Re Millions of PCs Targeted by Cryptocurrency-Mining Malware

["Dave Farber" <dave () farber net>]

---------- Forwarded message ---------
From: Joly MacFie <joly () punkcast com>
Date: Sat, Jan 27, 2018 at 10:12 PM
Subject: Re: [IP] Millions of PCs Targeted by Cryptocurrency-Mining Malware
To: dave <dave () farber net>, Dewayne Hendricks <dewayne () warpspeed com>
CC: ip <ip () listbox com>


Hi Dave, Dewayne,

At the Radical Networks Conference last November there was one presentation
'Browser as Botnet' with a live demo of a similar thing. You hit the the
page, it steals your CPU.  For the presentation it was activated on the
Radical Networks homepage. SInce I was streaming I was on that page to view
the agenda.. I started going nuts when my encoder jumped to 100% CPU. I
madly swapped browsers from chrome to firefox to edge, before I twigged
what he was saying!. If you watch the video he apologizes to me.
Fortunately I was on a very robust  Z820 with twin Xeons, and the stream
continued uninterrupted throughout.

https://livestream.com/internetsociety/radnets17/videos/164720367

joly

On Sat, Jan 27, 2018 at 7:38 AM, Dave Farber <farber () gmail com> wrote:

> Begin forwarded message:
>
> *From:* Dewayne Hendricks <dewayne () warpspeed com>
> *Date:* January 27, 2018 at 5:27:57 AM EST
> *To:* Multiple recipients of Dewayne-Net <dewayne-net () warpspeed com>
> *Subject:* *[Dewayne-Net] Millions of PCs Targeted by
> Cryptocurrency-Mining Malware*
> *Reply-To:* dewayne-net () warpspeed com
>
> [Note:  This item comes from friend Steve Goldstein.  DLH]
>
> Millions of PCs Targeted by Cryptocurrency-Mining Malware
> The hackers behind the malware appear to have been selling the hijacked
> computing power on the mining platform NiceHash, according to Palo Alto
> Networks.
> By Michael Kan
> Jan 25 2018
> <
> https://www.pcmag.com/news/358766/millions-of-pcs-targeted-by-cryptocurrency-mining-malware
> >
>
> Malware is increasingly developing an appetite for cryptocurrency mining.
> One newly discovered strain has tried to infect millions of Windows
> machines, all in an effort to siphon their computing power and possibly
> sell it for mining purposes.
>
> The operation has been going on for over four months, and may have
> targeted around 15 million machines or more, security firm Palo Alto
> Networks saidWednesday.
>
> To spread the malware, the hackers have been disguising the code as EXE
> files made to look like file-sharing downloads with names such as
> "File4org," "RapidFiles" and "Dropmefiles." Those EXE files have then been
> circulated online via shortened URL links through services like Bitly and
> possibly Adfly. It isn't clear where the hackers have been posting the
> links, but they've generated at least 15 million clicks, according to Palo
> Alto Networks.
>
> Once the malware infects, it will secretly run an open-source utility
> called XMRig, which mines Monero, a digital currency now worth about $310
> per coin.
>
> "In this case the attackers set it to never use more than 20 percent of
> (CPU) resources," said Josh Grunzweig, a malware researcher with Palo Alto
> Networks, in an email. As a result, most victims probably won't notice that
> the mining is taking place.
>
> However, the hackers may be less interested in generating the Monero for
> themselves than helping others mine it. The malware's code actually
> contains a reference to NiceHash, an online marketplace for people to buy
> and sell computing power to mine cryptocurrencies.
>
> "In our research, we've seen that the attackers using it as the
> marketplace where they 'sell' the hash processing power of the systems
> they've loaded XMRig on," Grunzweig said.
>
> Palo Alto Networks doesn't know how much Monero the hackers have mined
> with their malware, but it's been targeting computers mainly in Southeast
> Asia, North Africa and South America.
>
> [snip]
>
> Dewayne-Net RSS Feed: http://dewaynenet.wordpress.com/feed/
> Twitter: https://twitter.com/wa8dzp


-- 
---------------------------------------------------------------
Joly MacFie  218 565 9365 <(218)%20565-9365> Skype:punkcast
--------------------------------------------------------------
-
This message was sent to the list address and trashed, but can be found
online.
<https://www.listbox.com/login/messages/view/20180127221230:116CFDC2-03D9-11E8-92DD-D31883ABC8C8/>



-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/18849915-ae8fa580
Modify Your Subscription: https://www.listbox.com/member/?member_id=18849915&id_secret=18849915-aa268125
Unsubscribe Now: 
https://www.listbox.com/unsubscribe/?member_id=18849915&id_secret=18849915-32545cb4&post_id=20180127225240:AE2A64CE-03DE-11E8-86DA-C067F3CA041F
Powered by Listbox: http://www.listbox.com