining instructions.

Figure 2 shows the post-infection traffic generated by Adylkuzz in this attack.

Figure 2: Post-infection traffic associated with the attack

In this attack, Adylkuzz is being used to mine Monero cryptocurrency. Similar to Bitcoin but with enhanced anonymity capabilities, Monero recently saw a surge in activity after it was adopted by the AlphaBay darknet market, described by law enforcement authorities as a major underground website known to sell drugs, stolen credit cards and counterfeit items. Like other cryptocurrencies, Monero increases market capitalization through the process of mining. This process is computationally intensive but rewards miners with funds in the mined currency, currently 7.58 Moneros or roughly $205 at current exchange rates.

Figure 3 shows Adylkuzz mining Monero cryptocurrency, a process that can be more easily distributed across a botnet like that created here than in the case of Bitcoin, which now generally requires dedicated, high-performance machines.

Figure 3: Part of the behavioral analysis from an Adylkuzz-infected VM showing it, among other things, closing SMB door and launching Monero Mining

One of several Monero addresses associated with this attack is shown in Figure 4. The hash rate shows the relative speed with which the specific associated instance of the botnet is mining Moneros, while the total paid shows the amount paid to this particular address for mining activities. In this case, just over $22,000 was paid out before the mining associated with this address ceased.

Figure 4: One of several Monero addresses associated with income from Adylkuzz mining

Looking at the mining payments per day associated with a single Adylkuzz address, we can see the increased payment activity beginning on April 24 when this attack began. We believe that the sudden drop that occurred on May 11 indicates when the actors switched to a new mining user address (Figure 5). By regularly switching addresses, we believe that the actors are attempting to avoid having too many Moneros paid to a single address.

Figure 5: Daily payment activity associated with a single Adylkuzz mining address

Statistics and payment history for a second payment address are shown in Figure 6. This address has had just over $7,000 paid to date.

Figure 6: A second Monero address associated with income from Adylkuzz mining

A third address shows a higher hash rate and a current payment total of over $14,000 (Figure 7).

Figure 7: A third Monero address associated with income from Adylkuzz mining

We have currently identified over 20 hosts setup to scan and attack, and are aware of more than a dozen active Adylkuzz C&C servers. We also expect that there are many more Monero mining payment addresses and Adylkuzz C&C servers associated with this activity.

Conclusion

Like last weeks WannaCry campaign, this attack makes use of leaked NSA hacking tools and leverages a patched vulnerability in Microsoft Windows networking. The Adylkuzz campaign, in fact predates WannaCry by many days. For organizations running legacy versions of Windows or who have not implemented the SMB patch that Microsoft released last month, PCs and servers will remain vulnerable to this type of attack. Whether they involve ransomware, cryptocurrency miners, or any other type of malware, these attacks are potentially quite disruptive and costly. Two major campaigns have now employed the attack tools and vulnerability; we expect others will follow and recommend that organizations and individuals patch their machines as soon as possible.

Acknowledgments

We want to thank:

Indicators of Compromise

Also available in MISP JSON format.

Select Dropped Samples

Executed commands:

taskkill /f /im hdmanager.exe C:Windowssystem32wbemwmiprvse.exe -secured -Embedding taskkill /f /im mmc.exe sc stop WELM sc delete WELM netsh ipsec static add policy name=netbc netsh ipsec static add filterlist name=block netsh ipsec static add filteraction name=block action=block netsh ipsec static add filter filterlist=block any srcmask=32 srcport=0 dstaddr=me dstport=445 protocol=tcp description=445 netsh ipsec static add rule name=block policy=netbc filterlist=block filteraction=block netsh ipsec static set policy name=netbc assign=y C:WindowsFontswuauser.exe --server C:WindowsFontsmsiexev.exe -a cryptonight -o stratum+tcp://xmr.crypto-pool.fr:443 -u 49v1V2suGMS8JyPEU5FTtJRTHQ9YmraW7Mf2btVCTxZuEB8EjjqQz3i8vECu7XCgvUfiW6NtSRewnHF5MNA3LbQTBQV3v9i -p x -t 1 C:WindowsTEMP\s2bk.1_.exe /stab C:WindowsTEMP\s2bk.2_.log taskkill /f /im msiexev.exe netsh advfirewall firewall delete rule name="Chrome" netsh advfirewall firewall delete rule name="Windriver" netsh advfirewall firewall add rule name="Chrome" dir=in program="C:Program FilesGoogleChromeApplicationchrome.txt" action=allow netsh advfirewall firewall add rule name="Windriver" dir=in program="C:Program FilesHardware Driver Managementwindriver.exe" action=allow C:Windows445.bat C:Windowssystem32PING.EXE ping 127.0.0.1 net stop Windows32_Update attrib +s +a +r +h wuauser.exe C:Windowssystem32SecEdit.exe secedit /configure /db C:Windowsnetbios.sdb C:Windowssystem32net1 stop Windows32_Update

