Cryware
Cryware is a series of techniques targeting cryptocurrency users, the term was coined by Microsoft in May 2022.
As the ecosystem of cryptocurrency users grow, so does the potential returns available to malicious actors. Applications such as wallets are imperative to the cryptocurrency environment because they provide a means to store and exchange coins.
There are many options of wallets to use such as;
- Hot wallets (software wallets, in which private keys are stored online)
- Hardware wallets (wallets in which private keys are stored offline on a hardware device)
- Paper wallet (wallets in which private keys are written on paper)
Each kind of wallet has its pros and cons but for the purpose of this article, we’ll be focusing on hot wallets. These are without a doubt, the most popular option within the cryptocurrency space. Due to their easy accessibility, price and simplicity, hot wallets such as Metamask have dominated the cryptocurrency space with 21 million monthly users to date.
21 million users is a large amount, which suggests that Metamask is a secure option to facilitate cryptocurrency transactions. For the most part, this is true. But there are still risks.
Hot wallets such as Metamask store sensitive data such as private keys online, which is where the threat of Cryware becomes real.
Cryware uses a variety of techniques to obtain information like seed phrases, private keys and wallet passwords. When these bits of information are obtained, the threat actor siphons funds into their own private wallet.
There are different categories of Cryware which include;
Get Morayo Akran’s stories in your inbox
Join Medium for free to get updates from this writer.
Cryptojackers- These are scripts that are used to mine cryptocurrency with a victims computer resources. Coinhive was one of the most popular kinds of Cryptojackers, dominating almost 2/3rds of the market until it was shut down in 2018.
Information stealers- These target sensitive hot wallet data in the hopes of using it to enter the victims account and withdraw funds. There are many different strains of information stealers, Mars Stealer is the most prevalent at the moment. It is based off a previous threat named ‘Oski Trojan’ that was widespread in 2019.
Mars stealer is deemed to be more prolific because of its ability to navigate past the security settings of over 40 browser-based plug-ins and wallets. Even more concerning is its accessibility, the tool is available for less than £200 on the Darkweb.
The category of information stealers is continually growing, other threats include;
- Red Line stealer
- Arkei
- Raccoon
The best way to protect yourself from these threats is by remaining extra vigilant of files that you download. This may be from websites or emails, as phishing is a common attack surface used for information stealers.
Clipbankers- These tools scan the clipboard and replace an original wallet address with that of an attacker.
An attacker will commonly search for regexs to query common string patterns and replace it with their own. For example, if a user copies a wallet address (a 32–34 characters) then a threat actor can construct code that always replaces it with their own wallet address one its pasted. This may be an effective form of attack due to the intricate format of cryptocurrency addresses, many users may fail to notice a difference if they aren’t focused.
It is worth noting that many of these techniques aren’t new, but instead have evolved from previous tools to become more effective. Users must be aware of this fast-moving landscape of threats as malicious actors are constantly seeking ways to sabotage the experience of users. Awareness is always the best remedy when it comes to security issues, so please share with as many crypto users within your social circle!
