{"id":88554,"date":"2018-10-11T21:52:19","date_gmt":"2018-10-12T04:52:19","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=88554"},"modified":"2020-04-09T18:43:06","modified_gmt":"2020-04-09T17:43:06","slug":"adobe-flash-being-used-for-cryptojacking","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/adobe-flash-being-used-for-cryptojacking\/","title":{"rendered":"Adobe Flash Being Used For Cryptojacking"},"content":{"rendered":"

Cybersecurity software company Palo Alto Networks reports that miners looking to use your computer to expand their hashing power are getting sneakier. New fake Adobe updates are circulating that will actually update the plugin on your computer, but also install illicit mining malware<\/span><\/a>. <\/span><\/p>\n

Hiding Behind Legitimate Sofware<\/h2>\n

These fakes are especially insidious because they do install the correct program along with the malware, fooling the user into believing that the update is legitimate.<\/span><\/p>\n

As in other instances of illicit mining, the hackers are going after Monero<\/a>, who\u2019s mandatory privacy protocol makes it extremely hard to trace. The fake installer updates Adobe Flash on the victim\u2019s computer while installing XMRig in the background. The hidden program then uses the host computer\u2019s processing power and graphics card to mine Monero without them knowing. <\/span><\/p>\n

Over one hundred of these fake update programs have been found by Palo Alto since March, according to TechCrunch. As the XMRig software page lists an idle operating system is ideal for maximum efficiency<\/span><\/a>, its likely that this malware activates when a host computer isn\u2019t being used.<\/span><\/p>\n

\"\"
Graph by Palo Alto Networks showing the spike in fake Flash updaters in 2018.<\/figcaption><\/figure>\n

Flash has long been a favorite method for installing malware on the systems of unsuspecting users, which, along with updates to the web like HTML5 meaning Flash use is on the decline, probably contributed to Adobe\u2019s decision to kill it in 2020<\/span><\/a>. <\/span><\/p>\n

The Problem of Illicit Mining Malware Continues<\/h2>\n

Illicit mining has grown exponentially this year, as stated in a report released by the Cyber Threat Alliance (CTA) last month. Hackers are using fake installers like the one discovered by Palo Alto Networks, but also exploiting vulnerabilities like Eternal Blue which allow them easy access to older systems. Once in, they install similar hidden malware that hijacks a computer into their mining network.<\/span><\/p>\n

CTA Chief Analytical Officer Neil Jenkins stated that cryptojacking is the \u201ccanary in the coal mine” of attacks because bad actors could exploit the same vulnerabilities used in cryptojacking for even more nefarious purposes. The executive summary report includes:<\/span><\/p>\n

\n

\u201cIllicit cryptocurrency mining is the figurative canary in the coal mine, warning you of much larger problems ahead. CTA members recount case after case of being called into an incident response for a mining infection and finding signs of multiple threat actors in the network.\u201d<\/span><\/p>\n<\/blockquote>\n

Users may be wise to stick to newer protocols that don\u2019t require the use of Flash, scan their systems regularly for malware with a reliable program, and be wary of any update notifications they might not recognize. Palo Alto Networks provides an appendix of fake updater examples and tips on how to spot them in their blog post.<\/a><\/span><\/span><\/p>\n

\n

Unit 42 investigates a recent Fake Flash update pushing cryptocurrency mining software. Get the full report https:\/\/t.co\/qGt1Z1NNHw<\/a> pic.twitter.com\/ZejZE3sDpI<\/a><\/p>\n

— Unit 42 (@Unit42_Intel) October 11, 2018<\/a><\/p><\/blockquote>\n