Slashdot Mirror
DVRs Used To Attack Synology Disk Stations and Mine Bitcoin
UnderAttack (311872) writes "The SANS Internet Storm Center got an interesting story about how some of the devices scanning its honeypot turned out to be infected DVRs. These DVRs are commonly used to record footage from security cameras, and likely got infected themselves due to weak default passwords (12345). Now they are being turned into bots (but weren't they bots before that?) and are used to scan for Synology Disk Stations who are vulnerable. In addition, these DVRs now also run a copy of a bitcoin miner. Interestingly, all of this malware is compiled for ARM CPUs, so this is not a case of standard x86 exploits that happen to hit an embedded system/device."
...by this?
I'm more surprised that we haven't seen reports of infected DVD and Blu-ray players whose only purpose is to seek out more powerful devices (PCs, smartphones) on peoples' networks to compromise and turn into bitcoin zombies. After all, it only takes a few people to come up with the exploits in the first place, and then 5kr1p7 k1dd13s can use the tools others have created.
Do not look into laser with remaining eye.
Unfortunately this does not appear to be a case of April fools. Somehow I wish it were.
Interestingly, all of this malware is compiled for ARM CPUs
How else does malware running on ARM based systems work?
This april fools is believable.
I still have more fans than freaks. WTF is wrong with you people?
I hate April fools on the internet... April fools only works in person, it is just dumb and possibly dangerous on the internet.
Posted by Unknown Lamer on Monday March 31, 2014 @11:58PM
These should be considered counterfeit. True, they are probably good bitcoins in the accuracy department, but by no stretch of the imagination could they be considered legitimately mined. Is there a mechanism built into the bitcoin structure that allows for this and voids the coins?
But when you've actually been asked by management whether you've implemented RFC 3514 (the "Evil Bit"), how can the Internet NOT be better?
Bird is the word
rewriting history since 2109
The date/time you see on the story depends on your timezone. Yet it doesn't put everyone else into a time-warp where it's not April 1st for them...
This story absolutely was posted on April 1st, /. local time, as evidenced by the date embedded in the link to it:
http://it.slashdot.org/story/1...
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
I don't have an exact answer, Synology ARM devices vary, though mostly Marvell based; but for reference the 'Sheevaplug', based on a slightly obsolete Marvell storage processor, is quoted to be good for about .2 megahashes/second. I don't keep up with bitcoin difficulties, just don't care that much; but with USB-stick ASIC devices claiming 1 gigahash/second and greater, you'd need to own a mind-boggling number of these things to make it worth the time.
It's doubly weird because NASes probably have some neat stuff stashed on them, and would also be natural hosts for some sort of 'super-sleazy-CDN' type project, which would be equally illicit but might actually be worth more than a lukewarm cup of instant coffee.
Well the laundry thought they may as well make SCORPION STARE self-funding by mining bitcoins. Its fortunate the researchers did not activate the primary function
TFA has very little info on the supposed Synology management interface vulnerability.
I believe this article covers some some of the general info on the vulnerabilities: http://www.symantec.com/connec...
That might also be an error in reporting: TFA's Author might have written "bitcoin mining" (for lack of understanding the whole alt-coin ecosystem) when it would be best described as "cryptocurrency miner". /. mentioning mining malware, all said "bitcoin mining" when careful reading showed up that in fact the malware didn't mine bitcoins but another cryptocurrency better suited for CPU (one of the latest I remember was PTShares).
The last few article on
Reporter just say "bitcoin mining" because that's the only thing they know and they vaguely remember that creating bitcoins was something CPU intensive.
The black-hats creating sophisticated malware (a worm, infecting vulnerable connected DVR, so they in turn can attack Synology NAS and launch mining software) aren't probably stupid enough to mine bitcoin, they probably know better, and the miner is for whatever is the current most CPU-worthy (i.e.: non SHA-256^2 baesd) cryptocurrency-coin.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
As I've mentionned above, it's probably NOT bitcoins being mined. /. mentioning mining malware, all said "bitcoin mining" when careful reading showed up that in fact the malware didn't mine bitcoins but another cryptocurrency better suited for CPU (one of the latest I remember was PTShares).