Select ET signatures

2024217 || ET EXPLOIT Possible ETERNALBLUE MS17-010 Heap Spray 2024218 || ET EXPLOIT Possible ETERNALBLUE MS17-010 Echo Response 2024216 || ET EXPLOIT Possible DOUBLEPULSAR Beacon Response 2000419 || ET POLICY PE EXE or DLL Windows file download 2826160 || ETPRO TROJAN CoinMiner Known Malicious Stratum Authline (2017-04-28 1) 2017398 || ET POLICY Internal Host Retrieving External IP via icanhazip.com - Possible Infection 2022886 || ET POLICY Crypto Coin Miner Login

The rest is here:
Adylkuzz Cryptocurrency Mining Malware Spreading for Weeks ...

The total market capitalization of all cryptocurrencies reached an all-time high today, passing $60bn as the innovative assets continued to draw robust inflows.

This figure reached $63.6bn atone point during the day's trading, according to online data serviceCoinMarketCap, which represented a weekly, monthly and quarterly increase of roughly 18%, 115% and 220%, respectively.

While analysts cited different variables as fueling these gains, one factor they noted was growing awareness of cryptocurrencies, one that is finding them emerge as a more diverse set of investments than observed previously.

Tim Enneking, chairman of cryptocurrency hedge fund Crypto Asset Management, spoke to this development, stating:

"Cryptocurrencies are finally hitting the general consciousness whereas before they were marginal, with the possible exception of bitcoin."

As the assets draw "increased media coverage," Ryan Rabaglia, head trader for Octagon Strategy, told CoinDesk new investors are coming to the space.The growing interest in the space is also being felt at his over-the-counter (OTC) trading desk, which has been seeing a rise in business activity.

"Our onboarding rates have experienced a massive spike and our trading volumes, at mid-month, have already increased exponentially compared on a month-to-month basis. We do not see this quieting any time soon," he said.

When asked whether his company has experienced an increase in this activity amid the recent rally in cryptocurrency prices, Harry Yeh, managing partner of Binary Financial, told CoinDesk:

"There's definitely a larger demand, not just for bitcoin, but [for] everything across the board."

As for where cryptocurrency prices (and therefore total market cap) will go next, analysts offered mixed views. While the total value (and number) of assets in this space has surged in recent months, it is difficult to tell how much further they can climb without developing compelling value propositions.

Yeh offered an optimistic point of view, telling CoinDesk that "we are just getting started".

"People still don't really understand that there is a lot more room for this to move because it's a global phenomenon now. Expect more moves up but also some pullbacks like in the last week," he said.

Jacob Eliosoff, a cryptocurrency fund manager, offered a more cautious stance, telling CoinDesk that the market was "reaching the frenzy point". He expressed doubt as to how much longer these values would hold, noting that while nobody knows for sure when a bubble will pop, there are always warning signs.

Eliosoff stated that in this case, a "crackdown" oninitial coin offerings (ICOs), the process by which developers create new cryptocurrencies to fund projects, would likely spur a downturn.

He also asserted that should bitcoin prices see a downturn, the cryptocurrencyspace could see diminished confidence.

Price chart image via Shutterstock

Read more:
Cryptocurrency Market Cap Tops $60 Billion to Hit All-Time High - CoinDesk

Note: This is a precursory article, as the company has said they will be shipping units next week, and that there will be reviews and proof after that point. Nonetheless, we have decided to release the details we have now so that aspiring miners can make their own decisions regarding FoxMiners hardware.

