fermer
fermer
Le réseau de demain
Le réseau de demain
Planifiez votre chemin vers un réseau plus rapide, plus sûr et plus résilient, conçu pour les applications et les utilisateurs que vous prenez en charge.
          Essayez Netskope
          Mettez la main à la pâte avec la plateforme Netskope
          C'est l'occasion de découvrir la plateforme Netskope One single-cloud de première main. Inscrivez-vous à des laboratoires pratiques à votre rythme, rejoignez-nous pour des démonstrations mensuelles de produits en direct, faites un essai gratuit de Netskope Private Access ou participez à des ateliers dirigés par un instructeur.
            Un leader sur SSE. Désormais leader en matière de SASE à fournisseur unique.
            Un leader sur SSE. Désormais leader en matière de SASE à fournisseur unique.
            Netskope fait ses débuts en tant que leader dans le Magic Quadrant™ de Gartner® pour le SASE à fournisseur unique.
              Sécuriser l’IA générative pour les nuls
              Sécuriser l’IA générative pour les nuls
              Découvrez comment votre organisation peut concilier le potentiel d'innovation de l'IA générative avec des pratiques robustes en matière de sécurité des données.
                Prévention des pertes de données (DLP) pour les Nuls eBook
                La prévention moderne des pertes de données (DLP) pour les Nuls
                Obtenez des conseils et des astuces pour passer à un système de prévention des pertes de données (DLP) dans le nuage.
                  Réseau SD-WAN moderne avec SASE pour les nuls
                  SD-WAN moderne pour les nuls en SASE
                  Cessez de rattraper votre retard en matière d'architecture de réseau
                    Identification des risques
                    Advanced Analytics transforme la façon dont les équipes chargées des opérations de sécurité utilisent les données pour mettre en œuvre de meilleures politiques. Avec Advanced Analytics, vous pouvez identifier les tendances, cibler les domaines préoccupants et utiliser les données pour prendre des mesures.
                        Les 6 cas d'utilisation les plus convaincants pour le remplacement complet des anciens VPN
                        Les 6 cas d'utilisation les plus convaincants pour le remplacement complet des anciens VPN
                        Netskope One Private Access est la seule solution qui vous permet d'abandonner définitivement votre VPN.
                          Colgate-Palmolive protège sa "propriété intellectuelle" "grâce à une protection des données intelligente et adaptable
                          Colgate-Palmolive protège sa "propriété intellectuelle" "grâce à une protection des données intelligente et adaptable
                            Netskope GovCloud
                            Netskope obtient l'autorisation FedRAMP High Authorization
                            Choisissez Netskope GovCloud pour accélérer la transformation de votre agence.
                              Faisons de grandes choses ensemble
                              La stratégie de commercialisation de Netskope privilégie ses partenaires, ce qui leur permet de maximiser leur croissance et leur rentabilité, tout en transformant la sécurité des entreprises.
                                Solutions Netskope
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) fournit aux clients de puissants outils d'intégration pour tirer parti des investissements dans leur dispositif de sécurité.
                                  Support technique de Netskope
                                  Support technique de Netskope
                                  Nos ingénieurs d'assistance qualifiés sont répartis dans le monde entier et possèdent des expériences diverses dans les domaines de la sécurité du cloud, des réseaux, de la virtualisation, de la diffusion de contenu et du développement de logiciels, afin de garantir une assistance technique rapide et de qualité
                                    Vidéo Netskope
                                    Formation Netskope
                                    Grâce à Netskope, devenez un expert de la sécurité du cloud. Nous sommes là pour vous aider à achever votre transformation digitale en toute sécurité, pour que vous puissiez profiter pleinement de vos applications cloud, Web et privées.

                                      Step aside ransomware: Why cryptojacking is the new kid on the block

                                      May 30 2018
                                      Tags
                                      Cloud Malware
                                      Cloud Security
                                      cryptocurrency
                                      cryptojacking
                                      cybercrime
                                      Ransomware
                                      Risks
                                      Vulnerability Advisory

                                      With the ability to generate a staggering $1.5 trillion in revenues every year, cybercrime is big business. It’s the perfect model – earn a high income for minimum effort and risk of penalty.

                                      It comes as no surprise then that when faced with issues around the fluctuating value of Bitcoin, cybercriminals stepped into action. These savvy criminals created a new attack technique that offers better paid out odds in comparison to ransomware – cryptojacking – unauthorised use of someone else’s computing resources to mine cryptocurrency.

                                      This new technique has quickly risen in the ranks, replacing ransomware as the number one threat for consumers and enterprises. Let’s look more in detail at the factors that have driven this shift.

                                      The money maker

                                      With a cryptocurrency market cap of nearly $500 billion, cryptojacking is extremely attractive for cybercriminals: it doesn’t require high technical skills and, unlike ransomware, offers a potential 100% pay-out ratio. Once compromised, infected machines can immediately start to mine cryptocurrency in stealth mode regardless of its processing power or geographical location. Even low-end systems are useful to the cause since it’s the size of the network of compromised machines, and hence the total computational power, that really matters. Additionally, if the attackers don’t get carried away and tune the miner not to completely drain the CPU, the attack can go on stealth and undetected for a long time.

