Uncovered Selenium Grid Servers Targeted for Cryptocurrency Mining and Proxyjacking

September 12, 2024Ravie LakshmananDigital Currency / Network Safety

Exposed Selenium Grid instances on the internet are under attack by malicious actors for unauthorized digital currency mining and proxyjacking operations.

Cado Security researchers Tara Gould and Nate Bill, sharing their analysis today, mentioned, “Selenium Grid functions as a server that aids in running test cases concurrently across different browsers and versions.”

“Nonetheless, the default setup of Selenium Grid lacks proper authentication, which renders it susceptible to exploitation by cybercriminals.”

Previously, cloud security firm Wiz highlighted the misuse of publicly-available Selenium Grid instances for deploying crypto miners in July 2024, under the campaign name SeleniumGreed.

Cado, examining two distinct attacks on its honeypot server, revealed that threat actors are taking advantage of the absence of authentication measures to perpetrate harmful activities.

The first campaign utilizes the “goog:chromeOptions” dictionary to insert a Base64-encoded Python script that, in turn, fetches a script named “y,” which corresponds to the open-source GSocket reverse shell.

The reverse shell acts as an intermediary for introducing the subsequent payload, a bash script named “pl” that retrieves IPRoyal Pawn and EarnFM from a remote server using curl and wget commands.

Cado commented, “IPRoyal Pawns provides a residential proxy service enabling users to monetize their internet bandwidth.”

“IPRoyal utilizes the user’s internet connection within the residential proxy network, potentially exposing it to various use cases, including malicious ones.”

EarnFM, marketed as a revolutionary proxyware solution for “earning passive online income by sharing your internet connection,” was also featured in the attack.

Similar to the proxyjacking operation, the second attack deploys a bash script via a Python script, confirming its 64-bit nature before dropping a Golang-based ELF binary.

The ELF file tries to gain root access by exploiting the PwnKit vulnerability (CVE-2021-4043) and installs an XMRig cryptocurrency mining tool named perfcc.

The researchers noted, “Considering the widespread utilization of Selenium Grid for web browser testing, this campaign underscores the risk posed by misconfigured instances when exploited by malicious entities. Users should proactively enable authentication, as it is not activated by default.”