Trends

Crypto-jacking epidemic spreads to 30K routers across India

 
The spate of crypto-jackingĀ plaguing the internet shows no sign of slowing down. After infesting hundreds of thousands of routers in Brasil with cryptocurrency mining malware, reports indicate hackers have compromized a further 30,000 routers across India.
As Hard Fork previously reported, black-hat hackers are waging a war on the internet. Attackers have already forced almost 280,000 MicroTik routers in Latin America to mine Monero (XMR) non-stop, so the discovery of the malware running on routers elsewhere is nothing but troubling.
ā€œThe number of compromised routers [in India] has doubled in the past month,ā€ wrote internet security unit Banbreach. ā€œFor the top three cities with the most infected routers, the growth has been [500 percent].ā€

Courtesy of Banbreach

Worryingly, it appears internet service providers (ISPs) in India are distributing infected routers, presumably unaware hackers have rigged them to mine Monero on every page passing through their networks.
ā€œI found [CoinHive] in the router provided by my ISP a couple of days ago,ā€ tweetedĀ a security enthusiast from Mumbai. ā€œProbably all the routers used by them are infected and outdated.ā€

Crypto-jackers favorite tool is CoinHive

CoinHive is a supposedly neutral piece of code enabling browsers to mine cryptocurrency, particularly the anonymity-focused altcoin Monero.
Itā€™s best to think of CoinHive as a tool; charities use it to raise funds indirectly, but here, internet baddies are using it to steal the computing power of unsuspecting users to mine cryptocurrency for themselves.
To complicate matters, hackers are also intensifying efforts by rapidly sharing new, modified versions of their malware in a bid to spread it as quickly as possible.
Data shared by McAfee Labs shows more than two and a half million different versions of crypto-jacking malware (most of it CoinHive related) have been issued in the past three months.

Crypto-jacking succeeds in non-metro areas

Security researchers, like Banbreach and fellow malware-tracking group Bad Packets Report, use powerful search engines to listen to internet traffic. Services like Google only show websites, but those are only a small part of picture.
These detect all the devices on the internet with public IP addresses. As routers fall into that category, it is possible to snoop on some of the traffic passing through them.
Some of the publicly available data relates to its source location. This allows for the mapping of internet traffic.
Researchers grouped populated areas of India into three tiers. One contains the most dense, metropolitan areas, with two and three increasingly remote.
The chart below shows a great disparity in infection rates. Note, there are far more infected routers running in remote areas than in cities; 45 percent of the infected routers in India are in the most rural areas.

Courtesy of Banbreach

Banbreach explained that cybersecurity awareness is ā€œmuch, much lower in the ā€˜non-metroā€™ areasā€ of India.
To give an understanding of the scope of CoinHive, related studies suggest the total output of all the machines running CoinHive scripts generates more than $250,000 in XMR every month ā€“Ā although remember, not all of it comes by way of crypto-jacking.
If it helps ā€“ the hackers are primarily exploiting vulnerabilities in MicroTik brand routers. If you have one, refer to the manufacturer for an official patch.
As well, here is a handy guide on how to best protect your browser against crypto-jackers.
Source: The Next Web
To Read our Daily News Updates, Please Visit Inventiva Or Subscribe Our Newsletter & Push.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button

Adblock Detected

Please consider supporting us by disabling your ad blocker