IFSECInsider-Logo-Square-23

Author Bio ▼

IFSEC Insider, formerly IFSEC Global, is the leading online community and news platform for security and fire safety professionals.
January 1, 2014

Download

Whitepaper: Enhancing security, resilience and efficiency across a range of industries

More than 100 flavors of malware stealing bitcoins

For just USD 35, you can buy a popular specialized malware tool that steals Bitcoins and other such electronic currency — and researchers have unearthed more than 100 different malware families that specialize in this form of theft. Dell SecureWorks researchers Joe Stewart and Pat Litke discovered 80 of those cryptocurrency-stealing malware families in just the past year as thieves clamor to cash in on the growing use of digital currency. Some of the malware variants are custom, while others are cranked out via malware-generator tools, but either way, the average rate of detection across all antivirus tools is just under 50 percent, the researchers said here this week.

“They [Bitcoins and digital currency] are very easy to steal,” says Joe Stewart, director of malware research for SecureWorks. While there are some sophisticated hackers stealing the currency, many of the thieves are novice “script kiddies” who get the cheap tools to snatch the currency from unsuspecting victims. “In my opinion, most of them are individual actors. I don’t know if you’d want a group of people doing it” due to the challenge of splitting the ruins, he says. “There’s definitely big overhead in trying to launder money from credit cards and bank accounts, but there’s none [overhead] in Bitcoins, so there’s no risk,” he says. “And there’s been no single case of law enforcement with someone who stole a Bitcoin.”

If banks eventually adopt Bitcoin, then law enforcement would be motivated to pursue investigations into cryptocurrency theft. These thefts are happening around the glob, according to SecureWorks, including in the U.S. and Europe. Bitcoins and other forms of cryptocurrency are getting pilfered via wallet-stealing malware and credential-stealing malware, as well as via man-in-the browser attacks and phony currency with embedded wallet-stealing malware, Stewart and Litke found. PredatorPain ins the most pervasive flavor of this malware. It’s a credential- and file-stealing Trojan that was first released in 2009, and goes for about USD 35 in the hacker underground.

Another malware family called SovietMiner steals wallet files and forces the victim’s machine to mine alternative coins for the bad guys’ profit. This malware goes for about USD 15 per month. Stewart says it’s difficult to get a handle on the total losses being suffered by cryptocurrency owners, but he saw one case this week where the victim lost to thieves 127 Bitcoins valued at $540 apiece. “They were hacked not through malware but a vulnerability in a third-party search engine,” Stewart says. “Users are their own banks with cryptocurrency, so it’s hard to get numbers” in total losses, he says. “Every day I go into these forums, someone got robbed. Their wallet was emptied and they don’t know what happened,” Stewart says. “They had the latest antivirus updates,” but it still didn’t matter, he says. Wallet-stealing malware is the most popular form of this crimeware, which searches for “wallet.dat” or other known wallet software key storage files. Once that file is found, the wallet gets uploaded to a remote FTP, Web, or SMTP server where the thief extracts the keys and grabs the coins, signing a transaction that transfers them to his account.

Credential-stealing malware go after the Bitcoin user’s Bitcoin exchange credentials. “Many exchanges have implemented two-factor authentication using one-time PINs to combat unauthorized logins,” Stewart and Litke wrote in a report released today on their findings. “However, more advanced malware can easily bypass OTP-based 2FA, by intercepting the OTP as it is used and creating a second hidden browser window in order to log the thief into the account from the user’s own computer.” Man-in-the browser malware intercepts the transaction and changes the recipient address before it’s signed. The malware waits for new content hitting the clipboard: if it contains a valid Bitcoin address, the malware injects its own address to get the coins. The bottom line is that Bitcoins are a risky business. “A lot of people using Bitcoins don’t understand what they are doing with them,” Stewart says. “And if a Bitcoin is stolen, you don’t get it back. There’s no bank to back you, no insurance. Our goal with this paper is to get it out there how bit this threat has become … [people] just have to get better security practices in storing Bitcoin wallets.”

There are some ways to protect this digital currency, such as alternative wallets like Armory and Electrum that split up key storage. An offline computer stores the private key for signing transactions, while another machine connected to the Internet holds the master key. Hardware wallets, meanwhile, operate in a key fob style, and transaction integrity verification is an emerging option.

Free Download: The Video Surveillance Report 2023

Discover the latest developments in the rapidly-evolving video surveillance sector by downloading the 2023 Video Surveillance Report. Over 500 responses to our survey, which come from integrators to consultants and heads of security, inform our analysis of the latest trends including AI, the state of the video surveillance market, uptake of the cloud, and the wider economic and geopolitical events impacting the sector!

Download for FREE to discover top industry insight around the latest innovations in video surveillance systems.

VideoSurveillanceReport-FrontCover-23

Related Topics

Subscribe
Notify of
guest
0 Comments
Inline Feedbacks
View all comments