黑基网 首页 资讯 安全圈 查看内容

半年 700 万美元 这波挖矿黑客靠着别人的电脑赚翻了

2018-3-8 12:51| 投稿: xiaotiger |来自: 互联网

摘要: 比特币等虚拟货币价格的一路飙升让一些手中有技术的黑客们坐不住了,一场虚拟货币淘金热正在疯狂进行中。不过,他们并没有带着自己的挖矿机参与这场狂欢,而是“奴役”起了其他无辜用户的电脑。事实证明,这还真是个 ...

比特币等虚拟货币价格的一路飙升让一些手中有技术的黑客们坐不住了,一场虚拟货币淘金热正在疯狂进行中。不过,他们并没有带着自己的挖矿机参与这场狂欢,而是“奴役”起了其他无辜用户的电脑。

事实证明,这还真是个暴利行业,研究人员在过去 6 个月内追踪了一个挖矿团伙,它们居然利用 1 万台感染了挖矿恶意软件的电脑挣了 700 万美元。

对于网络安全从业者来说,挖矿恶意软件的崛起是意料之中,不过此类软件复杂度提升如此之快是人们始料未及的。黑客们为了暴利,手里的黑科技可都用上了。研究人员发现,一些只在高级持续性威胁(APT)中才会用到的黑客技术和工具都成了挖矿小组们的标配。

据雷锋网了解,卡巴斯基实验室周一发布了最新报告,研究人员剖析了三个挖矿小组,它们都是虚拟货币潮背景下的变种网络罪犯。卡巴斯基实验室研究人员 Anton Ivanov 指出,这些小组行事低调,完全没有其它黑客咄咄逼人的气势,但他们却悄悄潜伏在了电脑或数据中心里。

研究人员估计,光是去年一年,就有 270 万用户中招,成了黑客的免费挖矿机,而 2016 年时感染此类病毒的电脑只有 187 万台(增速高达 50%)。

“除了控制个人用户的电脑,企业电脑也成了黑客的目标。这些恶意软件则主要通过广告软件、破解游戏和盗版软件传播。”研究人员在报告中写道。“此外,黑客还通过被感染网页上一个特殊的 JavaScript 代码来入侵受害者电脑,Coinhive(网页挖矿机)就是其中最为臭名昭著的,很多受欢迎的网站上都被黑客埋了雷。”

用别人电脑挖矿成了 2017 年的新潮流

为挖矿搭建的大型僵尸网络

卡巴斯基实验室将第一个挖矿团伙命名为 Group One,这波人为了挖矿牟利,居然利用遍布全球的 1 万多台电脑和服务器搭建了僵尸网络。研究人员还表示,这些电脑很容易被控制,只要他们没打上漏洞补丁(如永恒之蓝),就有可能成为黑客的免费挖矿机。

“该团伙主要挖门罗币,而且还用上了定制版的挖矿机。”Ivanov 说道。“为了持续获利,他们甚至用上了类似 Process Hollowing 和操纵 Windows 系统任务管理器等手法。”

这里所说的 Process Hollowing 是现代安全软件中常用的进程创建技术,虽然在使用任务管理器等工具查看时,这些进程是合法的,但事实上该进程的代码已被恶意内容替代。卡巴斯基指出,这是它们第一次在挖矿攻击中发现该技术。

Windows 上的任务管理器一直都是黑客的突破口,它几乎成了恶意软件最好的伪装。感染了恶意软件的用户几乎没什么察觉,因为在开始界面中,这些软件都有着人畜无害的名字。不过,它们启动后挖起矿来可是一点都不客气。

攻击前罪犯们会提前寻找受害者

第二个挖矿团伙(Group Two)与 Group One 不同,他们可“挑剔”的很。

在对该团伙进行分析后,卡巴斯基发现了 PowerShell 脚本中的硬编码信息,他们认为“黑客会提前对受害者进行‘空中侦察’,以选定自己的目标。Group Two 如此挑剔主要是怕将恶意软件植入系统管理者或安全官电脑中,这样的专家能很快识破他们的伎俩。

由于该团伙用的是私有矿池,因此他们到底赚取了多少暴利还是个未知数。不过,鉴于该团伙用了不少复杂技术且专挑大公司下手,Ivanov 认为他们的牟利金额至少在百万美元级别。

倒卖计算能力

雷锋网发现,Group Three 团伙的玩法又不一样了,他们搭建起来的挖矿套件自己不用,而是拿到网上售卖。卡巴斯基的报告显示,该套件基于一个定制的脚本,专挖在暗网上做广告的门罗币。

