Crooks hacked Microsoft servers to mine Monero, they earned $63K in 3 months
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-7269 | Buffer Overflow in Microsoft IIS 6.0 via WebDAV PROPFIND Header CVE-2017-7269 is a buffer overflow (CWE-119) in Internet Information Services (IIS) 6.0, the web server shipped with Microsoft Windows Server 2003 R2. A remote attacker triggers it by sending a WebDAV PROPFIND request whose overly long header begins with 'If: <http://', overflowing a buffer during header parsing. Successful exploitation allows remote code execution on the affected web server, giving the attacker control of the host at the web service's privilege level. Only organizations still running IIS 6.0 on Windows Server 2003 R2 are affected, typically legacy web servers, since that OS reached end of support in July 2015. The flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a 99.8% EPSS score (100th percentile), indicating active in-the-wild exploitation; no public PoC is recorded in this data and, because the OS is out of support, no generally distributed patch exists. Do: Inventory internet-facing systems still running IIS 6.0 on Windows Server 2003 R2 and prioritize migration to a supported Windows/IIS version, since no general patch was released for this out-of-support product (custom-support customers may be able to obtain a hotfix from Microsoft). As interim mitigation, disable WebDAV if it is not needed, or block or limit PROPFIND requests and long 'If' headers via IIS request filtering, a reverse proxy, or a WAF. Per the KEV entry, apply updates per vendor instructions; ransomware association is currently unknown. | 9.8 | 100% | KEV PoC ×5 |
| largetens of thousands of internet-exposed IIS 6.0 servers today (hundreds of thousands at the 2017 disclosure) |
Full article515 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 29, 2017
Experts from security firm ESET discovered cyber criminals exploiting Microsoft Servers to mine Monero and already earned $63,000 in 3 Months.
Mining cryptocurrencies is a profitable business, but it is also expensive because it needs significant investment in computing power. Crooks are using malicious code that steals computing resources of victims’ machine and the number of attacks aimed to mine cryptocurrencies continues to increase.
Security researchers at security firm ESET have discovered a malware campaign that infected hundreds of Windows web servers with a malicious cryptocurrency miner. According to the experts, the criminal gang behind the attack made more than $63,000 worth of Monero (XMR) in just three months.
Crooks modified a legitimate open source Monero mining code and exploited a known buffer overflow vulnerability (CVE-2017-7269) in Microsoft IIS 6.0 to deploy the miner on unpatched Windows servers.
“One such operation has been going on since at least May 2017, with attackers infecting unpatched Windows webservers with a malicious cryptocurrency miner. The goal: use the servers’ computing power to mine Monero (XMR), one of the newer cryptocurrency alternatives to Bitcoin.” states a report published by ESET.
“To achieve this, attackers modified legitimate open source Monero mining software and exploited a known vulnerability in Microsoft IIS 6.0 to covertly install the miner on unpatched servers. Over the course of three months, the crooks behind the campaign have created a botnet of several hundred infected servers and made over USD 63,000 worth of Monero.”
The impact of the CVE-2017-7269 vulnerability is significant, according to data provided by the W3Techs, Microsoft’s IIS is currently the third most popular web server solution in the wild (11.4% of all websites). IIS 6.0 accounts for 11.3%, roughly 1.3% of all websites on the Internet. According to BuiltWith, IS 6.0 version is currently used by 2.3% of the entire Internet, over 8.3 million live websites are using IIS 6.0.
The vulnerability doesn’t affect newer versions of Microsoft Internet Information Services.
In order to mitigate the risk of cyber attacks, it is possible to disable the WebDAV service on IIS 6.0 installations.
Crooks are focusing their efforts on Monero cryptocurrency because of its focus on privacy and because it has a good mining profitability, it leverages on the proof-of-work algorithm called CryptoNight, which suits computer or server CPUs and GPU without requiring specific mining hardware.
Recently security experts have detected an increasing number of miners, in August a new fileless miner dubbed CoinMiner appeared in the wild, it uses NSA EternalBlue exploit and WMI tool to spread.
On May 2017 security experts at Proofpoint discovered that many machines weren’t infected by WannaCry because they were previously infected by the Adylkuzz cryptocurrency mining malware that uses the NSA EternalBlue exploit.to spread and infect machines to involve in a Monero botnet.
In the same month, GuardiCore malware experts discovered a new botnet malware, dubbed BondNet, that at the time infected an estimated 15,000 Windows server computers worldwide for mining Monero.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
|---|
(Security Affairs – mining, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/63563/cyber-crime/monero-server-botnet.html