New Skype Malware Uses Victims' Machines To Mine Bitcoins 132
An anonymous reader writes "A new piece of malware propagating across Skype has been discovered that tries to convince the recipient to click on a link. What makes this particular threat different is that it drops a Bitcoin miner application to make the malware author money. While malware has both spread on Skype and mined Bitcoins before, putting the two together could be an effective new strategy."
Re: (Score:2)
Dunno, but I've been waiting for this to happen. It's an obvious step for botnet owners.
Re: (Score:3)
Dunno, but I've been waiting for this to happen. It's an obvious step for botnet owners.
It would be an obvious step a couple years ago. Bitcoin mining with CPUs is so pointless that they removed the function from the software. Most computers likely to be infected likely won't have a powerful GPU, and GPU mining will become pointless pretty soon regardless.
Re: (Score:2)
Bitcoin mining with CPUs is so pointless .
Only if you're paying for the electricity yourself.
If somebody else is paying ... hey, why not?
Re: (Score:3)
Bitcoin mining with CPUs is pointless .
Only if you're paying for the electricity yourself.
If somebody else is paying ... hey, why not?
There are better and more lucrative things to do with botnets. If you have a botnet and can't think of anything better to do with it, you can lease it out or sell it. The tiny amount of money bitcoin on commodity hardware would bring in pales in comparison to selling bank accounts, sending spam, renting out attacks, etc. Keep in mind that as a zombie computer becomes more "obvious"- computer is slower, fan runs at 100% all the time, etc, the more likely that the malware will be noticed and removed.
Re:Nerdcoin Apologists (Score:4, Insightful)
Keep in mind that as a zombie computer becomes more "obvious"- computer is slower, fan runs at 100% all the time, etc, the more likely that the malware will be noticed and removed.
Typical geek thinking.
So what if it gets removed? If it ran for a week on 100,000 machines with somebody else paying for the electricity then it was totally worth it.
Re: (Score:3)
Re: (Score:1)
Or you could do all of the above. Many DDoS uses reflection amplification and do not require a lot of cpu time and aren't running 24/7. Spamming is similar in that it is limited by the bandwidth. In fact, most of the nefarious things I can think of are limited by network, not anything else. Mining, on the other hand, does not really use networking and can use all the cpu and gpu they have to spare.
Re: (Score:1)
...making about 7 dollars per hour...maybe 70 dollars per hour...that seems pretty good to me.
Your hourly rate for federal crime is very reasonable. I will contact you, should I need ur services
Re: (Score:2)
Thank you for letting us know that the average /. poster knows more about ways to make money with bots than people that actually write and use them.
Re: (Score:2)
Yes, but you assume that
{Slashdotters} != {botnet devs}
Which IMO is not the most reasonable assumption to make. :)
Re: (Score:2)
The average /. poster knows more about anything than anyone. That's why everytime there's a scientific article there's people popping out of the woodwork going: "Aha! Bet they didn't think of that, did they?".
Preferably without actually reading the article that adresses that very point ;-)
Re: (Score:3)
Except dealing with any third-parties increases your risk. Which one of them has loose lips, poor security, is a snitch or an undercover officer? Even criminals don't want to hang out with other criminals more than they have to.
I
Re: (Score:1)
Re: (Score:2)
It did not turn into one of those cacophagy or homos-in-the-hayloft trolls.
Be content.
Re: (Score:2)
coprophagy.
cacophagy isn't typically considered a word, but read in greek it would mean "eating of evil".
Re: (Score:3)
THINGS NOT TO DO BEFORE MORNING COFFEE ( updated ):
1. ... ... ...
2.
3.
4. Operate heavy equipment.
5. Juggle Greek prefixes without exercising the utmost care.
Thanks.
Re: (Score:3)
There are better and more lucrative things to do with botnets.
The two are not mutually exclusive.
Re: (Score:1)
Keep in mind that as a zombie computer becomes more "obvious"- computer is slower, fan runs at 100% all the time, etc, the more likely that the malware will be noticed and removed.
I was mining Litecoins this morning and even though my computer was relatively quiet (mining with GPU) compared to fans at 100%, etc, it was still painfully slow. When I hovered over a link it would take a second to change colors. Literally a second. The user would probably notice that too. Though it wasn't laggy when I was mining Bitcoins so...who knows.
