Colocation Users Should Be Alert To The Threat Of Cryptojacking | Cyber Wurx
Colocation | Dedicated Servers | Customer Center | About Cyber Wurx
Blog | Our Data Center | Contact Us
- Phone: 1-888-874-4592
If you were to design the perfect money-spinning tool for cybercriminals, it would probably look something like a cryptocurrency. There is no need to sell data or credit card numbers, create spurious advertising campaigns, or deal with less-than-honest middlemen to make a buck. All the enterprising criminal has to do is compromise a server, install cryptomining malware, point it at their digital wallet, and wait for the money to come rolling in.
Tesla is the latest high-profile victim of cryptojacking — the use of cryptomining malware to generate coins. The Tesla story is interesting from several perspectives that are relevant to colocation clients, not least the technique the attackers used to compromise Tesla’s servers. The attackers used an unsecured Kubernetes console to access credentials for Tesla’s cloud infrastructure, giving them access to sensitive data and the infrastructure on which they ran the cryptomining software.
Businesses are likely to see their security systems come under even greater pressure because of:
- The ease with which cryptomining can be used to generate revenue for criminals.
- The rising value of cryptocurrencies.
- The increasing expense of legitimate mining.
A recent survey revealed that cryptomining malware affects 23% of organizations globally, and although cryptomining might seem relatively benign compared to ransomware, the cost in wasted infrastructure and energy are not insignificant (aside from the fact that being infected with cryptomining malware is an obvious indication of infrastructure vulnerability).
There are two main techniques criminals use to mine:
- They use compromised infrastructure to mine directly.
- They use their access to that infrastructure to embed JavaScript mining code in user-facing sites and applications, recruiting both the business and its customers into a distributed mining operation.
The method used to compromise servers is often fairly typical: outdated software, brute force attacks, or supply chain attacks. In this case and several others, the culprit was a woefully insecure Kubernetes installation. Kubernetes is used by many businesses, including colocation clients, to deploy, scale, and manage containerized applications. Much of that management takes place via a web console which isn’t password protected by default.
Lessons learned:
- If you’re using Kubernetes, make sure you have password protected the console.
- Be careful about where your business stores access credentials for its infrastructure.
- Consider a bug bounty program to incentivize researchers to report vulnerabilities.