                                      Ubiquity of the attack surface

                                      It doesn’t matter if the malicious miner component is injected into a mobile device, a personal computer, a server, the cloud, or even an IoT device. It doesn’t even matter what operating system is being used. The attackers can take advantage of its CPU cycles for their illegitimate purposes with any OS. Even IoT devices with limited processing power can be recruited: the Mirai botnet has taught us what multiple IoT devices can do when working together. And it’s not a coincidence that a variant has been repurposed to mine cryptocurrency, and the same botnet has also spawned Satori, a variant infecting mining rigs, hijacking the device owner’s mining credentials. In fact, hacking multiple IoT devices can be rewarding: according to a recent estimate, 15,000 hacked internet-connected gadgets can mine $1,000 of cryptocurrency in just four days. Not shabby considering that by 2020, there will be over 20 billion internet-connected devices.

                                      Multiple infection mechanisms

                                      Since malicious miners can be injected in virtually any device, multiple infection vectors can be used such as brute-force attacks, unpatched vulnerabilities, or compromised websites (drive-by cryptomining). The timelines of cyberattacks that I collect each month highlight the attackers’ creativity and their ability to find new ways to carry out these attacks.

                                      Similar techniques can be used to compromise both client and servers, making new slaves for the cryptominer botnets. The Smomirnu botnet and Wannamine malware are two examples of threats exploiting the infamous EternalBlue vulnerability (CVE-2017-144) to spread. Even existing malware can be rewritten to mine cryptocurrency, or to add this “feature” to the existing ones.

                                      In reality clients are even more exposed since they can mine cryptocurrency simply visiting a web-page hosting a JavaScript miner like Coinhive. Coinhive mines a cryptocurrency called Monero (XMR) and the main reason is that besides being able to stay anonymous with this blockchain, the algorithm used to calculate the hashes, called Cryptonight, was designed to run well on consumer CPUs (what a coincidence).

                                      This is only the tip of the iceberg, since drive-by cryptomining campaigns are becoming bigger, more prevalent and more persistent while you browse the internet. Criminals are now adopting a technique similar to malvertising, injecting the Coinhive code into advertisements supplied by platforms like AOL or Google DoubleClick. It doesn’t even matter if the user leaves the compromised page or closes his browser since the malicious code can be hidden in a tiny ‘pop-under’ window hidden behind the Windows taskbar. This makes it persistent and invisible to the user. There have also been cases of malicious browser extensions injecting Coinhive directly into your browser.

                                      The role of the cloud

                                      The list of the five most new dangerous attacks presented by the SANS institute at the last RSA Conference includes both cloud storage data leakage and monetisation of compromised systems via cryptominers. Data leakage in the cloud is often the consequence of misconfigurations like wrong permissions or lack of an adequate password protection. Apart from stealing data, the same misconfigurations can be used by crooks to spin-up their own instances and use them to mine cryptocurrency at the expense of the victim, with the concrete possibility that the latter will not detect the attack until the next bill. A deadly combination of these two attack techniques listed by the SANS Institute has already hit some high-profile victims like Tesla, whose public cloud was used to mine cryptocurrency.

                                      There are also some additional risks. Miners can use known cloud services to spread more quickly inside organisations (Netskope Threat Research Labs discovered a Coinhive miner resident in a Microsoft Office 365 OneDrive for Business instance), or also to avoid detection (like in case of Zminer and Xbooster that download payloads from Amazon S3 cloud storage).

                                      Out-crafting the cryptojacker

                                      The good news is that businesses can reduce their risk of exposure to cryptojacking by enforcing policies such as:

                                      • Scanning all uploads from unmanaged devices to sanctioned cloud applications for malware
                                      • Scanning all uploads from remote devices to sanctioned cloud applications for malware
                                      • Scanning all downloads from unsanctioned cloud applications for malware
                                      • Scanning all downloads from unsanctioned instances of sanctioned cloud applications for malware
                                      • Enforcing quarantine/block actions on malware detection to reduce user impact
                                      • Blocking unsanctioned instances of sanctioned/well known cloud apps, to prevent attackers from exploiting user trust in cloud. While this seems a little restrictive, it significantly reduces the risk of malware infiltration attempts via cloud

                                      These policies combined with an effective patch management process for clients and servers; an updated corporate antivirus the latest releases and patches; and the use of Ad-blockers or browser extensions like NoScript can help to prevent drive-by cryptomining attacks.

                                      Criminals are savvy, smart and are always on the lookout for the opportunity to exploit what they can, when they can, so don’t give them the chance. These preventative measures are effective and offer the barrier you need to protect yourself against mounting cryptojacking attacks and stop them in their tracks.

                                       

                                      This article was originally published on Cloud Tech.

                                      author image
                                      Paolo Passeri
                                      Paolo supports Netskope’s customers in protecting their journey to the cloud and is a security professional, with 20+ years experience in the infosec industry.
                                      Paolo supports Netskope’s customers in protecting their journey to the cloud and is a security professional, with 20+ years experience in the infosec industry.

                                      Restez informé !

                                      Abonnez-vous pour recevoir les dernières nouvelles du blog de Netskope