JDWPMiner Trojan Targets the Java Debug Wire Protocol
Cybersecurity researchers report of a new piece of malware, which exploits weaknesses in the Java Debug Wire Protocol (JDWP) component. The latter is an important part of the debugging process when it comes to Java applications. Unfortunately, a weakness there can be very troublesome, considering that thousands of software solutions rely on Java. The threat, dubbed the JDWPMiner Mining Trojan, makes use of JDWP security weaknesses in order to execute cryptocurrency mining tasks. Miner botnets like this one often infect tens of thousands of machines worldwide, and this one is not an exception. The JDWPMiner Mining Trojan could be planted on thousands of systems that have JDWP active with an improper configuration.
One of JDWPMiner Mining Trojan's unique properties is that it is compatible with both Windows and Linux. Once installed, it can use python, perl, bash scripts or cron jobs to gain persistence. Dealing with the infection can be a major challenge, since threats like the JDWPMiner Mining Trojan usually focus on persistence and concealing their components.
What does the JDWPMiner Mining Trojan do?
Mining Trojans, in short, use the infected system's resources to mine for cryptocurrencies. In this case, the criminals are abusing the available CPU resources to mine for Monero (XMR.) Of course, the miner sends all the coins to the wallet of the attackers.
The risks of allowing a mining Trojan to run on your system or server are huge. Not only will it ruin the performance of other software and services, but it is also likely to shorten the lifespan of components. Furthermore, it may lead to system instability and crashes.
Protecting yourself from this particular Trojan should involve several security measures. The JDWPMiner Mining Trojan attack is preventable by disabling the Java Debug Mode or blocking online access to the JDWP service – usually done by closing JDWP's connection port. Finally, using proper firewall and antivirus products is another great way to stop threats like the JDWPMiner Mining Trojan.