Re: (Score:2)
Surely, if you mine bitcoins, then you have to put the mined bitcoins somewhere. One small hack to replace the coins with bogus ones would make the whole botnet glow like a firefly?
Re: (Score:2)
It's depressing how many people miss the obvious - two problems fixed by plugging in cables on Friday was a bit of a reminder for me on that one.
Re: (Score:2)
Butterflylabs offer ASIC miners in configurations from 5 GH/s to 1500GH/s. Lets assume that the difference is the number of ASICs inside and that a single ASIC represents 5 GH/s.
According to the bitcoin wiki mining hardware comparison a 3.0 GHz core 2 duo E8400 gives 6.9MH/s so 400 thousand of them would give 2760 GH/s
Plus in a real botnet some of your zombies would also have GPUs.
Re: (Score:3)
Butterflylabs offer ASIC miners
They offer them, but they don't ever seem to ship them, and if they did ship all of the orders, the difficulty rate would go 4 to 16 times harder because of the sudden massive increase in mining.
Re: (Score:1)
Re: (Score:2)
Yeah... if you're going to try mining with a botnet, it would make a lot more sense to mine Litecoins instead. The Litecoin mining software still works relatively well with CPU miners, and there is a better chance that the currency is going to appreciate in value.
Re: (Score:2)
Dunno, but I've been waiting for this to happen. It's an obvious step for botnet owners.
It has been going on since 2011.
Re: (Score:2)
I'm by no means a bitcoin apologist, but I it's not really different from using the same stolen cycles for any other commercial purpose, such as sending spam, hosting phishing sites, launching DDoS attacks, and so on. I wouldn't be surprised if there are cloud providers that run customers' jobs on botnets.
The interesting thing would be if the botnet is sufficiently large that it passes the magical 50% mark required to take control of the entire network.
Re: (Score:1)
Re: (Score:1)
Posting AC to preserve mods. I do know the owner of the site, but am not affiliated in any way.
Re: (Score:2)
And I worked for years with this site's original webmaster.
So what exactly does this pseudo-name-dropping have to do with the price of tea in China, anyway?
Too little, too late? (Score:1)
Re: (Score:2)
That was exactly my thoughts when I first saw the headline. A top-end core i7 can manage a mere 20 Mhashs/s, while a GPU can do 2000 MH/s. The professional miners have moved on from GPUs to custom ASICs that can churn out as much 50GH/s.
The only way the malware purveyors are going to get anything of value out of this is if they get lucky and infect a number of high-end gaming rigs.
Re: (Score:2)
That was exactly my thoughts when I first saw the headline. A top-end core i7 can manage a mere 20 Mhashs/s, while a GPU can do 2000 MH/s. The professional miners have moved on from GPUs to custom ASICs that can churn out as much 50GH/s.
The only way the malware purveyors are going to get anything of value out of this is if they get lucky and infect a number of high-end gaming rigs.
What I find a bit surprising is that doing something so relatively overt would still be a viable use of a botnet. Running the CPU full tilt, especially given how many computers are ill-cooled and battery powered these days, is something that even a total non-techie is relatively likely to notice. I'm amazed that any bot-herder decided that the increased attrition from being noticed would be less expensive than CPU-mining bitcoins would be valuable(especially when alternatives like keylogging for bank and ot
Re: (Score:2)
Try going to the police with "Somebody is using my computer to mine bitcoins" vs "someone stole money from my bank account".
Re: (Score:2)
That was exactly my thoughts when I first saw the headline. A top-end core i7 can manage a mere 20 Mhashs/s, while a GPU can do 2000 MH/s. The professional miners have moved on from GPUs to custom ASICs that can churn out as much 50GH/s.
The only way the malware purveyors are going to get anything of value out of this is if they get lucky and infect a number of high-end gaming rigs.
A 10,000 machine bot running on machines that average 2Mhashes/sec is ten times as effective as your 2000MH/s GPU. It's not the speed of the machines, but the size of the botnet.
