Powerful Malware Disguised as Crypto Miner Infects 1M+ Windows, Linux PCs (pcmag.com) 19
PC Magazine reports:
A powerful piece of malware has been disguising itself as a trivial cryptocurrency miner to help it evade detection for more than five years, according to antivirus provider Kaspersky. This so-called "StripedFly" malware has infected over 1 million Windows and Linux computers around the globe since 2016, Kaspersky says in a report released Thursday...
StripedFly incorporated a version of EternalBlue, the notorious NSA-developed exploit that was later leaked and used in the WannaCry ransomware attack to infect hundreds of thousands of Windows machines back in 2017. According to Kaspersky, StripedFly uses its own custom EternalBlue attack to infiltrate unpatched Windows systems and quietly spread across a victim's network, including to Linux machines. The malware can then harvest sensitive data from infected computers, such as login credentials and personal data. "Furthermore, the malware can capture screenshots on the victim's device without detection, gain significant control over the machine, and even record microphone input," the company's security researchers added.
To evade detection, the creators behind StripedFly settled on a novel method by adding a cryptocurrency mining module to prevent antivirus systems from discovering the malware's full capabilities.
StripedFly incorporated a version of EternalBlue, the notorious NSA-developed exploit that was later leaked and used in the WannaCry ransomware attack to infect hundreds of thousands of Windows machines back in 2017. According to Kaspersky, StripedFly uses its own custom EternalBlue attack to infiltrate unpatched Windows systems and quietly spread across a victim's network, including to Linux machines. The malware can then harvest sensitive data from infected computers, such as login credentials and personal data. "Furthermore, the malware can capture screenshots on the victim's device without detection, gain significant control over the machine, and even record microphone input," the company's security researchers added.
To evade detection, the creators behind StripedFly settled on a novel method by adding a cryptocurrency mining module to prevent antivirus systems from discovering the malware's full capabilities.
Infection point? (Score:4, Insightful)
Re: (Score:1)
To evade detection, the creators behind StripedFly settled on a novel method by adding a cryptocurrency mining module to prevent antivirus systems from discovering the malware's full capabilities.
If your antivirus program doesn't automatically flag cryptocurrency mining as malware, it is crap.
Re:Infection point? (Score:4, Insightful)
Antivirus has "always" been expected to detect trojans and worms, not just viruses... at least, as long as these things have existed.
Re:Infection point? (Score:5, Interesting)
The wording in the article is VERY BAD.
It should have read....
"To evade detection, the creators behind StripedFly settled on a novel method, by playing on the user's greed and ignorance of cryptocurrency, they hid the malware's full capabilities inside a mining module, thus ensuring the user would whitelist the infected application on their antivirus systems."
Re: (Score:2)
Re: (Score:2)
This. How the hell did adding cryptomining capability make a program look *less* suspicious?
Re: (Score:2)
Re: (Score:2)
It would have been really nice for the summary to tell us how it infects computers, especially the Linux ones. Some research makes it look like it does it via an SMBv1 exploit.
When I glanced over TFS, I took for granted people voluntarily install it to mine some coins and supposidly make money.
Re: (Score:2)
It would have been really nice for the summary to tell us how it infects computers, especially the Linux ones. Some research makes it look like it does it via an SMBv1 exploit.
Uh, when TFS suggested it was "unpatched" computers, I didn't realize they were talking about ones they found in the Microsoft wing of the museum. SMBv1? Seriously?
Malware infiltrating Linux computers (Score:3)
How does this “cryptocurrency miner” “infiltrate its victims’ systems”, without the user downloading and executing the said malware?
Re:Malware infiltrating Linux computers (Score:5, Interesting)
From what I've gleaned from reading the article (shame on me, I know):
The malware makes use of a Windows networking flaw on machines still using SMBv1 to get administrator access on Windows. From there Powershell is used to automate the rest.
It can only get onto Linux machines via the compromised Windows host. The Windows host will ssh into Linux machines using whatever ssh credentials exist on the Windows host, and remotely do its stuff as whatever Linux user it found on the Windows host.
Re: (Score:2)
So not actually a security problem on Linux at all. Well, I know why I have put 2FA on all my SSH logins that I occasionally use from Windows. (Yes, I know, I am lazy. I am still at zero malware infections on Windows though, so I have no clue how much risk of that I have.)
Re: (Score:3)
Funny! (Score:2)
Lol, wait, what? (Score:3)
"Powerful Malware Disguised as Crypto Miner Infects 1M+ Windows, Linux PCs"
Errrr, isn't the crypto-mining shit itself usually the malware?
Who would deliberately download crap this and- oh, wait, never mind.
There is always "even more stupid".... (Score:2)
I mean, anybody invested in crapcoins is already pretty stupid. But anybody thinking that at this time you can still meaningfully mine on a regular PC must be among the most stupid or naive fucks possible.
Greed is so useful (Score:3)
Title. (Score:3)