此外,这套挖矿套件还能进行深度定制,购买者可以调整 CPU 使用率,当受害者打开吃性能的游戏时,它还会自动进入休眠状态以防被发现。

“这些套件的目标是细水长流,普通用户恐怕很难意识到它们的存在。”研究人员解释道。

此外,在报告中卡巴斯基还警告称,曾经在黑客界红极一时的勒索软件已经锋芒不在,现在最火爆的就是这种虚拟货币恶意软件,而其中的参与者有很多都是从勒索软件开发转行的。

这波“转行”也是666。

再现“黑吃黑”,CPU窃贼的相杀

除了上述三个“搞事”挖矿组,雷锋网发现,挖矿界也不乏黑吃黑事件。

根据不久前云头条的报道,编写恶意软件以挖矿加密货币的不法分子已开始编写代码,将竞争对手赶出已中了招的计算机。

最先注意到这个矿工的是SANS互联网风暴中心的安全顾问泽维尔�6�1默滕斯(Xavier Mertens)。3月4日,Martens发现了PowerShell脚本,其在感染机器前先检查目标机器是32位系统还是64位系统,然后下载名为hpdriver.exe或hpw64的文件(它们佯称是某种惠普驱动程序)。如果安装成功,攻击脚本会列出正在运行的进程,杀死发现的其他任何耗用CPU资源的进程。