Re: (Score:2)
Re: (Score:1)
Indeed - from experience an average computer with standard GPU will do between 2 and 20 Mhash/s (not all GPUs will be usable, and most computers around with usable GPUs will have low-end ones). The best GPU's will make a whooping 600 to 900 Mhash/s, and even with that it'll be pretty hard to compete against the ASIC rigs - there's already devices making 60 Ghash/s (60,000 Mhash/s), and the upcoming rigs will do up to 1,500 Ghash/s (that's 1,500,000 Mhash/s!). In a few months the network difficulty will be s
Re: (Score:2)
A few hundred thousand or a million CPUs with someone else paying the electricity bill can still mine a few bitcoins. A $1500 ASIC setup does 40 or 50 thousand Mhash/s. If the average botnet machine does 50 Mhash/s on it's CPU/GPU you need a thousand infected machines to match that $1500 ASIC. If your botnet goes big and you get a hundred thousand machines, you've got a pretty nice mining setup.
Re: (Score:2)
So that really only leaves CPU mining as the no-fuss option. And a typical modern machine will do 3-6 MH/s per core, so figure 24MH/s as an upper limit for any fairly new high-end OEM machine. For comparison, the BitForce Jalapeno - If it ever ships - Wi
Re: (Score:2)
I'm pretty sure if I were into botnets I'd rather spend a weekend writing something to infect 20,000 machines than spend $15,000 on ASIC miners. That's using your numbers. Plus if someone comes along with a spam or DDOS job for you, you can switch to that, then back to mining when you're done.
If you've got a botnet lying around you might as well use it's off time.
Re: (Score:2)
That leads the logical conclusion that these will be mining on the CPU.
Re: (Score:2)
That depends on whether or not they effectively parallelized the algorithm. One Joe can't do it, but if you command a million Joe-bots it might be worth it. Maybe you don't even have to chop up work units. Maybe it's just a question of having enough "tickets" for the odds of one being a winner to go up. Since the tickets cost nothing there's no reason not to play except the possibility of getting caught. Since they're criminals already, "fear of getting caught" is a sunk cost.
What happens to those mined bitcoins? (Score:4, Interesting)
So when the user detects and presumably removes the malware, what happens to those mined bitcoins? Do they disappear? Are they still in the malefactor's account? Lastly, is there any chance of tracing and impounding the bitcoin account so that the bad guy doesn't profit?
Re: (Score:2)
Re:What happens to those mined bitcoins? (Score:5, Informative)
From what I understand, the trick is each miner goes through a search space. If it doesn't find anything, it requests another search space from the control server. If it does, it tells the control server about it. The control server then tells the rest of the world that it found this new bitcoin. If you shut down a machine during a search the control server eventually sees this and has another machine look through the same search space. This is basic parallel programming using a scatter-gather approach with a little bit of management on the server side.
As for the bitcoin itself. There's nothing anyone can do. There is no mechanism within the bitcoin system to declare a bitcoin to have been produced illegally. If the command and control server is shut down then the bitcoin wallet might very well be lost. In that case, the bitcoin is lost forever. See this CCC video about bitcoin loss, deflation, and why that's a bad thing. https://www.youtube.com/watch?feature=player_detailpage&v=-FaQNPCqG58#t=1137s [youtube.com] As cool as bitcoin is, it has serious problems which will keep it from being used in day to day life. Hyped Example: http://www.newstatesman.com/economics/2013/04/bitcoin-hyperdeflation [newstatesman.com]
The idea behind this malware is kind of neat though. It's not stealing log in credentials, so it doesn't need to do browser interception and then have the hacker physically dealing with banks. It doesn't preform ddos attacks or send spam, so it doesn't use any network resources except for talking to the command and control server. If it's written correctly, it should run at low priority with a small memory footprint. It might be using 100% CPU, but on a desktop machine, the user would probably never even know its there.
Re:What happens to those mined bitcoins? (Score:4, Insightful)
Bitcoin does indeed have problems that make it hard to use in daily life, but "deflation" is not one of them. BitPay has reported that when the value of a Bitcoin rises their transaction rate goes up not down, as macro-economists would predict. Perhaps because holders of coins feel rich and start to splash out. This should not surprise us. The consumer electronics industry has been in a permanent state of economy-destroying inflation since pretty much forever yet even better and cheaper smartphones/mp3 players/etc continue to fly off the shelves. And in case you'd like observations more rigorous, there is no empirical evidence of a link between deflation and depression [minneapolisfed.org].