The Bitcoin industry is so filled with scam artists, its instant and cash-like nature being attractive to them, that a given firm trying to enter the space is often marked guilty until proven innocent. While that may be what is going on with all the chatter aboutFoxMiners, it seems there are some legitimate reasons to be suspicious:

A company representative has said they will be shipping orders beginning Monday next week. Little of their story makes any sense, but we as journalists are charged with reporting the truth, so we will have to follow the story and see what happens. Our anonymous complainant makes a good point, however, saying:

I never received a receipt for payment, or any kind of notification. As stated, code on their page just rondomises a bunch of preprogrammed wallet codes, so there is no way for them to know who paid what. Generally for a Bitcoin transaction to occur for an online transaction, a wallet address would be generated and unique for each payment, so the supplier would know who is paying. I cannot see anyway that this isnt a scam.

Stay tuned. As far as we can tell, this could either be a great new mining company or another massive mining scam. Unfortunately there are no Bitcoin police, so stories like this will remain common for the forseeable future, and the best we can do is encourage our readers to know your provider, research anything that seems too good to be true, and, when possible, never pre-order anything.

Featured image from Shutterstock.

Follow this link:
Cryptocurrency Miner FoxMiners Rife With Scam Allegations - CryptoCoinsNews

Cryptocurrency is attracting mainstream attention, resulting in notable growth in trade volumes and token values.

Multiple blockchain-based currencies have seen massive growth since the beginning of 2017, including Bitcoin.

There has also been arecent boom in alternative cryptocurrencies, especially Ripple (XRP) and Ether (ETH).

This has caused Bitcoins share of the total cryptocurrency market cap to fall below 50% for the first time in history, despite thesignificant growth of the token.

One of the largest online cryptocurrency exchanges, Poloniex, recently issueda press release stating that it was working hard to cope with the influx of new users and increased transactions.

The exchange said that since January 2017, it has seen an increase of over 600% active traders online, and a 640% increase in the amount of transactions processed.

Poloniex said it is working to scale up its operations to meet the massive increase in active traders, including hiring more developers and exchange staff.

Read the rest here:
Massive cryptocurrency growth in 2017 - MyBroadband - MyBroadband

Ireland-based online foreign exchange AvaTrade has announced the addition of Ether, Dash, and Ripple to its trading portfolio. As per AvaTrade CEO Dire Ferguson:

"We are proud to be the first to introduce these exciting cryptocurrencies to our impressive instruments' selection."

AvaTrades announcement isnt surprising. The three rising cryptocurrencies have all experienced immense surges in their market caps over the past year. Global settlement network Ripple (XRP) has enjoyed a recent bullish run and managed to surpass Ether for second place on the market. Nevertheless, Ether (ETH) has risen approximately 680 percent over the past year, leaving its market position in a comfortable third place.Meanwhile, Dash (DASH) has also experienced a gradual climb. In March, the cryptocurrency skyrocketed to new highs and it currently occupies a solid sixth place spot on the market with a cap of $653,338,016 at the time of publication.

According to Ferguson, these were all positive indicators that the cryptocurrencies were ready to be traded on the Forex platform.

"The latest political and financial events have changed the trading world, and we work hard to ensure we stay on the top of our game, and always remain an industry leading brokerage."

Founded in 2006, AvaTrade is fully regulated in the European Union, Australia, Japan, South Africa, and the British Virgin Islands. The foreign exchange offers over 250 financial instruments, trading platforms, and mobile apps to its customer base.

Dan is a US Army veteran and Los Angeles-based writer passionate about science and technology, current events, human rights, economic impacts, and strategic calculus. Dan is a full time staff writer for ETHNews and holds value in Ether.

Read the original:
Foreign Exchange Adds Cryptocurrencies To Its Trading Portfolio ... - ETHNews (press release) (blog)

The global financial sector and economy have been transforming at a considerably fast rate during the past few years. Digitized assets, cryptocurrencies and innovative financial systems are creating new ecosystems for monetary transactions and formulating alternative assets that have become parts of a modern portfolio. Since its establishment in 2015, the Cambridge Centre for Alternative Finance, has pioneered the analysis and documentation of the present digital economic transformation.

The Cambridge Centre of Alternative Finance has just published a benchmarking study of the current global cryptocurrency economy. By far, this is the first study ever to closely examine the global cryptocurrency economy and its essential components including wallets, exchanges, payments and mining.

The study presented some interesting results, which we will summarize throughout ths article:

There are currently between 2.9 million and 5.8 million unique users of various cryptocurrency wallets. The study reported that there are currently at least 1,876 individuals, all over the world, who work full time in the cryptocurrency sector, yet there are most likely more than 2,000 workers in this sector when considering large mining companies and other businesses, which did not provide the needed headcount numbers.

