Internet infrastructure server hijacked for $152,000 Ether theft

A heist carried out through the DNS tubes.

Hackers made off with about $152,000 worth of Ether on Tuesday in an attack that exploited weaknesses in the internet’s infrastructure to steal users’ cryptowallet keys.

The hackers did so by exploiting a weakness in DNS servers serving MyEtherWallet, a cryptocurrency exchange. DNS is a service that connects domain names like myetherwallet.com to whatever IP address it’s hosted on.

“This is not due to a lack of security on the [MyEtherWallet] platform. It is due to hackers finding vulnerabilities in public facing DNS servers,” the company wrote in a Reddit post.

Hackers hijacked the DNS servers around noon UTC, the company said, and redirected user traffic to a replica of myetherwallet.com hosted on a Russian server. The actual exploit was through the Border Gateway Protocol (BGP), explains security researcher Kevin Beaumont. BGP is the system that actually directs traffic to a website.

MyEtherWallet noted in the Reddit post that, because users were rerouted to a phishing website, they likely clicked through a pop-up message warning them that the site they were visiting did not have a proper SSL certificate.

It’s not clear yet the root cause of the attack, but the hackers appear to have rerouted IP addresses operated by Amazon Web Services’ DNS service, known as Route 53.

DNS provider Cloudflare explained in a blog post about the incident that a BGP leak happens when a range of IP addresses is “announced” by an outside party, which could be a configuration mistake or done with malicious intent.

In Tuesday’s incident, a range of IP addresses belonging to AWS appears to have been rerouted via internet service provider eNet. It’s not clear how the fraudulent routes came to be announced by eNet.

“Neither AWS nor Amazon Route 53 were hacked or compromised,” an AWS spokesperson said in a statement. “An upstream Internet Service Provider (ISP) was compromised by a malicious actor who then used that provider to announce a subset of Route 53 IP addresses to other networks with whom this ISP was peered. These peered networks, unaware of this issue, accepted these announcements and incorrectly directed a small percentage of traffic for a single customer’s domain to the malicious copy of that domain.”

https://twitter.com/InternetIntel/status/988792927068610561

The attackers reportedly redirected traffic for about two hours. In that time, they managed to steal 215 Ether, amounting to about $152,000 at the time. The hackers had millions of dollars worth of Ether in their cryptowallets before the attack started, according to Beaumont, suggesting that they were well-resourced for an operation of this scale.

Beaumont notes that having that access, along with the ability to manage the scale of DNS traffic, requires great computing power. That suggests that the Ether trading site may not have been the only target.

“It seems unlikely MyEtherWallet.com was the only target, when they had such levels of access,” Beaumont writes.

This post has been updated with a statement from Amazon Web Services.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems