Incident: Cryptocurrency Mining Pool Hijacking Incident: $83,000 Stolen.

Published Date: 2014-08-08

Postmortem Analysis
Timeline 1. The software failure incident involving the hijacking of mining pools and stealing $83,000 in cryptocurrency happened between February and May 2014 as reported in Article 29246.
System 1. Border Gateway Protocol (BGP) 2. Mining pool software 3. Cryptocurrency mining protocols
Responsible Organization 1. A hacker targeted mining pools and managed to steal $83,000 in cryptocurrency by exploiting a security flaw [29246]. 2. The exploit involved using a fake Border Gateway Protocol (BGP) broadcast to compromise networks belonging to companies like Amazon, Digital Ocean, and OVH [29246]. 3. The hijacker redirected cryptocurrency miners' connections to a hijacker-controlled mining pool, preventing miners from receiving their earnings [29246]. 4. The researchers traced the fake broadcasts to a single router at an ISP in Canada but were unable to identify the hijacker, suggesting possibilities such as a rogue employee, an ex-employee with an unchanged router password, or a black-hat hacker [29246].
Impacted Organization 1. Mining pools were impacted by the software failure incident as a hacker targeted them and managed to steal $83,000 in cryptocurrency [29246].
Software Causes 1. The software cause of the failure incident was a security flaw in the mining pools' systems that allowed a hacker to exploit a fake Border Gateway Protocol (BGP) broadcast to compromise networks and redirect cryptocurrency miners' connections to a hijacker-controlled mining pool [29246].
Non-software Causes 1. Lack of proper network security measures: The hijacker was able to compromise networks belonging to major companies like Amazon, Digital Ocean, and OVH by using a fake Border Gateway Protocol (BGP) broadcast, indicating a lack of robust network security measures [29246]. 2. Human error or malicious intent: The incident could be attributed to a rogue employee of the ISP, an ex-employee with an unchanged router password, or a black-hat hacker, suggesting potential human error or malicious intent as a cause of the failure [29246].
Impacts 1. The software failure incident led to a hacker being able to steal $83,000 in cryptocurrency from mining pools by exploiting a security flaw [29246]. 2. The hijacker was able to redirect cryptocurrency miners' connections to a hijacker-controlled mining pool, preventing miners from receiving their earnings and allowing the hijacker to collect all profits [29246]. 3. Multiple cryptocurrencies were impacted by the attack, not just Bitcoin, as the threat actor hijacked the mining pool affecting various cryptocurrencies [29246]. 4. One miner reported that 8,000 dogecoin were hijacked and stolen in March, highlighting the impact on individual miners [29246]. 5. The incident raised concerns about the security of cryptocurrency mining activities, with the potential for such hacking to be lucrative if widespread [29246].
Preventions 1. Implementing robust network security measures to prevent unauthorized access and manipulation of BGP routes, such as using secure BGP (S-BGP) or Resource Public Key Infrastructure (RPKI) [29246]. 2. Regularly monitoring and auditing BGP routing announcements to detect any suspicious or unauthorized changes in network configurations [29246]. 3. Enhancing employee training and awareness on cybersecurity best practices to prevent insider threats, such as rogue employees or ex-employees with unchanged router passwords [29246]. 4. Collaborating with industry experts and organizations to share threat intelligence and best practices for mitigating BGP hijacking and other network security risks [29246].
Fixes 1. Implementing stricter authentication and access control measures to prevent unauthorized access to routers and BGP configurations, which could help prevent similar hijacking incidents in the future [29246]. 2. Regularly updating and changing router passwords to mitigate the risk of exploitation by rogue employees or hackers [29246]. 3. Enhancing monitoring and detection capabilities to quickly identify and respond to anomalous BGP announcements and network compromises [29246].
References 1. Dell SecureWorks Counter Threat Unit (CTU) research team [29246]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown a) The software failure incident related to the hijacking of mining pools and stealing cryptocurrency has not been specifically mentioned to have happened again at the same organization (Bitcoin.org) or with its products and services in the provided article [29246]. b) The article does not mention any specific instances of similar software failure incidents happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident in the article can be attributed to the design phase. The incident involved a hacker exploiting a security flaw in the system design related to mining pools and cryptocurrency. The hacker used a fake Border Gateway Protocol (BGP) broadcast to compromise networks of major players in the field, redirecting cryptocurrency miners' connections to a hijacker-controlled mining pool and stealing earnings amounting to $83,000 [29246]. (b) The software failure incident can also be linked to the operation phase. The hijacker's actions, such as redirecting miners' connections and stealing earnings, were a result of the operational misuse of the system. The miner who took action by adding a firewall rule to reject connections from the hacker's server was able to prevent further hijacking and resume normal mining regularity [29246].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident described in the article is primarily due to contributing factors that originate from within the system. The incident involved a hacker targeting mining pools by exploiting a security flaw that allowed them to redirect cryptocurrency miners' connections to a hijacker-controlled mining pool, resulting in the hijacker collecting the miners' profits [29246]. (b) outside_system: The software failure incident also involved contributing factors that originated from outside the system. Specifically, the hacker was able to compromise networks belonging to major companies like Amazon, Digital Ocean, and OVH by using a fake Border Gateway Protocol (BGP) broadcast. This external factor enabled the hijacker to carry out the attack on the mining pools and steal cryptocurrency [29246].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The software failure incident in the article was primarily due to a security flaw that allowed a hijacker to use a fake Border Gateway Protocol (BGP) broadcast to compromise networks belonging to major players in the cryptocurrency mining field. This exploit enabled the hijacker to redirect cryptocurrency miners' connections to a hijacker-controlled mining pool, resulting in the hijacker collecting the miners' profits without their knowledge. The incident involved non-human actions such as the exploitation of the security flaw in the BGP protocol, leading to the theft of $83,000 in cryptocurrency [29246]. (b) The software failure incident occurring due to human actions: While the software failure incident itself was primarily driven by the exploitation of a security flaw, there were potential human actions that could have contributed to the incident. The researchers suggested that the scheme could be blamed on a rogue employee of an ISP, an ex-employee with an unchanged router password, or simply a black-hat hacker. These human actions, such as insider threats or negligence in maintaining secure configurations, could have played a role in enabling the hijacker to carry out the attack successfully [29246].
Dimension (Hardware/Software) hardware, software (a) The software failure incident reported in the article is primarily related to a hardware issue. The incident involved a hacker targeting mining pools by using a fake Border Gateway Protocol (BGP) broadcast to compromise networks belonging to major companies like Amazon, Digital Ocean, and OVH [29246]. This hardware-related exploit allowed the hijacker to redirect cryptocurrency miners' connections to a hijacker-controlled mining pool, leading to the theft of earnings. (b) The software failure incident also has a significant software component. The exploit identified by the Dell SecureWorks Counter Threat Unit (CTU) research team was related to a security flaw that allowed the hijacker to redirect miners' connections and collect their profits [29246]. Additionally, the incident involved the use of spoofed servers to ensure that miners never received their earnings, indicating a software manipulation aspect to the attack.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. A hacker targeted mining pools using a fake Border Gateway Protocol (BGP) broadcast to compromise networks belonging to major players in the field, redirecting cryptocurrency miners' connections to a hijacker-controlled mining pool and stealing their earnings. The hijacker was able to earn $83,000 in cryptocurrency over four months through this exploit. The incident involved intentional actions by the hacker to harm the system and profit from the stolen cryptocurrency [29246].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident described in the article was primarily due to poor decisions made by the hacker who targeted mining pools to steal cryptocurrency. The hacker exploited a security flaw by using a fake Border Gateway Protocol (BGP) broadcast to compromise networks belonging to major players in the field, redirecting cryptocurrency miners' connections to a hijacker-controlled mining pool. This allowed the hijacker to collect the miners' profits for themselves, resulting in a total earning of $83,000 over four months [Article 29246]. (b) Additionally, the incident also involved accidental decisions or unintended consequences. For example, one miner mentioned in the article had 8,000 dogecoins hijacked and stolen in March, worth $1.39. The miner was able to mitigate the issue by adding a firewall rule to reject connections from the hacker's mining server, which restored normal mining regularity. This accidental decision to implement the firewall rule helped prevent further losses due to the hijacking incident [Article 29246].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the article can be attributed to development incompetence. The incident involved a hacker exploiting a security flaw in mining pools by using a fake Border Gateway Protocol (BGP) broadcast to compromise networks of major players in the cryptocurrency field [29246]. This exploit allowed the hijacker to redirect cryptocurrency miners' connections to a hijacker-controlled mining pool, resulting in the theft of earnings. The researchers traced the fake broadcasts to a single router at an ISP in Canada, indicating a vulnerability introduced due to lack of professional competence in securing the network infrastructure. (b) The software failure incident can also be categorized as accidental. The article mentions that the exploit used by the hijacker involved a fake BGP broadcast, which was used to compromise networks belonging to prominent names in the cryptocurrency field [29246]. This accidental vulnerability allowed the hijacker to redirect miners' connections to a controlled mining pool, leading to the theft of earnings. The incident was not intentional but rather a result of accidental exploitation of the security flaw in the system.