Anyway, obviously the goal is that nobody loses Bitcoins through carelessness - there are many strategies to help people back up their keys, and over time they will become widely implemented and used.
Re: (Score:2)
BitPay has reported that when the value of a Bitcoin rises their transaction rate goes up not down, as macro-economists would predict
You're confusing long and short-term trends. If there is a consistent long-term trend upwards, then economics predicts that people will hold, because it's the rational thing to do. If there is a lot of volatility, then it predicts that people will sell when the value goes up and buy when it goes down. This means that you'd expect a lot of high-frequency trades when the value spikes, as people cash out. They'll then buy slowly at the bottom (so as not to push the price up too fast) and then sell again at
Re: (Score:2)
But the long term trend with Bitcoin has been upwards in both value and transaction volume. So what economics predicts simply doesn't line up with reality, no matter which way you slice the data.
Re: (Score:2)
Re: (Score:1)
there is no empirical evidence of a link between deflation and depression [minneapolisfed.org].
never had to take Viagra have you?
Re: (Score:3)
It might be using 100% CPU, but on a desktop machine, the user would probably never even know its there.
Is there a way to keep your program's CPU usage from showing up in Task Manager (etc)? If so, then the only other thing you'd need is a way to keep the computer's fans at their nominal levels so that the extra noise wouldn't tip the user off, and you're golden (at least until the computer catches fire).
Re: (Score:3)
For 99% of users it doesn't matter. Computers are the magic black boxes that either work or they don't.
While it might be fun to write a program that disables all thermal protections and stops the fans, it's quite a different challenge than a simple bitcoin miner.
I have enough trouble trying to set things using the officially provided drivers. Controlling hardware on an unknown machine... Anyone who could do that shouldn't have any trouble making quite a bit of money.
Re: (Score:2)
While it might be fun to write a program that disables all thermal protections and stops the fans, it's quite a different challenge than a simple bitcoin miner.
Of course you wouldn't disable thermal measures but instead add little moments of idle to the loop to keep the CPU utilization down.
Re: (Score:1)
Re: (Score:2)
The idea behind this malware is kind of neat though. It's not stealing log in credentials, so it doesn't need to do browser interception and then have the hacker physically dealing with banks. It doesn't preform ddos attacks or send spam, so it doesn't use any network resources except for talking to the command and control server. If it's written correctly, it should run at low priority with a small memory footprint. It might be using 100% CPU, but on a desktop machine, the user would probably never even know its there.
Indeed, it doesn't even need to have an exploit. If you implemented a miner in Javascript you could just stick it in an advertisement and have it crunch away in a sandbox. Granted, you couldn't keep it running when the tab is closed and it would be slow in Javascript, but it would work just fine.
Even if mining on non-specialized hardware is inefficient it doesn't cost the operator anything, and it greatly reduces their risk of being caught, assuming they don't use the stolen bitcoins in any traceable tran
Re: (Score:2)
Even if mining on non-specialized hardware is inefficient it doesn't cost the operator anything, and it greatly reduces their risk of being caught, assuming they don't use the stolen bitcoins in any traceable transactions (the bitcoins are always traceable, but to be caught you have to use them in some transaction that can link them up with your real-world identity).
The bitcoins would look entirely legit, as they wouldn't need to be actually minted on the zombie; the distributed client could just report the key information back to the C&C server which would then do the actual minting (very easy, as there would be no search required). From the outside world's perspective, it would look just like the C&C server has lots of kick-ass hardware to do the searching.
Re: (Score:2)
Good point - wasn't really thinking of that but it would be hard to ID the bitcoins that used the botnet for aid.
Re: (Score:1)
So when the user detects and presumably removes the malware, what happens to those mined bitcoins? Do they disappear?Are they still in the malefactor's account?
I would doubt the keys for the address the bitcoins end up in are stored on the infected machine.
Lastly, is there any chance of tracing and impounding the bitcoin account so that the bad guy doesn't profit?
