As the price of Ethereum and other cryptocurrencies rise, cybercriminals are beginning to create blockchain exploits to invade these digital marketplaces. Many of these threats involve stealing funds directly from mobile wallets and coin exchanges, but some can impact your overall enterprise and endpoint security.
DDoS Attacks, Mobile Wallet Theft and Blockchain Exploits
Perhaps the most devastating incidents have been distributed denial-of-service (DDoS) attacks, either on blockchain-based exchanges or other sources of cryptocurrency. The first such attack targeted the DAO joint Ethereum investment fund back in 2016, but security researchers have reported numerous other DDoS exploits since then.
Another popular blockchain exploit aims to infect mobile wallet apps and online exchanges where cryptocurrency is stored. In recent months, fraudsters have written specialized phishing lures to penetrate these systems.
But wallets aren’t the only sources of digital funds. Last year saw the rise of the initial coin offering, a funding event similar to an initial public offering (IPO), but using new cryptocurrencies that could hold value if the startup gains any traction.
While this sounds very exotic, the method of compromising one offering was fairly old school: Criminals replaced the Ethereum address on the Enigma cryptocurrency investment platform with their own address and collected $500,000 in investment funding for the startup before anyone from the company noticed the change. The replacement was a simple password attack that helped the actors gain access to the Enigma website. Although the money was eventually returned, the cryptocurrency and security communities should expect more of these attacks in 2018.
Mining Malware and Endpoint Security
Fraudsters have also been known to take over unsuspecting endpoint computers and use them to mine or create new crypto coins. Others, meanwhile, have gotten particularly creative in response to the increasing value of these cryptocurrencies. The Neptune exploit kit, for example, enables threat actors to hide their mining payloads in seemingly innocuous hiking advertisements. These tools register the attacker’s email address as the source of the mining operation before infecting the victim’s PC with malware.
Some browser-based malware scripts run in the background even after the user closes his or her browser session. This places the burden on endpoint detection tools to find these infections, which could allow fraudsters to process cycles from corporate PCs.
Mining malware often uses tools favored by other threat actors, such as the EternalBlue exploit, which was used in the WannaCry ransomware outbreak. Take Adylkuzz and CoinMiner, for example. Both use EternalBlue to infect other endpoints once they reach one PC on a network. These mining programs can be very hard to detect because they are often combined with other techniques, such as fileless methods, to hide their tracks.
Finally, NiceHash said it lost about $64 million worth of bitcoin during an attack on its systems in December. The Slovenian bitcoin trading marketplace enables customers to mine for cryptocurrencies by leveraging unused CPU cycles. Although NiceHash is a legitimate mining method, users should exercise extreme caution when using this and similar services.
The Future of Financial Cybercrime
The skyrocketing value of cryptocurrencies has ushered in a new wave of financial cybercrime. These blockchain exploits and mining schemes are growing more sophisticated and more effective every day as investors flock to buy up digital funds. Users should closely monitor their cryptocurrency wallets and implement robust endpoint security measures to protect their increasingly valuable digital funds from this burgeoning threat.
Download the Ransomware Response Guide from IBM Incident Response services