On the week of January
8th, many web servers were hit by the malware, RubyMiner which attempted to
take control of servers and install the Crypto mining software. Using
vulnerabilities from PHP, Microsoft IIS, or Ruby on Rails, the malware could
install the Monero miner (XMRig). Since the popularity and rise of
cryptocurrency, attackers have been looking for computers to mine crypto coins.
Initially, desktop machines were used, but more recently, web servers were
targeted for their CPU power. In just one day on Jan 11th, about 700 servers
were enslaved to make $540 (Checkpoint Research, 2018).
The malware can be executed on Windows or Linux systems, and has affected web servers in the United States, Germany, United Kingdom, Norway, and Sweden. On vulnerable web servers, the malware downloads and runs the robots.txt file which installs the crypto mining software. Since the malware is instructed to run hourly, the attackers can issue a kill command at any time by modifying the robots.txt file. So far, the compromised domain, lochjol.com is being used for attacks. The Monero miner usually sends 5% of the proceeds to the author of the code, but the attackers have removed that piece of the code to retain all the currency.
Since attackers are utilizing known vulnerabilities that were patched in 2012 and 2013, web server owners should quickly review and update their servers. Also, the incident of compromises should be reviewed so that intrusion detection system can be updated to catch the malware. As the crypto mining software continues to run, it will use up all the resources for the web server and decrease its performance. Also, the attackers are making currency for free with no overhead expenses. Go and update your web servers today!
References
The malware can be executed on Windows or Linux systems, and has affected web servers in the United States, Germany, United Kingdom, Norway, and Sweden. On vulnerable web servers, the malware downloads and runs the robots.txt file which installs the crypto mining software. Since the malware is instructed to run hourly, the attackers can issue a kill command at any time by modifying the robots.txt file. So far, the compromised domain, lochjol.com is being used for attacks. The Monero miner usually sends 5% of the proceeds to the author of the code, but the attackers have removed that piece of the code to retain all the currency.
Since attackers are utilizing known vulnerabilities that were patched in 2012 and 2013, web server owners should quickly review and update their servers. Also, the incident of compromises should be reviewed so that intrusion detection system can be updated to catch the malware. As the crypto mining software continues to run, it will use up all the resources for the web server and decrease its performance. Also, the attackers are making currency for free with no overhead expenses. Go and update your web servers today!
References
Arghire, I. (2018, Jan
17). Crypto-Mining Attack Targets Web Servers Globally. Retrieved from
http://www.securityweek.com/crypto-mining-attack-targets-web-servers-globally
Checkpoint Research. (2018, Jan 11). ‘RubyMiner’ Cryptominer Affects 30% of WW Networks. Retrieved from https://research.checkpoint.com/rubyminer-cryptominer-affects-30-ww-networks/
Checkpoint Research. (2018, Jan 11). ‘RubyMiner’ Cryptominer Affects 30% of WW Networks. Retrieved from https://research.checkpoint.com/rubyminer-cryptominer-affects-30-ww-networks/
No comments:
Post a Comment