Hackers turn hacked IP addresses into money

Online hackers steal IP addresses and convert them into cash by selling them to so-called proxyware services.

Malicious actors install proxyware on computers without the owner’s knowledge, then sell the unit’s IP address to a proxyware service, earning up to $10 a month for each compromised device, the Sysdig Threat Research Team.

Proxy services allow a user to earn money by sharing their Internet connection with others, researchers explained in a company blog post. Attackers, however, exploit the platforms to monetize victims’ Internet bandwidth, similar to how malicious cryptocurrency mining attempts to monetize the CPU cycles of infected systems.

“Proxy services are legitimate, but they’re for people who want to circumvent protections and restrictions,” observed Michael Clark, director of threat research at Sysdig, a San Francisco-based maker of a platform. SaaS form for threat detection and response.

“They use residential addresses to bypass bot protection,” he told TechNewsWorld.

For example, buying a bundle of a brand of sneakers can be very profitable, but websites put in place protections to limit a sale to a single pair at an IP address, he explained. They use these proxy IP addresses to buy and resell as many pairs as possible.

“Sites also trust residential IP addresses more than other address types,” he added. “That’s why there’s such a premium on residential addresses, but cloud services and mobile phones are also starting to be desirable for those services.”

Food for influencers

These apps are often promoted through referral programs, with many notable “influencers” promoting them for passive income opportunities, said Immanuel Chavoya, senior director of product security at network firewall maker SonicWall. in Milpitas, California.

“Revenue seekers download the software to share their bandwidth and earn money,” he told TechNewsWorld.

“However,” he continued, “these proxyware services may expose users to disproportionate levels of risk because users cannot control the activities performed using their personal and mobile IP addresses.”

ADVERTISEMENT

“There have been instances of users or their infrastructure being unwittingly involved in criminal activity,” he added.

This activity includes accessing potential click fraud or silent advertising sites, SQL injection polls, attempts to access the critical /etc/passwd file on Linux and Unix systems (which tracks users registered with access to a system), crawling of government websites, mining of personally identifiable information – including national ID cards and social security numbers – and mass registration of media accounts social.

Beware of Organizations

Timothy Morris, chief security adviser at Tanium, a maker of an endpoint management and security platform in Kirkland, Wash., pointed out that proxyware services can be used to generate web traffic or manipulate web search results.

“Some proxy clients will come with ‘bonus content’ which may be ‘Trojan’ or malicious, allowing unauthorized use of the computer running the proxy service, typically for crypto mining,” he said. told TechNewsWorld.

Organizations infested with proxyware can see the costs of managing their cloud platform rise and see service degradation, noted Crystal Morin, threat research engineer at Sysdig.

“And just because an attacker is doing crypto mining or proxyjacking on your network doesn’t mean that’s all they’re doing,” she told TechNewsWorld.

“There is concern that if they use Log4j or any other vulnerability and gain access to your network,” she continued, “they might be doing something other than using the system for profit, so you should take precaution and look for other malicious activity.

Clark added that an organization could also face reputational risks from proxyjacking.

“There could be illegal activity going on that could be traced to a company or organization whose IP address was taken, and they could end up on a deny list for threat intelligence agencies, which could lead to a whole host of problems if people stop dropping the victim’s internet connections,” he said.

“There are also potential law enforcement investigations that could take place,” he noted.

He added that the proxyjacking activity uncovered by Sysdig researchers targeted organizations. “Attackers cast a wide net across the entire internet and targeted cloud infrastructure,” he said.

“Usually,” he continued, “we would see this type of attack grouped into Windows adware. This time we see targeted networks and cloud servers, which are more business oriented.”

Log4j vulnerability exploited

The attackers studied by Sysdig researchers exploited the Log4j vulnerability to compromise their targets. This flaw in a popular open-source Java-based logging utility discovered in 2021 is estimated to have affected 93% of all enterprise cloud environments.

“Millions of systems are still running vulnerable versions of Log4j, and according to Censys, more than 23,000 of them are accessible from the Internet,” the researchers wrote.

“Log4j is not the only attack vector to deploy proxyjacking malware, but this vulnerability alone could theoretically generate over $220,000 in profit per month,” they added. “More conservatively, a modest compromise of 100 IP addresses will yield passive income of nearly $1,000 per month.”

ADVERTISEMENT

While that shouldn’t be a problem, there’s still a “long tail” of systems vulnerable to the Log4J vulnerability that hasn’t been patched, observed Mike Parkin, senior technical engineer at Vulcan Cyber, a SaaS provider for cyber business. hazard remediation in Tel Aviv, Israel.

“The number of vulnerable systems keeps dropping, but it will still take some time before it reaches zero – either because of all the remaining patches or those found and exploited,” he said. at TechNewsWorld.

“The vulnerability is being actively exploited,” Morris added. “There are also reports of a vulnerable version still being uploaded.”

Protect by detection

To protect against proxyjacking, Morin recommended strong and continuous real-time threat detection.

“Unlike cryptojacking, where you’ll see spikes in CPU usage, CPU usage is pretty minimal here,” she explained. “So the best way to detect this is to use detection analysis, where you look for the kill chain aspects of the attack – initial access, exploiting the vulnerability, evading detection, persistence.”

Chavoya advised organizations to create granular rules through an app whitelist for which app types are allowed on end-user devices.

Whitelisting involves creating a list of approved apps that can run on devices within the organization’s network and blocking any other apps from running.

“This can be a very effective way to prevent proxyware and other types of malware from running on devices in an organization’s network,” Chavoya said.

“By creating granular rules for which types of apps are allowed on end-user devices, organizations can ensure that only allowed and necessary apps are allowed to run,” he continued.

“This can significantly reduce the risk of proxyjacking and other types of cyberattacks that rely on unauthorized applications running on end-user devices,” he concluded.