No, Bitcoin was designed intentionally to not allow that sort of thing. Not so much to protect bad guys, of course, but to protect someone like a political dissenter from the government seizing/freezing their funds to silence them. Unfortunately you can't have one without the other.
Re: (Score:3)
Miners are looking for the lottery number (nonce) such that it plus a set of new bitcoin transactions and the hash of the previous block generates a new hash with a lot of leading zeros. The exact number the new hash has to be below is set by the total hashing power of the network. Thus the difficulty of the lottery is adjusted so that a new block is found every 10 minutes. If you win the lottery, you get to include 25 newly created bitcoins addressed to your own account, plus any transaction fees. At th
Re: (Score:2)
If you win the lottery, you get to include 25 newly created bitcoins addressed to your own account, plus any transaction fees. At the moment this is worth $3500 or so per block.
Hmm, for $3500 per block, I wonder if anyone has set up a "miner parasite" malware -- it would infect as many legitimate BitCoin-mining machines as possible, then do nothing until a mining machine discovered a winning hash. At that point it would intercept the miner's announcement of the winning hash code at the network level, so that instead of the announcement going out to the BitCoin network, it would go out to the malware creator's machine instead. The malware creator would then cash in on the new blo
Re: (Score:2)
If you have the malware that can detect a "winning block" being sent from a computer, then you can also extract the private key from said miner (and pull the coin out from under the worker.)
Re: (Score:2)
If they are mining in a pool, then it doesn't matter if they find the block. The more computation you contribute to the pool, the bigger % you get of the 25 BTC if the pool as a whole wins the lottery. It means there's a much higher probability of the botnet controller making money than the way you are describing.
Re: (Score:1)
Re: (Score:1)
hmm I don't think you get it.
Mining for bitcoin is the same process as maintaining the bitcoin network.
They are in effect being paid to run the bitcoin network.
Given the author of bitcoin is anonymous, it's unlikely he/she/it would be able to setup a foundation anonymously.
And even if they did, it would reduce bitcoin to nothing more than any of the numerous pre-existing failed e-currencies.
You can trust a open source piece of software run on millions of computers more than you can trust a foundation.
Re: (Score:1)
maybe Bitcoin was commissioned by computer hardware providers that wanted to give the processor market a boost when the Credit Crunch was at its worst.
Re:Mining for bitcoin, undermines bitcoin (Score:4, Insightful)
I know, right? Like those lumps of yellow metal or shiny hunks of clear carbon we mine from the Earth. Entirely arbitrary and ridiculous to assign any value to them.
If it makes more sense to you, it may help to stop thinking of it as "mining", and instead consider it as pay for doing the work necessary to add transactions to the blockchain.
Re: (Score:1)
cept those lumps of metal are physical items that can be used for more than money, bitcoin is imaginary and doesnt even act as a good currency let alone anything else
Re:Mining for bitcoin, undermines bitcoin (Score:4, Informative)
You should read up on the Bitcoin protocol/architecture. "Mining" isn't arbitrary, it's how the system verifies transactions and prevents double spending - you need mining for the whole system to work.
The fact that new coins can be gain from mining is not arbitrary either: first, it encourages people to mine, and therefore strengthens the network. Second, a big part of the Bitcoin appeal is that nobody can just inflate away the value of the coins one owns.
You may disagree with it, but it's definitively not arbitrary.
Absolutely futile (Score:2)
Had this been done with litecoin or namecoin, I could see some profit. Bitcoin? Sorry, difficulty rating is too high and just keeps going up.
On top of that, the type of people likely to click on this are also already likely exploited and running with limited system resources as-is.
Even the entire skype userbase couldn't stand up to the raw power behind half of the mining farms already out there.
What a stupid malware author.
Re: (Score:1)
They got sucked in by the bitcoin scam, but are using somebody else's electricity so they sound a bit less stupid than the usual mark for the bitcoin scam.
CPU Bitcoin Mining still makes sense for Botnets (Score:5, Interesting)
Yes, it's a waste of time and electricity for an individual to mine Bitcoins with their CPU, but if you have access to 100,000+ machines doing it, and you're not paying for the electricity, it's obviously worth it.
