Opening the Pandora’s Box of Crypto Currency. Are We Ready?

By Ryan Berg, Fellow Data Scientist, Alert Logic

The global value of the cryptocurrency market has reached $2.37 trillion, surpassing the $2.33 trillion market capitalization of Apple. Major banks and governments are starting to dip their toes in the crypto water, with lots of exploratory talks and efforts underway. For many, crypto currencies are still perceived as a tool used by criminals as the primary currency of the dark web for ransomware payments and the buying and selling of illicit goods and services. While some of this may be true, crypto currency is not limited to criminal use. In fact, 2021 is the year where Bitcoin has even become a national currency. If there is anything to be learned from history, it is the fact that criminal activity and fraud always follows the money. The purpose of this article is not to argue for or against the use of crypto currency, but as the crypto industry is currently constituted, both organizations and consumers should be aware of the risks.

How many times have you forgotten your password? Forgetting one’s password has a whole new meaning when it comes to crypto currencies. This risk is not simply about forgetting one’s password, even for those thinking that won’t happen to them because they use a password vault. While your password vault may not have any known security weaknesses, malware is increasingly targeting exchanges and stealing credentials – your password can be stolen simply by being infected. This type of attack of course is not limited to crypto currencies themselves, but many crypto exchanges do not provide the same level of anti-fraud protection that traditional banks often provide.

Anyone can create a crypto currency – all it takes is a bit of programming. As a result, there are a lot of scammers taking advantage of the overall rise in popularity and people’s genuine “fear of missing out” (especially those that were not early investors in Bitcoin). A perfect example of this in 2021 was the Squid Game Token. These types of scams unfortunately are all too easy to create and take advantage of people as the rush to get on the next big thing in crypto. 

Another popular scam this year was the use of ICO’s to raise money outside of the traditional funding systems available. While some may view this as simply fools being parted with their money, this is just demonstrating that the crypto marketplace is still the wild, wild, west and if it sounds too good to be true it likely is.

As the mainstream adoption of crypto continues to increase so will the focus of bad actors, whether they be nation states, malicious hackers, or fraudulent entities. One of the inherent challenges of crypto currencies is the lack of standardization and – dare I say it? – regulation. Not all crypto currencies are created equal and the exchanges are no different. One example from this year was the two billion dollars stolen from the fraudulent Thordex exchange. Unfortunately, it’s not just fraudulent exchanges that one needs to worry about. The simple fact that crypto currency is completely software-driven means that the entire crypto currency ecosystem is threatened by the same sort of vulnerabilities that have plagued the software industry at large. Bitmart recently suffered a large breach where an estimated US $150 million was stolen. Poly Networks was hit by an attack where an estimated US $600 million was stolen, and while much of this was eventually returned, this should not be expected. 

Crypto currency has even led to the development of a new class of malware: crypto miners. These rogue applications steal CPU cycles to mine for various crypto currency using the resources of the targeted machine as a source of passive income. One only has to look at the major Log4j vulnerability to get a sense of the massive exposure that this creates.

So, what can we anticipate for 2022 and beyond? Unfortunately, I expect we will continue to see an increase in criminal activity across the entire crypto currency industry. As the adoption of crypto currency increases and is embedded in more commercial activities, so will the criminal activity that targets this complex supply chain. Crypto currency may be here to stay for the foreseeable future, and while some of the risks are shared with many of our traditional monetary systems, crypto currency in its current form does introduce additional risks that everyone should pay attention to before jumping in the pool with both feet. 

For those that do decide to take part in the crypto currency marketplace, always read the fine print, fully understand the risks involved, and never invest more than you are willing to lose. As this continues to be an attack of choice for malware authors, it is critical for organizations to maintain visibility into how their computing resources are being used and who/what they are communicating with to ensure rogue crypto mining activies are not taking place.