图片来源:云头条

“争夺CPU周期的好戏开始上演了!”Mertens说道。

雷锋网 Via.Threat Post参考来源:云头条

, groupId: 6530024996478124551, itemId: 6530024996478124551, type: 2, subInfo: { isOriginal: false, source: 雷锋网, time: 2018-03-07 10:32:00 }, tagInfo: { tags: [{"name":"网络安全"},{"name":"黑客"},{"name":"卡巴斯基"},{"name":"Windows"},{"name":"软件"}], groupId: 6530024996478124551, itemId: 6530024996478124551, repin: 0, }, has_extern_link: 0 }, commentInfo: { groupId: 6530024996478124551, itemId: 6530024996478124551, comments_count: 8, ban_comment: 0 }, mediaInfo: { uid: 6101038992, name: 雷锋网, avatar: //p3.pstatp.com/large/2b7000b08216d5fe4e6, openUrl: /c/user/6101038992/, follow: false }, pgcInfo: {"media_info":{"open_url":"/c/user/6101038992/","avatar_url":"https://p3.pstatp.com/large/2b7000b08216d5fe4e6","media_id":6101038992,"name":"雷锋网","user_verified":false},"articles":[{"item_id":"6530415876070441475","url":"/item/6530415876070441475","title":"如何用张量分解加速深层神经网络?(附代码)"},{"item_id":"6530410208668156424","url":"/item/6530410208668156424","title":"告别 SIM 卡,联通首推 eSIM 服务"},{"item_id":"6530399520256164360","url":"/item/6530399520256164360","title":"5G 商业化指日可待,高通是如何做到一路领跑的?"},{"item_id":"6530396604296331789","url":"/item/6530396604296331789","title":"加密货币当货币用?俄罗斯财政部:这是犯罪"}]}, feedInfo: { url: /api/pc/feed/, category: __all__, initList: [{"comments_count":139,"media_avatar_url":"//p2.pstatp.com/large/41100083a7ca7958545","is_feed_ad":false,"is_diversion_page":false,"title":"红极一时的打星,两度离婚后负债累累,暴毙家中数日无人管","single_mode":true,"gallary_image_count":13,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530100241931174408/","source":"阳光八卦君","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":27,"image_url":"//p3.pstatp.com/list/190x124/6c370000c39949a0f4ce","group_id":"6530100241931174408","is_related":true,"media_url":"/c/user/6369728762/"},{"comments_count":5,"media_avatar_url":"//p1.pstatp.com/large/38310011f2e109c03351","is_feed_ad":false,"is_diversion_page":false,"title":"比特币一年涨20倍?别只见投资吃肉忘了投机客跳楼","single_mode":true,"gallary_image_count":2,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530037078946742797/","source":"SexyVC","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/6c3000063f02d5e8fb00","group_id":"6530037078946742797","is_related":true,"media_url":"/c/user/68142929933/"},{"comments_count":27,"media_avatar_url":"//p1.pstatp.com/large/4389000104c72cca3f80","is_feed_ad":false,"is_diversion_page":false,"title":"老婆月薪好几万,看到银行流水账单之后,我决定离婚","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530025257657434632/","source":"小格夫人","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"image_url":"//p3.pstatp.com/list/190x124/6c36000017e3144174a3","group_id":"6530025257657434632","is_related":true,"media_url":"/c/user/75171073356/"},{"comments_count":1,"media_avatar_url":"//p10.pstatp.com/large/4e61000018a60ff89436","is_feed_ad":false,"is_diversion_page":false,"title":"弱势普跌,你的信仰还在吗?3月7日行情分析","single_mode":true,"gallary_image_count":1,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530196995938714115/","source":"股权之道","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/6c340002a180003dbd42","group_id":"6530196995938714115","is_related":true,"media_url":"/c/user/59041330875/"},{"comments_count":24,"media_avatar_url":"//p2.pstatp.com/large/14f00161f2e0bcfd617","is_feed_ad":false,"is_diversion_page":false,"title":"这位温州小伙出演了一部电影,燃爆了!票房怒破30亿……","single_mode":true,"gallary_image_count":5,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530137440412238339/","source":"钱塘兵事","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/65c0001206ff6e8b2fa8","group_id":"6530137440412238339","is_related":true,"media_url":"/c/user/6038463142/"},{"comments_count":20,"media_avatar_url":"//p6.pstatp.com/large/5d4a00007fe28d2d266d","is_feed_ad":false,"is_diversion_page":false,"title":"币安交易所被盗!全球最大数字货币交易平台!","single_mode":true,"gallary_image_count":2,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530263686550913540/","source":"大头说币","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"image_url":"//p3.pstatp.com/list/190x124/6c37000258e819beb2ea","group_id":"6530263686550913540","is_related":true,"media_url":"/c/user/82135994501/"},{"comments_count":124,"media_avatar_url":"//p3.pstatp.com/large/2c6b000f237bb18f12b6","is_feed_ad":false,"is_diversion_page":false,"title":"一夜暴富到“一夜暴负”,我被现金贷坑惨了","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6510365786681377293/","source":"每日必读消息","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":50,"image_url":"//p3.pstatp.com/list/190x124/56950004f1428294952e","group_id":"6510365786681377293","is_related":true,"media_url":"/c/user/64542327563/"},{"comments_count":22,"media_avatar_url":"//p9.pstatp.com/large/504100068d1093bcd023","is_feed_ad":false,"is_diversion_page":true,"title":"币安暂停提币传遭黑客攻击,数字货币全盘大跌","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530267472661053955/","source":"36氪","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/65c600009f1a5c0f4328","group_id":"6530267472661053955","is_related":true,"media_url":"/c/user/3757989448/"},{"comments_count":53,"media_avatar_url":"//p3.pstatp.com/large/470400038795dddfed75","is_feed_ad":false,"is_diversion_page":false,"title":"票房31亿,利润12亿,他却只要10万片酬,没王宝强一天赚得多","single_mode":true,"gallary_image_count":6,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530077406181458440/","source":"小阳观娱","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":4,"image_url":"//p1.pstatp.com/list/190x124/6c340001c3dfeff7e071","group_id":"6530077406181458440","is_related":true,"media_url":"/c/user/77170607653/"},{"comments_count":14,"media_avatar_url":"//p3.pstatp.com/large/594100040ef55cccdb7a","is_feed_ad":false,"is_diversion_page":false,"title":"新一轮的比特币瀑布来临,大家抓稳扶好了","single_mode":true,"gallary_image_count":2,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530108368978182663/","source":"以特星","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"image_url":"//p1.pstatp.com/list/190x124/6c370000e459a7cc8f73","group_id":"6530108368978182663","is_related":true,"media_url":"/c/user/53259159174/"},{"comments_count":49,"media_avatar_url":"//p1.pstatp.com/large/ef700179dc8483ce09c","is_feed_ad":false,"is_diversion_page":false,"title":"黑客武库升级DDoS电磁炮 