Hackers infecting computers to mine Bitcoin have discovered multinational corporations do not even have passwords for their admin consoles.
As Business Insider reports quoting findings by security firm RedLock, Amazon Web Services suites at both Aviva and Gemalto were easy prey for bad actors.
Just like Deloitte and the ongoing Equifax scandal, where investigators realised vast troves of employee and customer data were protected by a classic “admin/admin” password combination, these two giants also had failed to get to grips with security.
In addition to AWS, Google Cloud Platform and Microsoft Azure cloud storage also lacked passwords.
Kubernetes, an open-source app writing aid from Google, served as the site for infection.
“Upon deeper analysis, the team discovered that hackers were executing a Bitcoin mining command from one of the Kubernetes containers,” RedLock reveals.
“The instance had effectively been turned into a parasitic bot that was performing nefarious activity over the Internet.”
The international community has been on high alert specifically regarding Bitcoin ransomware since May’s wide-reaching WannaCry cyberattack.
At the same time, multiple reports have voiced warnings about the proliferation of ransomware and phishing emails over the past year.
With legacy systems offering such little defense, however, hackers have a natural advantage. Neither Aviva nor Gemalto have made official responses to the attack after RedLock informed them about their involvement.