Cryptojacking is quickly becoming a very serious problem in the world of security and cryptocurrency. Especially when it comes to unprotected online administration consoles, a lot of damage can be done. Surprisingly, Tesla has fallen victim to this increasingly popular trend as well. It is evident cryptocurrency mining malware will not be going away anytime soon.
In recent months, cryptojacking has affected a fair few companies. Aviva, a British insurance company, and Gemalto, the world’s largest manufacturer of SIM cards, are two of the more noteworthy targets to date. Both firms had their login credentials for their Amazon Web Services and Microsoft Azure environments exposed due to lackluster security. Criminals used those credentials to infect these platforms to mine cryptocurrencies such as Monero and Zcash. This activity flew under the radar for some time, but it was eventually addressed successfully.
Unfortunately, those are not the only major companies to have fallen victim to cryptojacking. In fact, this threat has become so popular that major firms are at risk of falling victim now more than ever before. The current method of attack is also rather different compared to the earlier incidents. Some malware types steal credentials from computer memory, whereas others use stealthy mining tools to generate cryptocurrencies without stressing infected systems too much.
What makes this particular incident rather interesting is that the criminals didn’t use a public mining pool to generate cryptocurrency. Instead, the installed malware connected to an unlisted endpoint, which made it impossible for Tesla’s security solutions to detect this activity right away. Moreover, the mining pool service’s IP address was obfuscated using CloudFlare. This allowed them to switch the IP of this mining pool with just a few clicks, which means this particular pool will remain a problem for quite some time to come.
It is also interesting to note how this “new” malware hides itself quite well when it comes to utilizing CPU resources. In fact, the hijacked Tesla Kubernetes dashboard didn’t show a big increase in CPU usage, which is rather interesting. This further confirms criminals will modify this malware to evade detection for as long as possible. It is unclear how much money they made while Tesla’s servers were infected, though.
Source: Tesla Falls Victim to Increasingly Popular Cryptojacking Trend – The Merkle
