Hackers are illegally generating Monero, Bitcoin and other cryptocurrencies by exploiting a software flaw that was leaked from the U.S. government, according to new research, raising questions about the security of one of the fastest-growing corners of financial markets.

Detected cases of illicit cryptocurrency mining — the digital equivalent of minting money — have surged 459 percent in 2018 compared to last year, Cyber Threat Alliance said in a report released Wednesday.

The spike is tied to the 2017 leak of Eternal Blue, a tool to exploit vulnerabilities in outdated Microsoft Systems software. When the tool became known, it tipped hackers to a previously unknown flaw in the software, now the basis of some hackers’ efforts to commandeer computing power of others to generate digital currency.

As of July this year, 85 percent of all illicit cryptocurrency mining has targeted Monero, according to the report. Bitcoin made up about 8 percent, while other cryptocurrencies accounted for 7 percent.

Hackers can “sit back and watch the money roll in,” said Neil Jenkins, chief analytic officer of Cyber Threat Alliance, a group formed in 2014 by a consortium of cyber-security firms to share intelligence about cyber-threats. While the hacks are occurring across the globe, a significant portion are in the U.S., he added.

Bitcoin and other cryptocurrencies are generated through a process of solving complex mathematical equations, which requires significant computing power. Most users and investors lack the means to create, or mine, cryptocurrency and simply buy it from an online exchange. When hackers illicitly generate currency using others’ computers, it creates free money for them and could erode the overall value of the currency by increasing its supply.

Eternal Blue was allegedly stolen from the National Security Agency and leaked last year in an unsolved breach by a hacking group that calls itself the Shadow Brokers. The group has repeatedly released tools from that breach.

The code gained notoriety when Russia and North Korea used it in massive attacks. In the first instance, known as WannaCryNorth Korean hackers shut down computers in dozens of countries, including Britain, where hospitals were hit. In the second, known as NotPetya, Russia used Eternal Blue to hack computers at companies including Denmark’s A.P. Moller-Maersk A/S, leading to billions of dollars of damage, according to the White House.

“A security update was released in March 2017. Customers who applied the update are protected,” Jeff Jones, a senior director at Microsoft Corp., said in a statement.

The NSA declined a request for comment.

“The threat of illicit cryptocurrency mining represents an increasingly common cybersecurity risk for enterprises and individuals,” according to the report. And the “rapid growth shows no signs of slowing down.”

 

This post credited to bloomberg  Image source: Bloomberg 

Firefox will block cryptojacking malware in future versions of its web browser, according to an announcement August 30.

The move comes as part of an anti-tracking initiative expected to be implemented over the next few months. In the announcement, Firefox cites a study by browser extension Ghostery, stating that 55.4 percent of the total time required to load an average website is spent loading third party trackers.

Future versions of Firefox will reportedly block such practices as cryptomining scripts that “silently mine cryptocurrencies” on users’ devices by default. By blocking tracking and offering a “clear set of controls,” Firefox is looking to provide its users more choice over what data they share with websites.

Back in 2016, Mozilla, the company behind Firefox browser, implementedpractices encouraging users to take care of their online privacy and security in an ongoing shift towards data encryption. Firefox reportedly was going to block connections to HTTPS secure servers employing weak encryption and establish a minimum of 1023 bits for TLS handshakes using Diffie-Hellman keys.

Another major web browser, Opera, included anti-crypto mining in their integrated ad-blocker for desktop in December last year. Later in January, the company announced plans to add the feature to their mobile browser as well.

This month, Opera announced the launch of its desktop web browser with built-in crypto wallet functionality. As with the mobile app, the desktop client will support tokens as well as digital collectibles, with product lead of Opera Crypto Charles Hamel commenting that browser integration represents a further step in “making cryptocurrencies and Web 3.0. mainstream.”

 

This post credited to cointelegraph  Image source: cointelegraph

The concept of ‘Security Tokens’ has been a subject of debate and controversy since they came to prominence . How have they changed since they were first introduced, and where might they be heading next?

Futures, and “All Coins are Securities”

This was around Winter 2017 – 2018. The same time when the Securities and Exchange Commission (SEC) in the USA began focusing their attention on this new and previously unregulated form of cash. Before many other national, government authorities worldwide decided to follow suit.

It was also around the same time when the first ‘bitcoin futures’ contracts were launched and sold by enterprising new and existing firms – with the SEC ruling creating a significant space for traditional investment and old-money to pour into the market.