Duration temporary (a) The software failure incident described in the article was temporary. The incident involved a hacker exploiting a security flaw to redirect cryptocurrency miners' connections to a hijacker-controlled mining pool, resulting in the hijacker collecting the miners' profits for themselves. This exploitation led to the theft of $83,000 in cryptocurrency over a period of roughly four months [29246]. The incident was eventually mitigated when the researchers traced the fake broadcasts to a single router at an ISP in Canada and provided evidence to stop the malicious BGP announcements, indicating that the failure was not permanent.
Behaviour omission, value, other (a) crash: The incident described in the article does not involve a crash where the system loses state and does not perform any of its intended functions. Instead, the system continues to function, but the earnings of cryptocurrency miners are redirected to a hijacker-controlled mining pool [29246]. (b) omission: The software failure incident can be categorized as an omission since the system omits to perform its intended functions at instances where the hijacker redirects cryptocurrency miners' connections to a hijacker-controlled mining pool, preventing the miners from receiving their earnings [29246]. (c) timing: The incident does not involve a timing failure where the system performs its intended functions too late or too early. The system operates as expected but with the flaw that allows the hijacker to redirect earnings [29246]. (d) value: The software failure incident can be classified as a value failure since the system performs its intended functions incorrectly by allowing a hijacker to redirect cryptocurrency miners' earnings to the hijacker-controlled mining pool instead of the miners receiving their rightful profits [29246]. (e) byzantine: The incident does not exhibit a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. The behavior of the system is consistent in redirecting the earnings to the hijacker-controlled pool [29246]. (f) other: The behavior of the software failure incident can be described as a security breach leading to unauthorized redirection of earnings, indicating a breach in the system's security protocols [29246].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident described in the article resulted in a hacker being able to steal $83,000 in cryptocurrency from mining pools. The hijacker used a fake Border Gateway Protocol (BGP) broadcast to compromise networks belonging to major companies in the field, redirecting cryptocurrency miners' connections to a hijacker-controlled mining pool. As a result, the miners' earnings were taken by the hijacker, totaling $83,000 over four months. Additionally, one miner reported that 8,000 dogecoin were hijacked and stolen, worth $1.39 [29246].
Domain finance (a) The failed system was related to the cryptocurrency industry, specifically affecting mining pools and cryptocurrency miners who were targeted by a hacker to steal cryptocurrency [29246]. (b) No information provided in the articles about the transportation industry. (c) No information provided in the articles about the natural resources industry. (d) The incident did not directly involve sales transactions but rather the theft of cryptocurrency earnings from miners. (e) No information provided in the articles about the construction industry. (f) No information provided in the articles about the manufacturing industry. (g) No information provided in the articles about the utilities industry. (h) The incident is related to the finance industry as it involved the theft of cryptocurrency, which is a form of digital currency used for financial transactions [29246]. (i) No information provided in the articles about the knowledge industry. (j) No information provided in the articles about the health industry. (k) No information provided in the articles about the entertainment industry. (l) No information provided in the articles about the government industry. (m) The failed system was specifically related to the cryptocurrency industry, which falls under the broader category of the financial technology (fintech) industry [29246].

Sources

Back to List