Could you be secretly generating profits for cybercriminals?
You may have noticed your laptop or computer becoming slower. It could be an unexplained spike in your electricity bills. Or even an overheating PC. These are among the possible signs of cryptomining malware – also known as cryptojacking – on your computer.
Cryptocurrency mining is an energy-intensive process. Bitcoin mining, the largest crypto mining industry, consumes 127.77 terawatt-hours of electricity annually. In fact, its annual energy consumption is comparable to that of an entire country like Norway. To offset these exorbitant costs, miners have turned to a darker path to mine cryptocurrency: exploiting innocent computer and mobile device users through crypto-mining malware.
What Is Cryptomining Malware (Cryptojacking)?
Cryptojacking is a cybercrime in which cryptocurrency miners install malware on a victim’s computer to use the victim’s computing power to mine cryptocurrency. Hackers run the mining software on your device to access your CPU or GPU power quickly and efficiently. Through their malware, they receive the benefits of cryptocurrency mining without paying for the power consumption or buying crypto mining devices.
Alternatively, hackers may infiltrate a website and use it to access your device for crypto mining. When you visit the webpage, your device will run the mining script, becoming a mini mining rig. Unfortunately, cryptojacking can compromise any device with a CPU or a GPU, including smartphones and network servers, using it to mine cryptocurrency on their behalf.
A single cryptocurrency mining botnet can net cyber criminals more than $30,000 per month, according to a recent report from cybersecurity company Kaspersky Labs.
How Does Cryptojacking Work?
A cryptojacking attack takes two main forms.
- Delivery or device infection: Hackers trick victims into running crypto mining code through social engineering scams such as phishing or a malicious link. They can also deploy the hack via compromised legitimate sites or deceptive downloads.
- Execution: Once infected, your computer will run the cryptomining scripts, allowing the malware to use your CPU or GPU to solve complex cryptographic puzzles. Your device will become part of a network of infected computers, contributing to the hacker’s mining capacity.
- Hacker’s profit: Because of the distributed network of infected computers, the miner will have an edge over their competitors, solving the complex crypto puzzle first and receiving the block reward. Miners will also be able to mine cryptocurrecy without the initial outlay of energy, or specialized devices like Bitcoin mining rigs.
Why is Cryptojacking a Problem?
Cryptomining malware might seem pretty innocuous – after all, the attackers can only take your computing power, and nothing tangible.
But the real issue is the nefarious nature of cryptojacking. It enables absolutely anyone with sufficient technical knowledge to commandeer your connected device, and spend your computing resources. So cryptojacking is really an assault on your digital sovereignty, and erodes your online security.
Examples of Cryptojacking
Let’s explore some prominent examples of cryptojacking that reveal its widespread nature and the inventive methods attackers employ.
- Coinhive launched in 2017 as a legitimate service, allowing website owners to generate income by embedding JavaScript code that mined Monero using visitor computers. However, cybercriminals quickly adopted Coinhive, secretly inserting its code into unsuspecting websites and transforming millions of users’ computers into unwitting mining rigs. Regulatory pressure and declining interest ultimately led to Coinhive’s closure in 2019.
- FaceXWorm leveraged social engineering on Facebook Messenger. Attackers send deceptive YouTube links that redirect users to a fake site, prompting them to download a Chrome extension. This extension hijacked the user’s Facebook account, spread the worm, and installed cryptojacking malware that mines cryptocurrency using the victim’s computing resources.
- In 2018, crypto jackers penetrated Tesla’s Amazon Web Services (AWS) cloud infrastructure. Researchers from RedLock uncovered cryptomining code operating on Tesla’s cloud, impacting Tesla’s systems and potentially compromising sensitive data. Tesla swiftly addressed the breach, but the incident highlighted the vulnerability of cloud environments to cryptojacking attacks.
- Black-T, a creation of the cybercriminal group TeamTNT, targeted AWS credentials to mine Monero. This sophisticated malware searched for vulnerable systems with exposed Docker daemons, employing advanced techniques to block rival cryptojacking worms and extract passwords from memory.
- In 2020, cybercriminals exploited GitHub’s Actions feature to execute crypto mining operations. Attackers duplicated legitimate repositories, inserted cryptomining code, and submitted Pull Requests to the original repositories. This triggered GitHub’s systems to run the crypto mining software, misusing GitHub’s infrastructure for illicit mining. The attack showcased how automated workflows can become targets for cryptojacking.
Types of Cryptojacking Attacks
We can classify cryptojacking attacks by how they occur.
Browser Based Cryptojacking
Browser based cryptojacking sneaks into your life while you innocently browse the web. Malicious actors deliver crypto-jacking malware directly to your computer through compromised websites or online ads.
When you visit an infected site or click on a malicious ad, the malware silently installs itself, hijacking your device’s computing power to mine cryptocurrency. In-browser hijacking drains your device’s battery, generates heat, and potentially reduces its lifespan.
In-Host Hijacking
In-host cryptojacking directly infiltrates your system, installing malware that takes control of your device’s resources for cryptocurrency mining. This type of attack is more persistent and difficult to detect than in-browser hijacking. The malware consumes system resources, reducing device performance and overheating hardware.
