Hacker makes $84k hijacking Bitcoin mining pool

A hacker generated $84,000 worth of the Bitcoin cryptocurrency by gaining access to a Canadian internet provider and diverting the computing power of private Bitcoin “mines”.

The malicious activity was discovered by researchers at Dell SecureWorks, a cyber intelligence company, after noticing that some of their own mining power stolen. The team traced the activity back to an internet service provider (ISP) in Canada, which remains anonymous.

It remains unclear exactly how the hacker managed to gain access to the ISP’s infrastructure to reroute users’ mining power to their own pool.

Speaking to the Guardian at the BlackHat security conference in Las Vegas, Pat Litke from SecureWorks suggested they may have been a current or former employee at the ISP, or an external hacker who had breached the company.

By gaining administrative access to a router at the ISP, they abused a service known as the Border Gateway Protocol (BGP) that is designed to connect different networks on the internet together. By compromising BGP functions at the ISP, the hacker was able to send traffic destined for a legitimate mining pool to his own pool.

The hijacker actually set up two malicious pools. One was used to send miners to a second pool. “By convincing the miners to connect to this second malicious pool rather than the original malicious pool, the hijacker filters out traffic that has already been hijacked so it is not hijacked again,” the researchers’ paper read.

Users originally complained about the illicit activity on internet forums in March, but Litke and his colleague Joe Stewart said the attacks dated back to February. The hacker also stole mining power to release other cryptocurrencies, including Dogecoin, HoboNickels and WorldCoin. As many as 8,000 Dogecoins, equivalent to $1.42, were lost at one small-time miner as a result of the hack.

To prevent similar attacks in the future, Litke and Stewart recommended pool servers use the Secure Sockets Layer (SSL) encryption protocol. If the affected pool had done so here, it would have prevented the theft, they said.

The researchers were impressed by the ingenuity of the hacker, saying it was a “great idea”, at least from a criminal perspective. The attacker was specifically targeting those miners who had invested in souped-up hardware designed to mine Bitcoin.

The victims will receive no compensation and Litke said the chance of any prosecution was very slim, due to the difficulty of tracking the perpetrator.

Source http://www.theguardian.com/technology/2014/aug/07/hacker-bitcoin-mining-pool-internet-service-providers-canada-dell