威力已不止瘫痪美国半张互联网","single_mode":true,"gallary_image_count":7,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6528289326009156099/","source":"爱活网","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/65bc000e0a6a0cee8683","group_id":"6528289326009156099","is_related":true,"media_url":"/c/user/3349501823/"},{"comments_count":0,"media_avatar_url":"//p1.pstatp.com/large/5e770002dc018f7fbec8","is_feed_ad":false,"is_diversion_page":false,"title":"比特币背后的“男人”———区块链","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530181429299511815/","source":"科技创造新生活","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/6c3400032a42a9f17b84","group_id":"6530181429299511815","is_related":true,"media_url":"/c/user/72162092539/"},{"comments_count":84,"media_avatar_url":"//p9.pstatp.com/large/54ee000a0ecef7fcd164","is_feed_ad":false,"is_diversion_page":false,"title":"英特尔i3 8100完成历史使命,价格开启跳涨模式","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530202162599821831/","source":"智慧新视界","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/6c35000269fc0409cc29","group_id":"6530202162599821831","is_related":true,"media_url":"/c/user/70336188854/"},{"comments_count":18,"media_avatar_url":"//p1.pstatp.com/large/6cb0003068f5da06941","is_feed_ad":false,"is_diversion_page":false,"title":"母亲猝死墙壁里藏2万现金腐烂 银行员工化腐朽变现金","single_mode":true,"gallary_image_count":9,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530364894837998094/","source":"看看新闻","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":55,"image_url":"//p3.pstatp.com/list/190x124/65c600015f940d343afc","group_id":"6530364894837998094","is_related":true,"media_url":"/c/user/5839829632/"},{"comments_count":80,"media_avatar_url":"//p3.pstatp.com/large/3b0800018282f0e4a49e","is_feed_ad":false,"is_diversion_page":false,"title":"最强佛系吃鸡外挂,把把都是零杀吃鸡!","single_mode":true,"gallary_image_count":24,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530019231499551245/","source":"小鸡游戏","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":2,"image_url":"//p1.pstatp.com/list/190x124/6c32000041667065fa8b","group_id":"6530019231499551245","is_related":true,"media_url":"/c/user/69695930405/"},{"comments_count":15,"media_avatar_url":"//p10.pstatp.com/large/66b1000282dbdc449ade","is_feed_ad":false,"is_diversion_page":false,"title":"比特币“它妈”也疯狂:一天一个价,一机一世界","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529667871335776775/","source":"安于现在","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":3,"image_url":"//p1.pstatp.com/list/190x124/6c3000030e52fc639809","group_id":"6529667871335776775","is_related":true,"media_url":"/c/user/58651266561/"},{"media_avatar_url":"//p4.pstatp.com/large/39aa000417f58e690863","is_feed_ad":false,"is_diversion_page":false,"title":"比尔·盖茨:“几乎肯定”我们将经历又一次金融危机","single_mode":false,"gallary_image_count":0,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530269922113618446/","source":"第一财经","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":17,"comments_count":404,"group_id":"6530269922113618446","is_related":true,"media_url":"/c/user/5431132532/"},{"comments_count":24,"media_avatar_url":"//p2.pstatp.com/large/2b60024d62c9ee113c9","is_feed_ad":false,"is_diversion_page":false,"title":"真的?被传坐拥“2千个王健林”的神秘罗斯柴尔德家族即将来中国","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530224154732397063/","source":"江南都市报","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":4,"image_url":"//p9.pstatp.com/list/190x124/6c3800014e951eaefea0","group_id":"6530224154732397063","is_related":true,"media_url":"/c/user/5979976554/"},{"comments_count":56,"media_avatar_url":"//p1.pstatp.com/large/47260003f9b345c28a2b","is_feed_ad":false,"is_diversion_page":false,"title":"今日头条刚过新手期?手把手教你如何 用视频赚收益!","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529645639196738061/","source":"不曾忘怀的时光","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/pgc-image/1520302261006a33d5b1c00","group_id":"6529645639196738061","is_related":true,"media_url":"/c/user/50826050330/"},{"comments_count":18,"media_avatar_url":"//p1.pstatp.com/large/5939000446b58fcd73ad","is_feed_ad":false,"is_diversion_page":false,"title":"网赚项目:6个用手机赚钱的APP项目","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530048599449928195/","source":"斯文人123","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/594100048f75c06e848b","group_id":"6530048599449928195","is_related":true,"media_url":"/c/user/3581706975/"}] }, shareInfo: { shareUrl: https://m.toutiao.com/item/6530024996478124551/, abstract: 比特币等虚拟货币价格的一路飙升让一些手中有技术的黑客们坐不住了,一场虚拟货币淘金热正在疯狂进行中。不过,他们并没有带着自己的挖矿机参与这场狂欢,而是“奴役”起了其他无辜用户的电脑。
小编推荐:欲学习电脑技术、系统维护、网络管理、编程开发和安全攻防等高端IT技术,请 点击这里 注册黑基账号,公开课频道价值万元IT培训教程免费学,让您少走弯路、事半功倍,好工作升职加薪!



免责声明:本文由投稿者转载自互联网,版权归原作者所有,文中所述不代表本站观点,若有侵权或转载等不当之处请联系我们处理,让我们一起为维护良好的互联网秩序而努力!联系方式见网站首页右下角。


鲜花

握手

雷人

路过

鸡蛋

相关阅读

最新评论


新出炉

返回顶部