News broke yesterday that “highly professional” hackers made off with around 4,700 Bitcoin from a leading mining service, a Bitcoin exchange has said.The value of Bitcoin is currently extremely volatile, but at the time of writing, the amount stolen was worth approximately $80m. IT security experts commented below.
Dr. Richard Ford, Chief Scientist at Forcepoint:
While the Bitcoin valuation is incredibly tantalizing, investors need to recognize that cryptocurrencies are not magic – they can be stolen just like regular money, and are comparatively easy to launder. So, how can you protect a cryptocurrency renowned for its anonymity? Users and companies need to take precautions commensurate with the value of the as set they are protecting, implementing not only traditional security but also watching out for malicious insiders or compromised third-party partners who have access to a vast pool of liquid assets. Our prediction remains: we’re just seeing the beginning of these attacks – there will be many more to come in 2018.”
2018 Prediction – Cryptocurrencies
Attackers will target vulnerabilities in systems which implement blockchain technology.
The Rise of Cryptocurrency Hacks: As cryptocurrencies grow in importance, including as a method of extracting revenue from cybercrime, Forcepoint predicts that the systems surrounding such currencies will increasingly come under attack. We expect to see an increasing amount of malware targeting user credentials of cryptocurrency exchanges, and that cybercriminals will turn their attention to vulnerabilities in systems relying on blockchain-based technologies.
Tristan Liverpool, Director of Systems Engineering at F5 Networks:
“In addition, many application developers are still failing to write APIs with security embedded, which puts both the application and the underlying data at risk. Better code means better confidence as the need for greater transparency, combined with emerging business models built on blockchain technology, will drive more organisations to safeguard data and improve overall application security standards.
“Users of Bitcoin should be well advised to do their due diligence before making investments. Having a secure and versatile application program interface (API) will give users complete control and flexibility over the performance and integrity of vital applications. In the wake of recent high-profile breaches, now is the time for users to protect their passwords and be vigilant with on-line behaviour.”
Matt Walmsley, EMEA Director at Vectra:
“If you are using bitcoin, it is important to remember that exchanges are like not banks and therefore are not subject to the same cybersecurity regulations like those defined by State of New York for any institution operating in the state. If you are risk averse, transfer deposits made to your Bitcoin wallet to a hard currency account with a bank.
“While a bank can be hacked too, financial services firms demonstrate the lowest rates of attacker behaviours per 1,000 devices monitored, according to the 2016 Attacker Behaviour Industry Report. This is most likely due to their investment in cybersecurity controls and security personnel. However, many exchanges may limit the amount you can transfer in one instance and you may not be able to empty your account, so buyers beware.”
Igal Zeifman, Security Evangelist at Imperva Incapsula:
Attackers can make a lot of money when attacking crypto exchanges due to factors such as the anonymity of the cryptocurrencies, hence the ability to “get rid” of the stolen goods with limited risk.
In Imperva’s latest DDoS Report we discovered that 73.9 percent of all bitcoin exchanges and related sites on the Imperva Incapsula service were attacked in Q3 2017. As a result, the relatively small and young industry made it into the top-10 most attacked industries this quarter. The DDoS attacks we mitigated could have been attempts to manipulate the price of bitcoin and other cryptocurrency, something we know offenders had tried in the past.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.