Cryptocurrency exchanges have the largest number of operating companies and employ more individuals than any other sector in the cryptocurrency industry. Exchanges are dispersed upon a wide geographical area and are not confined to a certain area or continent. Interestingly enough,52% of small cryptocurrency exchanges had a formal governmental license, as opposed to only 35% of larger exchanges. 13% of employees on exchanges were responsible for the security of the platforms. An average of 17% of an exchanges budget is spent on security maintenance.

The study estimated the number of active cryptocurrency wallets to be somewhere between 5.8 million and 11.5 million. The demarcation between exchanges and wallets is considerably blurred, as 52% of wallets were found to offer integrated cryptocurrency exchange options, of those 80% offered a fiat-to-cryptocurrency exchange service. Oppositely to exchanges, most online wallets do not control the private keys of the coins of the users.

Even though 79% of cryptocurrency businesses have relationships with retail banks and payment networks, the difficulty of establishing and maintaining such relationships is still the industrys biggest challenge. Averagely, fiat-to-cryptocurrency payments comprise 66.6% of the transaction volumes of various cryptocurrency payment companies, while fiat-to-fiat transactions and crypto-to-crypto transactions represent 27% and 6% respectively.

70% of large cryptocurrency miners have high influence on protocol development, as compared to only 51% of small cryptocurrency miners. The map of miners shows that big mining facilities are dispersed all across the globe, yet a large number of these facilities exists in certain Chinese areas.

The Cambridge Centre of Alternative Finance has just published the first study of its kind to highlight some of the basic elements of the current cryptocurrency economy. More similar studies have to be conducted periodically to monitor the transformation of the global economy via the blockchain technology during the upcoming years.

Image source:The Cambridge Centre of Alternative Finance

About Dr Tamer Sameeh

View all posts by Dr Tamer Sameeh

Read the original here:
Benchmarking the Global Cryptocurrency Economy - A Research Study - Live Bitcoin News

NEW DELHI: Allaying fears that after "WannaCrypt" ransomware, India will be targeted by a cryptocurrency malware attack that quietly but swiftly generates digital cash from machines it has infected, the country's cyber security unit on Thursday said India is safe from the "Adylkuzz" malware.

"There are no reports of this 'Adylkuzz' malware from the Indian establishments yet. Users are advised to maintain updated anti-virus software and apply patches to operating systems and applications on regular basis," Sanjay Bahl, Director General of the Computer Emergency Response Team (CERT-In), said.

After facing a massive ransomware attack that exploited a vulnerability in a Microsoft software and hit 150 countries, the same Windows vulnerability (MS17-010) was also exploited to spread "Adylkuzz" by another group of hackers.

According to a report in The Registrar, tens of thousands of computers globally have been affected by the "Adylkuzz attack" that targets machines, lets them operate and only slows them down to generate digital cash or "Monero" cryptocurrency in the background.

"Monero" -- being popularised by North Korea-linked hackers -- is an open-source cryptocurrency created in April 2014 that focuses on privacy, decentralisation and scalability.

It is an alternative to Bitcoin and is being used for trading in drugs, stolen credit cards and counterfeit goods.

"There is no need to panic as "CERT-In publishes regular advisories and vulnerability notes on its website as well as some on Cyber Swachhta Kendra website," Bahl said.

According to Nick Savvides, Manager, Cyber Security Strategy at Symantec who is based out of Melbourne, Australia, the attack is not on the math behind the cryptocurrencies.

"Instead, it is based on compromising computer to be used to mine cryptocurrencies for the benefit of attackers. Essentially stealing people's power and CPU to generate new cryptocurrency coins," Savvides said.

Organisations should never conclude that the absence of a major cyber-attack means that they have effective cyber defences.

"'WannaCry' and 'Adylkuzz' show how important security patches are, in building and maintaining those effective defences, and why regular patching plans to mitigate environment vulnerabilities need to become a higher priority," added Steve Grobman, Senior Vice President and Chief Technology Officer, McAfee.

One difference between "Adylkuzz" and "WannaCry" is that it is advantageous for "Adylkuzz" to remain undetected and run as long as possible to maximise the amount of time a machine can be used for mining.

"There are the latest reminders of how the 'to patch or not to patch' risk analysis needs to be rethought within organisations worldwide," Grobman said.

View post:
No reports yet of cryptocurrency malware attacks in India - Economic Times