In-Memory Hijacking
The malicious code resides solely in the device’s memory, making detection challenging as it leaves no traces on the disk. This method often goes after cloud-based infrastructure, exploiting weaknesses to mine without getting caught. While in-memory cryptojacking might not directly harm your device, it still steals computing power for the attacker’s benefit.
How To Detect Cryptojacking
When your computer starts running slower than usual or your phone battery drains quicker than expected, it might be more than just age catching up with your device. Your device might be secretly mining cryptocurrency without your knowledge. Here’s how to detect and prevent this hidden threat.
Educate Users and Teams
The first step in combating cryptojacking is awareness. Users might overlook signs like sluggish performance if they don’t know what to look for. IT, help desk, and network operations staff should receive training to recognize unauthorized mining processes.
Proactive Threat Hunting
Not all signs of cryptojacking are obvious. Skilled security personnel or dedicated threat hunters can proactively look for subtle indicators of compromise. Behavioral anomalies, unusual network activity, and other clues can help identify cryptojacking before it becomes a critical issue.
Monitor and Block crypto mining Traffic
Cyber protection tools can detect cryptojacking and block crypto mining traffic. cryptojacking attempts often masquerade as normal behavior, making them hard to detect but not impossible. Here are some methods to spot cryptojacking:
- Decreased Performance: If your device slows down, crashes, or exhibits unusually poor performance, cryptojacking might be the cause. Additionally, a rapidly draining battery can be another red flag.
- Overheating: Cryptojacking can cause devices to overheat. If your laptop or computer’s fan is running faster than usual, it could indicate that a cryptojacking script is overworking your device. The fan is trying to prevent overheating or potential damage.
- High CPU Usage: An unexpected spike in CPU usage, especially on a site with little media content, may indicate cryptojacking scripts. Checking CPU usage through Task Manager or Activity Monitor can reveal suspicious activity, although some cryptojacking processes may mask themselves as legitimate.
Detecting and preventing cryptojacking requires personnel education, proactive monitoring, and cyber protection tools.
Is Cryptojacking Harmful?
We’ve already seen how cryptocurrency mining demands a lot of power. But what does this mean for your device? Here are a few key points about the effects of cryptojacking.
A Performance Slowdown
When your device becomes infected with cryptojacking malware, it works overtime to mine cryptocurrencies. As a result, its performance takes a hit. You might notice sluggishness, longer load times, and unresponsive applications.
Increased Wear and Tear
Mining cryptocurrencies is resource-intensive. The malware pushes your CPU and GPU to their limits, causing wear and tear over time. Think of it as asking your car to constantly rev its engine at maximum RPM—it’s not sustainable, and parts start wearing out faster.
Higher Power Consumption
Cryptojacking drains your device’s computing power and consumes electricity. The more your system mines, the more energy it consumes.
By infecting your device with cryptojacking scripts, cryptojacking malware unwittingly turns you into a part of the problem. Your machine becomes a “zombie miner” contributing to the larger mining network.
Protect Against Crypto Mining Malware
Here are practical steps to safeguard your devices and networks:
- Firstly, install and maintain reliable antivirus and malware protection software. Keeping this software up to date and conducting regular scans is crucial. Antivirus software helps detect and remove malicious activities, including cryptojacking.
- Ad blockers are another effective defense. Browser extensions like No Coin, minerBlock, or Antiminer can avoid suspicious websites running crypto-jacking scripts without your knowledge. These tools add more protection by blocking potentially harmful ads and scripts.
- Exercise caution when visiting websites. Stick to reputable sources and avoid unfamiliar or suspicious domains. Many crypto-jacking scripts hide in websites that seem harmless but actually steal your device’s power.
- Disabling JavaScript in your browser can offer temporary protection when browsing untrusted sites. Crypto-jacking scripts often rely on JavaScript to run in the background.
If you’re in charge of servers or data centers, you need to have solid cybersecurity systems. Regular audits and timely application of security patches can prevent vulnerabilities that cryptojackers might exploit. Keeping your software updated, including your operating system, web browser, and applications, addresses potential security flaws targeted by malware.
Monitoring your device’s resource usage can also alert you to cryptojacking. Unusually high CPU or GPU usage without any apparent activity may indicate cryptojacking.
Closing Thoughts
Recent developments highlight the growing threat of cryptojacking across various platforms. In-browser mining has become more sophisticated, making it harder to detect. Be wary of websites requesting excessive permissions or displaying unusual behavior.
With the growing threat to mobile devices, it is crucial to be cautious while installing apps by sticking to trusted sources and monitoring app permissions. Even Internet of Things (IoT) devices like smart TVs and routers are at risk. Secure these devices with strong passwords and keep their firmware updated.
FAQ
What is a cryptojacking script?
Cryptojacking script is a type of malicious code that causes infected devices to act as a proxy miner for the attacker. It enables the hacker to use the victim’s computer and computing power to mine cryptocurrency, which the attacker can then profit from.
How can you block crypto mining malware?
The best way to prevent cryptomining malware attacks is to run and maintain antivirus and malware protection software. You should also remain vigilant as you browse the web, and avoid opening suspicious looking emails or clicking unexpected links and pop-ups, which could contain the malicious script.
How can you remove cryptojacking malware?
If you suspect you have an infected device, you can take steps to remove cryptojacking code. The simplest way is to restart your computer or device in Safe Mode, run antivirus software to perform a full system scan, and follow instructions for eliminating the code.
