Hackers target Jenkins servers for cryptocurrency

Hackers exploit continuous deployment servers to mine millions in Monero

Bitcoin cryptocurrency mining

A new cryptocurrency mining hack is targeting continuous deployment technology, tricking it into mining millions of dollars worth of Monero coins.

A hacker or hackers have exploited an existing security vulnerability in Jenkins servers - continuous deployment servers written in Java - to download and install a Monero miner called XMRig.

This vulnerability in the Jenkins Java deserialisation implementation, CVE-2017-1000353, means malicious content can be implanted into the server without requiring authentication. This has enabled hackers to install mining malware simply by sending two requests to the CLI interface, according to security vendor Check Point's research team. 

As the researchers explain, these requests do two things to exploit the vulnerability. "The first is its capability object which informs the server of the capabilities of the client [computer]," they wrote. "The second meanwhile is the Command object which would contain the Monero payload."

A remotely-executed start command gets the malware running, and forces the victim's computer to mine Monero coins.

Advertisement
Advertisement - Article continues below

"The miner is capable of running on many platforms and Windows versions, and it seems like most of the victims so far are personal computers," the researchers said. "With every campaign, the malware has gone through several updates and the mining pool used to transfer the profits [has] also changed."

The hacker or hackers have reportedly mined over 10,800 Monero in the JenkinsMiner campaign, bringing them 2.3 million.

Check Point's team added: "As if that wasn't enough though, [the hacker] has now upped his game by targeting the powerful Jenkins CI server, giving him the capacity to generate even more coins."

This isn't the first time either that Jenkins servers have been exploited for malicious use. In January, security researcher Mikail Tunc found 25,000 Jenkins servers that were exposed to hackers.

Just last week a cryptocurrency mining attack hit official government websites, including the Student Loan Company in the UK, which would force unsuspecting visitors to mine cryptocurrencies for the hackers' benefit.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Most Popular

Visit/operating-systems/microsoft-windows/354297/this-exploit-could-give-users-free-windows-7-updates
Microsoft Windows

This exploit could give users free Windows 7 updates beyond 2020

9 Dec 2019
Visit/security/identity-and-access-management-iam/354289/44-million-microsoft-customers-found-using
identity and access management (IAM)

44 million Microsoft customers found using compromised passwords

6 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019