The opening of crypto-futures arguably exacerbated the pressure on cryptocurrencies which resulted from prying government eyes.

The Two Tokens: Securities & Utilities

Since those early days of regulation in the West, cryptocurrencies have eventually dichotomized into: ‘security tokens’ and ‘utility tokens’.

The definitions used by coin creators and the communities can be flexible, with many fundraisers opting to class their coins as ‘utilities’ to avoid potential additional legal / administrative repercussions – however the most commonly accepted definition is that:

  1. ‘Securities’ are asset backed tokens (AKA fungible, often equivalent to a real-world asset).
  2. ‘Utilities’ are functional assets within the blockchain project in question’s eco-system whose value is based in more abstract terms.

At present, the SEC has declared few tokens as being officially classed as utilities rather than securities and are thus not subject to laws pertinent to traditional securities. Two of these are Bitcoin and Ethereum.

Independent Standards Agencies?

Some companies, such as Luxembourg based Tokeny were able to establish their headquarters in a pro-crypto country in the first place, regardless of their seasoned – international leaders.

This team includes CEO and founder Luc Falempin: supported by a diverse team of executives coming from traditional financial services, as well as global roles in software and IT service companies like IBM and Syniverse.

Tokeny hails itself as “The end-to-end platform to issue, manage and trade Utility and Security tokens” significantly cutting down on needs for otherwise unneccessary intermediaries.

The organisation advertises its proprietary approval program entitled SICOP (AKA The Sustainable Initial Coin Offering Protocol): a standards and regulation process for ICOs and STOs which is independent of government intervention.

Havens: Not Just for Taxes, But Cryptos Too!

If you’ve read some of my writing on CCN or our sister site Hacked.com, you may notice a running theme of discussion surrounding security concerns and government regulations.

This is in addition to the role which many international ‘crypto-havens’ play as independent advocates of cryptocurrencies on the world stage. One example is the ways in which such financially liberal (and often nation-state) countries play in facilitating innovation and business migration from stricter countries.

DSTOQ made its way to the news recently in-part due to being ‘the first fully-licensed cryptocurrency’ – as issued by the tax-haven government of Vanuatu. Also notable was the recent and unexpected surprise public reveal / launch of the company itself and MVP.

The company’s decision to acquire official legislative backing through the ‘Commonwealth of Nations’ member country is a means of bypassing the strict legislation put in place by agencies such as the USA’s SEC.

It also prevents them from allowing investment from citizens of the USA; meaning that they are focusing their efforts in Europe to begin with. A decision which potentially reflects a smaller-scale crypto-flight from the USA – as seen with China.

Binance conversely has been noted for their relocation and international expansion outside of their native China: with various regional offices across South-East Asia, including Japan.

Blue-Chip Big Dogs

World-class asset management firms such as BlackRockMorgan Stanley and Goldman Sachs have been admitting interest repeatedly in potentially implementing crypto investments into their business roadmaps. The same can be said for market leaders in other sectors, such as tech giants like IBM.

According to Sonali Basak of Bloomberg,

“Wall Street’s money managers are in an arms race for technology that will help them gain market share,”

This only further proves the importance of opening as many methods for investment to traditional / old-money as possible.

It also reveals the forthcoming generation of standard creators / bearers as potentially being those current market leaders who are successful in adapting blockchain to the needs of themselves and the general customers and users.

These companies’ likelihood of dominating the discussion would come due to their economic and industry influence and experience, putting potential independent attempts to waste.

Governments and Securities

The SEC has been fickle with their outlook on various cryptocurrencies – starting their public announcements with an aggressive tone regarding all tokens as-of-then being unregulated.

They backed up their bark with a series of bites which came in the form of crackdown operations against crypto companies in the country which had been suspected of carrying out fraudulent actions.

On a positive note, the government financial authority has also been establishing strong relationships with various blockchain companies who are willing to play ball with the recently created, developing ground rules.

This move hasn’t convinced everybody – and US based or US citizen targeted ICO fundraising campaigns are all-but-strictly forbidden under current rulings.

This post credited to ccn Image source: Shutterstock.

Cybersecurity company Trend Micro has revealed that between January and July 2018, its researchers detected unauthorized crypto mining attacks – also known as ‘cryptojacking’ – at a rate nearly 1000 percent higher than in the second half of 2017. The information was revealed in the company’s H1 2018 report titled “Unseen Threats, Imminent Losses.”

