<figure>
 <figcaption>
 Cover image via <a href="https://u.today/" rel="noopener noreferrer nofollow">U.Today</a>
 </figcaption>
</figure>
According to a Tuesday&nbsp;<a href="https://thehackernews.com/2024/07/hackers-exploiting-jenkins-script.html" rel="noopener noreferrer nofollow">report</a> by The Hacker News, the Jenkins Script Console has been weaponized by malicious actors for illegal cryptocurrency mining. The report is based on findings that were recently published by prominent cybersecurity firm Trend Micro.
Jenkins is a popular open-source continuous integration (CI) server. Before Jenkins, developers would have to deal with irregular commits since many of them could possibly be based in different countries. This would cause major integration issues, and developers would find it challenging to complete a certain project efficiently. Jenkins makes it possible for developers to continuously develop their code.
Jenkins has a Groovy script console that allows developers to run arbitrary scripts within the controller or the agents that are connected to it. The feature is useful for troubleshooting and diagnostics. Notably, it is available to users only with administrative permissions.
According to Trend Micro, the script console feature can be potentially weaponized by bad actors who can take advantage of misconfigured servers. Those developers who run unpatched versions of Jenkins are also at risk of falling victim to cryptojackers.
As mentioned above, unauthorized users cannot gain access to the script console. However, misconfigured Jenkins deployments are a prime target for bad actors who mine cryptocurrencies.
Cryptojackers typically deploy a malicious script that kills off all processes that consume substantial CPU resources and then proceed to install malicious mining software.
Cryptojacking, which became&nbsp;<a href="https://u.today/cryptojacking-is-more-rampant-than-ever-in-2018-report" rel="noopener noreferrer nofollow">rampant</a> in 2018, remains a persistent threat. Earlier this year, a cryptojacker from Nebraska was indicted for defrauding cloud computing companies to earn roughly $1 million worth of crypto.

New Crypto Mining Attacks Discovered by Researchers

U_Today

Alte articole publicate pe 9 iul. 2024

Ethena Labs and Lyra Finance Partner for Unique ETH Strategy

APEX Platform: Revolutionizing DeFi with ERC314

Mpeppe (MPEPE) and BONK Lead the Charge in the Meme Coin Market Amid Broader Crypto Movements

Fed Chair Jerome Powell Testimony Sets Bitcoin (BTC) On Bullish Course

Solving the Blockchain Trilemma: Are We Finally There?

BlockDAG Shakes Up the Crypto World: $2M Giveaway & a Whopping $56.7M Presale; Blast Token’s Wild...

Join our free newsletter for daily crypto updates!