TL;DR: Attackers are exploiting a chain of Plex Media Server vulnerabilities to install unauthorised cryptocurrency miners and a Linux proxy backdoor on vulnerable systems.
The latest cryptojacking warning comes from an unexpected direction: home and business media servers. Security researchers have observed attackers chaining multiple weaknesses in Plex Media Server to run software on machines they do not own.
The technique, dubbed Plex2Shell, involves four vulnerabilities that can be combined to reach remote code execution under certain conditions. The attacks described this week installed an XMRig cryptocurrency miner alongside software functioning as a reverse proxy or backdoor.
XMRig is a legitimate open-source mining tool when used with permission, but on a compromised server it can quietly consume processing power and electricity for the benefit of an attacker. That makes cryptojacking a practical security problem well beyond exchanges and cryptocurrency wallets.
The vulnerabilities were reported earlier in the year and addressed in Plex Media Server version 1.43.3.10861, according to the security reporting. Exploitation attempts appeared after public proof-of-concept material circulated in October.
Not every server running Plex is necessarily vulnerable, and details of attackers’ success rates remain unclear. The key risk is to instances running affected, unpatched software.
For operators, the sensible response is to check the installed version, apply the vendor’s updates and review systems for unexpected processes or network connections. Cryptocurrency mining malware rarely announces itself; an unusually busy server may be the first obvious clue.
Written by the News Desk and edited by Samuel Rae.
TL;DR: Attackers are exploiting a chain of Plex Media Server vulnerabilities to install unauthorised cryptocurrency miners and a Linux proxy backdoor on vulnerable systems.
The latest cryptojacking warning comes from an unexpected direction: home and business media servers. Security researchers have observed attackers chaining multiple weaknesses in Plex Media Server to run software on machines they do not own.
The technique, dubbed Plex2Shell, involves four vulnerabilities that can be combined to reach remote code execution under certain conditions. The attacks described this week installed an XMRig cryptocurrency miner alongside software functioning as a reverse proxy or backdoor.
XMRig is a legitimate open-source mining tool when used with permission, but on a compromised server it can quietly consume processing power and electricity for the benefit of an attacker. That makes cryptojacking a practical security problem well beyond exchanges and cryptocurrency wallets.
The vulnerabilities were reported earlier in the year and addressed in Plex Media Server version 1.43.3.10861, according to the security reporting. Exploitation attempts appeared after public proof-of-concept material circulated in October.
Not every server running Plex is necessarily vulnerable, and details of attackers’ success rates remain unclear. The key risk is to instances running affected, unpatched software.
For operators, the sensible response is to check the installed version, apply the vendor’s updates and review systems for unexpected processes or network connections. Cryptocurrency mining malware rarely announces itself; an unusually busy server may be the first obvious clue.
Written by the News Desk and edited by Samuel Rae.
Bitcoin Magazine
Here’s How Not To Screw up Your Bitcoin Privacy
Just one transaction can compromise years of discreet Bitcoin activity, Cake Wallet’s chief operating officer has warned.
Speaking on the Bitcoin Rails podcast this week, activist Seth for Privacy talked about different ways of protecting one’s privacy when using Bitcoin and said that focusing on privacy was a must for the West.
Bitcoin privacy is a hot topic again ever since the developers of private coin mixer Samourai Wallet went on trial last year and were subsequently imprisoned.
But just this week, the U.S. Department of Treasury scrapped two long-stalled crypto surveillance proposals, handing a major win to privacy advocates and the digital asset industry.
“If you ever spend your no-KYC coins with one of your KYC coins — which if you just let the wallet do its thing, it could do because it doesn’t know the difference — you immediately connect all of the non-KYC Bitcoin that you spend in that with your identity,” Seth said, referring to UTXO management, also called “coin control” by some wallets.
Bitcoin wallets don’t hold a single balance but a collection of separate unspent transaction outputs — UTXOs — each one a discrete “coin” from a specific past transaction.
When you send a payment larger than any one UTXO, the wallet picks several and combines them as inputs to the same transaction — an easy mistake to make, Seth highlighted.
Seth added that unlike in the global South, where people have experienced more oppressive states, citizens in the West will need to “feel pain” in order to realize how important privacy is.
Still, he added that attitudes were changing and people were getting more serious about protecting their privacy.
“It has been shifting, in the last five or six years a lot of people — even in the West — are starting to think [privacy] really matters, we really need to think about this seriously now,” he said.
Cake Wallet is a privacy-oriented, self-custody, open-source wallet. The wallet earlier this year integrated Bitcoin’s Lightning Network into its platform.
Using the second layer solution is not only faster and cheaper, it also offers more privacy than Bitcoin’s main chain.
While Cake Wallet supports other cryptocurrencies, including privacy coin Monero, Seth for Privacy added that he’d love it if the digital coin didn’t exist.
“If Bitcoin’s privacy got good enough that you could use it and have at least almost as good privacy as Monero without massive hoops to jump through, and Monero ceased to exist, that’s fine,” he said.
“I would much rather the thing that more people use has better privacy than a more niche tool that has perfect privacy, and that’s something that less people are using because it’s less well known.”
This post Here’s How Not To Screw up Your Bitcoin Privacy first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.
Login