Yahoo malware turned PCs into Bitcoin miners
Yahoo malware turned PCs into Bitcoin miners: The cybercriminals who infected the computers of European Yahoo users apparently wanted to create a huge Bitcoin network.
Researchers at security firm Light Cyber revealed this week that one of the malware programs aimed to use the resources of infected PCs to perform the calculations necessary to run a Bitcoin network. Reported earlier this month by fellow security firm Fox IT, the campaign spread its package by using Yahoo’s ad server to deploy malicious ads. The malware took advantage of vulnerabilities in Java to install itself on computers that visited the ads.yahoo.com site.
Light Cyber founder Giora Engel told CNET that his firm detected the attack in its customers’ networks four days before it was publicly known and reported by Fox IT. Engel explained how the firm learned of the malware:
Many of our customers share threat intelligence with our Magna Cloud, so our research lab noticed this unknown malware and attack campaign coming from our customers’ networks and investigated the specific case. As part of the investigation, we found a few tools that were downloaded by the malware. This specific attack campaign incorporated a variety of different monetization techniques using a variety of malwares. The attackers made sure they exploit each of the millions of infected machines to its full worth by employing Bitcoin miners, WebMoney wallet hackers, personal information extraction, banking information extraction, and generic remote access tools.
Engel said that Light Cyber detected a portion of the infected computers talking to Bitcoin mining pools on the Web, a sign that they were actually being used for mining. He also explained how Bitcoin mining works:
Bitcoin mining is a computationally heavy process that gets harder and harder in time. Bitcoin is mined in blocks, and since it takes a lot of computing power to mine a block, the miners join forces and form mining pools or “bitcoin mining networks” — in which each one participates with his computing power and gets in return his share of the revenue. In our case, the malware author would be the sole beneficiary of the mining efforts.
Bitcoin mining on computers is not usually worth the effort, Engel added, because the electrical cost of operating the computer is higher than the revenue garnered from the mining itself. But the malware author stole the computing resources of the affected machines and did it in such large numbers as to turn a profit from the operation.