The last few article on
Reporter just say "bitcoin mining" because that's the only thing they know and they vaguely remember that creating bitcoins was something CPU intensive.
If the black-hats are smart enough to think this contrived way to infect the synology (infect first the "always on internet" DVR and only then, once you're on the other side of the firewall, start scanning the home intra-net for NAS hidden behind the firewall), perhaps they are also able to pick a CpU worthy (ie.: not SHA-256^2 based) cryptocurrency coin.
Even free-as-in-stolen, you're telling me that the best use somebody can think of for a botnet of network attached storage devices is generating maybe as many hashes as one of those cheapo USB-stick ASICs, rather than, say, basking in juicy private data and massive stolen storage space?
While you're at it, it's best to take as much opportunity as possible.
- you can "safely" mine on a nas, because the clueless user won't notice a heavily degraded performance (unlike on their desktop).
- you can pick-up a coin which won't be beaten by cheapo USB ASICs: math based coins (like PrimeCoin, RieCoin, etc.) are still mined on CPUs. SHA3 based coins (CopperLark, QuarkCoin, etc) don't have an efficient GPU implementation yet. SCrypt-based coins are some memory-intensive, that the jump between hardware generations doesn't yield such a strong difference in hash rate: even if the current mining is mostly done on GPU and some early experimental FPGA, high-end server CPU can still give Litecoin for their run. (so even if the ARM inside NAS isn't that powerful, a whole botnet mining Litecoin could still earn some money back).
And last but not least:
- that the worm download a payload for mining bitcoins, doesn't prevent the the worm to also download a payload for scanning credit-cards numbers, SSN, naked photos, etc.
So don't despair, the massive stolen storage space will also be juiced for all it's worth.
The coin-mining at least is low bandwidth, and it's possible for the blackhats to check if their plan is working just by looking at the income on the cryptocurrency address used for mining. Scanning the stolen storage space would be much more bandwidth intensive (the victim would notice that "their internet has become slow").
On the other hand, getting that money out of the botnet and into the black-hat's pockets is going to be tough:
cryptocurrency aren't anonymous. in fact they work based on the exact opposite: every single transaction is boardcaster to the whole network. While this provide good security against counterfeit wiithout needing a central authority (the whole point of the bitcoin protocole), that also means that anyone can follow the transaction following this mining.
If the hackers indeed used a rare CPU-based coin, that means that they can't do much except exchange it on one of the few major exchange which accepts even very minor coins (like cryptsy). That means it's rather easy for law forces to collaborate with cryptsy to try and catch any transaction with coins coming from this mining- then it's just a question of matching this transaction with user profiles and/or follow the money trail further.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Is there a mechanism built into the bitcoin structure that allows for this and voids the coins?
Is there a mechanism built into hard cash that allows to void the silvercoins/bank bills to be remotely voided? No.
And basically any cryptocurrency works the same. There's by definition NO SINGLE ENTITY in control of the bitcoin protocol (that's the whole point of it).
so nobody could remotely void any coin. (but at least that means that legally earned crypto-mony won't suddenly vanish neither... no fraudulous chargebacks on the bitcoin network)
On the other hand, cryptocurrencies aren't anonymous. At all. In fact they are (again by definition) the exact opposite: every signle transaction is broadcasted to the whole network. That really helps the security (thus every single node on the network can check and verify all transaction) without needs for a central authority (see previous point). But that also means that anyone can follow transaction a follow money jumping from one public key to another.
As the blackhats aren't probably mining actual bitcoins, but some minor alt-coins which is much more mine-able on CPUs, at some point, they'll need to exchange it for something more easily spendable. So they need to send them to one of the (few) exchanges accepting less known coins (Probably cryptsy).
Law forces could collaborate with exchanges and try to catch transaction whose coins can all be traced back to the initial mining by this botnet.
Then it's a matter of matching transaction with profiles registered at the exchange or further following the money trail.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
At the current bit coin difficulty, I would have thought even a large botnet of conventional CPUs would be pretty pointless.
impossible to make any cash mining bitcoin this way, probably mining primecoin or one of the other CPU based alt coins
that if you DVR fishing shows, you spread worms, too
if this is supposed to be a new economy, how come they still want my old fashioned money?