Hackers Fake Computational Power to Steal Cryptocurrencies Directly From Mining Pools

A new attack targeted equihash mining pools that use vulnerable equihashverifier to verify the miner’s shares. The logic vulnerability in the verifier allows an attacker to fake the mining shares without using so much computing power.

Probably the vulnerability may have a huge impact as the verifier equihashverify was previously used by zcash and other new cryptocurrencies.

360 Core Security published a report along with the PoC explaining the vulnerability, according to their report it is not a vulnerability of Equihash, but a vulnerability of the implementation of Equihash solution verifier.

It was developed by University of Luxembourg’s. it is an is a memory-oriented Proof-of-Work algorithm and in April 2016 ZCash integrated Equihash for security, privacy, and ASIC miner resistance.

The vulnerability resides in how the algorithm computes, hdr stands for the block header and soln to determine the solutions that users submitted to Equihash. But the algorithm contains multiple vulnerabilities which allow an attacker to bypass the equihash verifier for any block header.

Starting from 2018 cyber threat landscape shifted from Ransomware to Cryptocurrency mining attacks, attackers targeted a huge number of web portals, mechanical man devices, and different types of servers.

Cryptocurrency Mining Attack Vectors reworking the cyber threat landscape, the importance of cryptocurrencies drawing the eye of cybercriminals.

Hackers taking every and each chance for mining cryptocurrencies, even they inserted Cryptocurrency Mining Script with the embedded videos in word documents.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

Guru baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government entities and energy companies.  The attackers,…

4 hours ago

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to dismantle its operations. Initially detected in…

4 hours ago

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source nature. However, it has a big…

4 hours ago

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation, and growth. However, this shift towards…

5 hours ago

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed light on the growing concerns within…

8 hours ago

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse engineering .NET malware.  The write-up outlines…

9 hours ago