Criminals have ALWAYS Followed the Money…
Financial transactions have always been a risk, both with criminals looking to steal the money when at rest or in transit, and criminals committing fraud or money laundering. We’ve had counterfeit currency, fake checks, ATM card skimming, and the like. Why wouldn’t we think that crime wouldn’t move to cryptocurrency?
Few understand that consumers need assurances through trusted financial institutions with (security) certified processes and technologies. An awakening is needed in the recently emerged Cryptocurrency market. The value of your crypto coins depend upon it!
Even within historically trusted encryption methods of the past, safety in e-Business has always a race against time. How long will it take to brute force a cypher through an off-line attack and can I do it before keys are rotated? How long will a given set of ciphers be considered strong and when will they need replacing?
Weren’t countermeasures for such concerns designed into end-to-end cryptocurrency transactions?
In a recent review of Cryptocurrency Mining by Malwarebytes, we see that in a mere 10 minutes an attacker can break a block in this gravy train. Blocks must be processed end-to-end within that timeframe. Leave it to Coinhive to invent a miner and not keep it under control. Sophos researchers found Coinhive infestations in nineteen Android apps this past week (Computing). A zero-day flaw in Telegram, now patched, also installed a miner that pulled in Zcash and Monero (SecureList). An attack is now in the wild in search of weak cryptocurrency implementations.
Cryptocurrency is not without its share of fraud. Look no further than LoopX who recently disappeared, along with $4.5M in ICO (Naked Security). It’s no wonder that the US SEC has recommended regulations.
References:
- https://www.malwarebytes.com/blog/security-world/2017/12/how-cryptocurrency-mining-works-bitcoin-vs-monero
- https://www.computing.co.uk/ctg/news/3026552/researchers-find-javascript-cryptomining-code-in-19-android-apps
- https://securelist.com/zero-day-vulnerability-in-telegram/83800/
- https://nakedsecurity.sophos.com/2018/02/14/cryptocurrency-startup-loopx-exit-scams-with-4-5m-in-ico/