From Malware to Cryptojacking

One significant insight contained in the report is that cybercriminals who previously favored the use of malware and ransomware to shake down their victims are increasingly looking toward digital coin mining as a new frontier.

Explaining the new threat, an excerpt from the Trends Micro report reads:

“Throughout the next few months, we also saw a noticeable shift away from highly visible ransomware to a more discreet detection: cryptocurrency mining. These damaging threats — from the miners that quietly leech power from victims’ devices to the dangerous vulnerabilities that leave machines open to covert attacks — split limited security resources and divide the focus of IT administrators.”

A cryptojacking attack, while often escaping detection by network security personnel and users can have debilitating consequences for a network or computer equipment such as increased response time and extreme lags, physical degradation of hardware due to increased workload and overheating, and power usage spikes.

The attack is quite devastating because it makes use of a computer system’s graphics processing capability instead of its processor, which slows down a system’s operating speed with serious effects, particularly for an enterprise level computer operation.

The report states that as predicted in 2017, detection of cryptojacking incidents and attempts has increased twofold, and more pertinently, it continues to expand as cybercriminals increasingly see a future in digital currency crime. According to the report, not only is the number of incidents going up, but the number of cryptojacking malware families is also increasing, which shows that bad actors are investing considerable amounts of time and resources in developing cryptojacking as a new area of criminal enterprise.

Breakdown and Statistics

The security roundup reveals that between January and July 2017, Trend Micro’s researchers documented a 141 percent increase in unauthorized crypto miningincidents. Over the same period, they also found 47 new cryptojacking malware families as hackers evolved and changed their mode of operation.

Strategies used for gaining access to systems to mine crypto included inserting malvertising into Google’s DoubleClick ad program, injecting infected advertisements into websites, deploying Adware downloader ICLoader, and even uploading mining script to AOL’s ad platform.

Over the course of 2018, there have been several reports of cryptojacking incidents affecting hundreds of websites including government websites and high profile platforms by cybercriminals mining Monero. Monero generally remains the cryptocurrency of choice for crypto jackers because it offers almost total anonymity as well as market liquidity.

It is challenging catching crypto jackers by tracing Monero wallet funds. This is because they use crypto blending services to launder their crypto funds before withdrawing them. To avoid becoming victims of cryptojacking, it is recommended that network security administrators should regularly look out for power usage spikes, unusual power usage patterns or other unauthorized activity on their networks.

 

This post credited to Coinjournal   Image source: coinjournal

Japanese cryptocurrency platform Coincheck has taken another step towards repairing its reputation – devastated in January by the biggest exchange hack in history.

The exchange, which was taken over by the Monex Group in April this year, has decided to beef up its security system with a two-step authentication system.

Coincheck issued a notice to all customers stating that all logins will now need to be made via Google Authenticator and SMS (text message) authentication – as part of updates that will be made applicable to web logins and app users. The changes will be enforced via a new update, which will be compulsory to all users as of September 3.

The exchange has been hoping to rebuild consumer confidence and restore its reputation with the regulatory Financial Services Agency by bolstering its security network, as well as cooperating with self-imposed bans on “anonymous” tokens and limiting margin trading.

Coincheck also yesterday resumed trading in the Lisk (LSK) cryptocurrency, per a company tweet, two days after suspending LSK transactions due to the launch of the Lisk mainnet. LSK developers have claimed the launch was a success, and a number of other Japanese exchanges – including market leader bitFlyer – also took to Twitter to announce they were resuming LSK withdrawals and deposits on August 30.

Meanwhile, Monex Group, the new owner Coincheck, said in May that it also plans to expand its operations to the United States.

“We can broaden our customer base at Coincheck. In the end, we should and we can replicate the profitability [the previous owners] achieved before,” Monex CEO Oki Matsumoto said.

For the 12-month period through March 2017 Coincheck generated JPY 980 million (USD 8.8 million) in revenue and JPY 471 million in net income from its core business. Also, the company made JPY 76.3 billion from the sale of investments in cryptocurrencies.

Monex has acquired Coincheck for a total of 3.6 billion yen (USD 32 million). The buyer has also agreed to split profits with former shareholders for the next three years. Founding president Koichiro Wada, who owned a 45% stake in the company, and chief operating officer Yusuke Otsuka (5.5% of the shares), as well as the rest of Coincheck’s management, step down as part of the deal.

 

This post is credited to cryptonews  Image source: iStock/Rawpixel