Despite these setbacks, hackers are adapting to more creative ways of launching mining attacks, according to a new report from AT&T Cybersecurity (formerly AlienVault), which found that hackers are targeting cloud computing services, container platforms, and control panel packages of web hosting solutions.
SEE: Top cloud providers 2019: A leader’s guide to the major players (Tech Pro Research)
In February 2018, hackers compromised the Kubernetes infrastructure on Amazon Web Services (AWS) of electric car manufacturer Tesla, mining for Monero. The report notes that “In the event of such unrestricted access, cryptocurrency mining is one of the least malicious outcomes to victim organization. For example, customer data and business operations could be at risk for theft or malicious modification.”
Docker images in hosted on Dockerhub, the official container repository, have been found to host Monero miners. Meanwhile, ZDNet’s Charlie Osborne reported earlier this month that vulnerability CVE-2019-5736, publicly reported in February, could be used to secure host root access from a Docker container, which, combined with an exposed remote Docker API, could lead to a fully compromised host.
The risks of browser-based cryptojacking have not evaporated. “There are Coinhive alternatives so the threat hasn’t disappeared,” AT&T Cybersecurity researcher Chris Doman told TechRepublic, “but we seem to be a long way from the days when Coinhive was popping up on all kinds of websites. I think we’ll still see Coinhive style ‘in-browser’ mining kits in use against routers and websites.”
For more on the risks of cryptojacking, see TechRepublic’s coverage of why cryptojacking will become an even larger problem in 2019, and a new detection method to identify cryptomining and other fileless malware attacks, as well as Cryptojacking cyberattacks: Is the end now in sight? at ZDNet.
Jirapong Manustrong, Getty Images/iStockphoto