Hackers Exploiting Microsoft Servers to Mine Monero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-7269 | Buffer Overflow in Microsoft IIS 6.0 via WebDAV PROPFIND Header CVE-2017-7269 is a buffer overflow (CWE-119) in Internet Information Services (IIS) 6.0, the web server shipped with Microsoft Windows Server 2003 R2. A remote attacker triggers it by sending a WebDAV PROPFIND request whose overly long header begins with 'If: <http://', overflowing a buffer during header parsing. Successful exploitation allows remote code execution on the affected web server, giving the attacker control of the host at the web service's privilege level. Only organizations still running IIS 6.0 on Windows Server 2003 R2 are affected, typically legacy web servers, since that OS reached end of support in July 2015. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a 99.8% EPSS score (100th percentile), indicating active in-the-wild exploitation; no public PoC is recorded in this data and, because the OS is out of support, no generally distributed patch exists. Do: Inventory internet-facing systems still running IIS 6.0 on Windows Server 2003 R2 and prioritize migration to a supported Windows/IIS version, since no general patch was released for this out-of-support product (custom-support customers may be able to obtain a hotfix from Microsoft). As interim mitigation, disable WebDAV if it is not needed, or block or limit PROPFIND requests and long 'If' headers via IIS request filtering, a reverse proxy, or a WAF. Per the KEV entry, apply updates per vendor instructions; ransomware association is currently unknown. | 9.8 | 100% | KEV PoC ×5 |
| largetens of thousands of internet-exposed IIS 6.0 servers today (hundreds of thousands at the 2017 disclosure) |
Full article447 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalSep 28, 2017
Mining cryptocurrencies can be a costly investment as it takes a monstrous amount of computing power, and thus hackers have started using malware that steals computing resources of computers it hijacks to make lots of dollars in digital currency.
Security researchers at security firm ESET have spotted one such malware that infected hundreds of Windows web servers with a malicious cryptocurrency miner and helped cybercriminals made more than $63,000 worth of Monero (XMR) in just three months.
According to a report published by ESET today, cybercriminals only made modifications to legitimate open source Monero mining software and exploited a known vulnerability in Microsoft IIS 6.0 to secretly install the miner on unpatched Windows servers.
Although ESET's investigation does not identify the attackers, it reports that the attackers have been infecting unpatched Windows web servers with the cryptocurrency miner since at least May 2017 to mine 'Monero,' a Bitcoin-like cryptocurrency.
The vulnerability (CVE-2017-7269) exploited by the attackers was discovered in March 2017 by Zhiniang Peng and Chen Wu and resides in the WebDAV service of Microsoft IIS version 6.0—the web server in Windows Server 2003 R2.
Therefore, hackers are only targeting unpatched machines running Windows Server 2003 to make them part of a botnet, which has already helped them made over $63,000 worth of Monero.
Since the vulnerability is on a web server, which is meant to be visible from the internet, it can be accessed and exploited by anyone. You can learn more about the vulnerability here.
The newly discovered malware mines Monero that has a total market valuation of about $1.4 billion, which is far behind Bitcoin in market capitalisation, but cybercriminals’ love for Monero is due to its focus on privacy.
Unlike Bitcoin, Monero offers untraceable transactions and is anonymous cryptocurrency in the world today.
Another reason of hackers favouring Monero is that it uses a proof-of-work algorithm called CryptoNight, which suits computer or server CPUs and GPUs, while Bitcoin mining requires specific mining hardware.
However, this is not the first time when analysts have spotted such malware mining Monero by stealing computing resources of compromised computers.
In mid-May, Proofpoint researcher Kafeine discovered cryptocurrency mining malware, called 'Adylkuzz,' which was using EternalBlue exploit—created by the NSA and dumped last month by the Shadow Brokers in April—to infect unpatched Windows systems to mine Monero.
A week before that, GuardiCore researchers discovered a new botnet malware, dubbed BondNet, that was also infecting Windows systems, with a combination of techniques, for primarily mining Monero.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2017/09/windows-monero-miners.html