Cyberhackers are using compromised cloud accounts to mine cryptocurrency, Google has warned.
Details of the mining hack are contained in a report by Google’s cybersecurity action team, which spots hacking threats against its cloud service – a remote storage system where Google stores customers’ data and files off-site – and gives advice on how to tackle them.
Other threats identified by the team in its first “threat horizon” report include: Russian state hackers attempting to gain users’ passwords by warning they have been targeted by government-backed attackers; North Korean hackers posing as Samsung job recruiters; and the use of heavy encryption in ransomware attacks.
“Mining” is the name for the process by which blockchains such as those that underpin cryptocurrencies are regulated and verified, and requires a significant amount of computing power. Google reported that of 50 recent hacks of its cloud computing service, more than 80% were used to perform cryptocurrency mining.
Q&A
What is blockchain technology?
Show
Blockchain is a digital ledger that provides a secure way of making and recording transactions, agreements and contracts. However, uniquely, rather than being kept in one place like the more traditional ledger book, the database is shared across a network of computers.
This network can encompass just a handful of users, or hundreds and thousands of people. The ledger becomes a long list of transactions that have taken place since the beginning of the network, getting bigger over time.
A blockchain database consists of blocks and transactions. Blocks contain batches of transactions that are “hashed” and encoded. Each block contains the hash of the block before it, which links the two and forms the chain. This process validates each block, all the way back to the original, and is integral to the database’s security.
Blockchain technology has been around for a number of years – its most well-known use so far is Bitcoin, the virtual currency. The uses of blockchain are not limited to financial transactions, though, and enthusiasts are looking into other applications for the technology, especially for the types of transactions where there are often disputes or trust issues.
Katherine Purvis
The report said that “86% of the compromised Google Cloud instances were used to perform cryptocurrency mining, a cloud resource-intensive for-profit activity”, adding that in the majority of cases the cryptocurrency mining software was downloaded within 22 seconds of the account being compromised. Google said that in three-quarters of the cloud hacks the attackershad taken advantage of poor customer security or vulnerable third-party software.
Google’s recommendations to its cloud customers to improve their security include two-factor authentication – an extra layer of security on top of a generic user name and password – and signing up to the company’s work safer security programme.
Elsewhere in the report, Google said the Russian government-backed hacking group APT28, also known as Fancy Bear, targeted 12,000 Gmail accounts in a mass attempt at phishing, where users are tricked into handing over their login details. The attackers attempted to lure account holders into handing over their details via an email that said: “We believe that government-backed attackers may be trying to trick you to get your account password.” Google said it had blocked all the phishing emails in the attack – which focused on the UK, the US and India – and no users’ details had been compromised.
Another hacking ruse flagged by Google in the report involved a North Korea-backed hacker group posing as recruiters at Samsung and sending fake job opportunities to employees at South Korean information security companies. Victims were then steered towards a malicious link to malware stored in Google Drive, which has now been blocked.
Google said dealing with ransomware attacks, where the files and data on a user’s computer are encrypted by the attacker until a payment is made for their release, was difficult because heavy encryption “makes recovery of files nearly impossible without paying for the decryption tool”. The report flags the emergence of Black Matter, which it describes as a “formidable ransomware family”.
However, at the beginning of the month Black Matter said it was shutting down due to “pressure from the authorities”. Black Matter victims include the Japanese technology group Olympus.
The Google report said: “Google has received reports that the Black Matter ransomware group has announced it will shut down operations given outside pressure. Until this is confirmed, Black Matter still poses a risk.”
This news is republished from another source. You can check the original article here
Be the first to comment