Criminal Web-Injects Can Steal Cryptocurrency

Criminals have deployed a variety of tactics in recent months to try and profit from the cryptocurrency boom. One of them is the use of Web injects to intercept and modify traffic between user browsers and cryptocurrency sites in order to steal coins from victims and transfer it to accounts held by criminals.

Third-party risk management firm SecurityScorecard says it has seen recent evidence of threat actors using Web injects to target crypto-currency exchange Coinbase and Bitcoin wallet Blockchain.info.

Tens of thousands of bots can run the Web injects to steal crypto-currency, making them a potent threat for investors and exchanges, according to SecurityScorecard.

A Web inject is basically code for injecting malicious content into a Web page before the page is rendered on a user's browser. This work by intercepting and modifying traffic between a Web server and user browser in such a manner that the victim typically does not notice anything amiss.

Web injects can be used to add or delete content on the Web pages that a victim sees. For instance, a Web inject can be used to add a field in the login screen for capturing the PIN a user might use to access his or her bank account, or it can be used to delete warnings that a user might normally see when viewing a particular Web page.

Web injects typically have been used to steal credentials for accessing bank accounts, but recently have begun to play a role in crypto-currency heists as well.

Bot masters can readily buy the Web injects for Coinbase and Blockchain.info and distribute them to infected computers in a botnet, says Doina Cosovan, malware researcher at SecurityScorecard.

The malware installed on those infected computers receive the Web injects and inject them in the Coinbase and Blockchain.info websites if a user happens to visit either site.

These Web injects are provided as a service, so different malware families can use them. Cosovan says. "We noticed Zeus and Ramnit in particular, but these are simply examples we observed.

Any other bot master controlling bots infected with a malware family which has capabilities to inject code in websites can buy and use these Web injects on their bots," she notes.

The Web inject for Coinbase that SecurityScorecard discovered is designed to change the settings on a victim's account in order to enable digital coin transfers without requiring the user's confirmation.

When a user tries to log in to his or her Coinbase account, the injected JavaScript content first disables the "Enter" key for the email and password fields so the user has to actually click on the "Submit" button in order to submit the form, according to SecurityScorecard.

It also creates a new button that has mostly the same attributes as the original button, and a few additional malicious ones. It then adds the rogue "Submit" button on top of the original sign-in button so that the victim clicks on the malicious button rather than the original.

The ultimate goal is to capture the victim's multifactor authentication information and then using it to change account settings so further transactions can be carried out without requiring the user's approval.

"Once this change is made, the injected content can start making transactions without the need to authorise them with [two-factor authentication]," Cosovan says. "Even more, the user's access to the settings is blocked, so that he can't enable the two-factor authentication for transactions," she adds.

The Blockchain.info Web inject has somewhat similar functionality but in this case is designed to steal from a user's Bitcoin wallet and transfer the digital currency to accounts held by threat actors.

As a final touch, the Web inject presents the user with a "Service Unavailable" notice after stealing the crypto-currency, thereby delaying the victim's ability to detect the theft, SecurityScorecard said.

The use of Web injects in cryptocurrency theft is one of many tactics that cybercriminals are employing to profit from the surging interest in Bitcoin, Monero, and other cryptocurrencies worldwide. Even as defenders have adapted their tactics to deal with threats, criminals have come up with new ways around them.

Dark Reading

You Might Also Read: 

World's Biggest Ever Digital Currency Theft:

Bitcoin Exchanges Under Siege:

« The Cloud Is A Key To Cyber Defence
Cambridge Analytica, Facebook & GDPR »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Quttera

Quttera

Quttera provides Website Security Solutions for Small & Medium Businesses, Enterprises and Organizations.

Kualitatem

Kualitatem

Kualitatem Inc. is an independent software testing and information systems auditing company

REVI-IT

REVI-IT

REVI-IT is a Danish state-owned audit firm focusing on enterprise IT business processes and compliance,

Gate 15

Gate 15

Gate 15 provide risk management services focusing primarily on information, intelligence and threat analysis, operational support and preparedness.

NetGuardians

NetGuardians

NetGuardians is a leading Fintech company recognized for its unique approach to fraud and risk assurance solutions.

ditno

ditno

ditno uses machine learning to help you build a fully governed and micro-segmented network. Dramatically mitigate risk and prevent lateral movement across your organisation – all from one centralised

Wizard Cyber

Wizard Cyber

At Wizard Cyber, we simplify cyber security, delivering an advanced service that protects your high-risk assets from the complex threats that technology alone can miss, 24/7.

GRSi

GRSi

GRSi deliver next-generation systems engineering, cybersecurity, technology insertion and best practices-based Enterprise Operations (EOps) management.

BridgingMinds Network

BridgingMinds Network

BridgingMinds Network is an industry leading best practices and IT security training provider in Singapore.

Purple Knight

Purple Knight

Purple Knight is a free Active Directory security assessment tool built and managed by an elite group of Microsoft identity experts.

Sentra

Sentra

Sentra is focused on improving data security practices within the cloud, mitigating the risks of damaging data leaks by providing comprehensive visibility into critical data assets.

ANSSI Burkina Faso

ANSSI Burkina Faso

ANSSI is responsible for managing the security of information systems and cyberspace in Burkina Faso.

The Cyber Scheme

The Cyber Scheme

The Cyber Scheme provides NCSC certified and assured assessments, training and career support for security testers & technical cyber professionals.

True Corporation

True Corporation

True Corporation is Thailand’s leading Telecom-Tech company, empowering people and businesses with connected solutions that advance society sustainably.

Freeze

Freeze

Freeze prevents attacks before they can start by finding, removing, and stopping the spread of information about your organization and employees.

Planisys

Planisys

Planisys is a cybersecurity leader specializing in cutting-edge DNS security and email security solutions.