Re: (Score:1)
WUT?
67 BTC/day == $1,000/day? In other words - $16/BTC?
I thought it was more like $140 or so?
Maybe just add another zero in there...
Re: (Score:2)
A 250,000 machine botnet is extremely large, that puts you up in the worlds largest active botnets. Building and maintaining such a thing is not easy at all. To mine off that, you need to run a pool server that those machines can all get work from (as the existing pools will all ban you), which is a rather complex scaling problem all by itself, and then you have the fact that it's all a time limited technique. ASIC hardware has, from what I understand, finally started to ship in significant numbers from the
Re: (Score:2)
They've been doing it a long time. That's why the ZeroAccess guys run their own pool (or tried to at least).
Re: (Score:1)
Nice Messenger migration welcome (Score:2)
In case you have not heard, Hotmail's PC chat application, Messenger, is two days from being sunset [google.com] in favor of Skype. That will be causing a massive migration from users who ignored repeated upgrade emails from the MS team.
Just when I thought it was hard to convince my long-term guests that they should ignore the Messenger Icon, forcing themselves to learn the freshly installed Skype forced down our throats, I have to worry about their malware risks from a new vector of attack.
I very sparingly use the hot
Honeypot possible (Score:2)
Someone might modify the malware to still generate Bitcoins, but to record the coins generated. Then watch the blockchain to see who spends them. Bitcoins aren't anonymous. Mt. Gox has on at least one occasion frozen an account due to possession of "tainted" coins. [bitcointalk.org]
Bitcoin isn't as distributed as many enthusiasts think. 80% of transactions go through Mt. Gox, a/k/a Magic, the Gathering Online Exchange.
Windows malware propagating across Skype? (Score:2)
idiotic (Score:2)
Re: (Score:2)
Well, criminals are typically idiots. Otherwise they would go into accepted work for amoral characters, like banking, insurance or politics.
Re: (Score:1)
Re: (Score:2)
I believe the current difficulty of mining bitcoins is fixed until it becomes impossible. As they're currently going at an astonishing $145 (quadrupled over a month), it's extremely profitable to mine on ATI card. However, the FPGA will flood the market with Bitcoins and we willl see the price dropping, maybe crashing.
Only important question ... OS dependencies? (Score:2)
Assuming that Kaspersky are not complete and utter idiots, and that the Win32 element of the name means what it normally means, I have no further interest in the story.
Bye.
Re: (Score:2)
The virtual currency that is "safe", despite numerous examples of exchange hacks and theft.
What one has in an exchange isn't bitcoins, it's credit which they promise to exchange for bitcoins. It's bank money.
Wouldn't it make sense to hold off on your purchase if tomorrow your current bitcoin wallet can get you more?
It depends; the utility of having the item now may be greater than the gain by waiting. Otherwise, nobody would ever by phones, computers, cars, etc, since by waiting people could always get something better. Yet, these markets have a very high amount of sales.
Note: I don't own any Bitcoins; I think for now they're nothing but a speculator's toy. But I'm not writing them off just yet.
Re: (Score:2)
Re: (Score:2)
I can't "explain" an event that hasn't happened yet, except point out similarities to past events that this one so far is matching pretty well. But I'll just let this graph [clarkmoody.com] stand as an example of the past few days. Zoom out a little, say to the "D3" three day chart. If I was a retailer selling a $10 item and accepting bitcoin, I would currently have to be adjusting the price every minute. Does this make sense for a currency? Absolutely not. Better yet, when more money piles into bitcoin and prices elevate h
Re: (Score:2)
Personally I think it'd be easier to talk to a Catholic about the illogic of transubstantiation, but you go right ahead.
Re: (Score:2)
Re: (Score:2)
Okay, so how come none of that has happened yet even after multiple high-profile hacks and price crashes over the last several years? Each time something like that happens, plenty of people repeat every point you just made and insist that Bitcoin is going away this time for sure. But it only seems to get more popular over time.
I remember that arguement in the late 90's. "Netscape missed its earnings target, but it's getting more popular so buy buy!" or "The whole industry is overvalued, but that's not a problem because it's a new economy. Just look at how stock prices are going up"