Cryptocurrency mining is turning into a lucrative business. And lucrative businesses can attract less ethical, or sometimes even less savory elements to try their hand at making quick money. So Cryptojacking is born.
The problem facing an entrepreneur is that cryptocurrency mining is CPU intensive and that means the more computer power you can put into the effort, the more money you can make. So what do you do when you have a lucrative operation just out of reach because you don’t have a server room full of computing power?
One answer: You borrow someone else’s computing power. This process can be executed semi-legally or not legally at all.
There are some websites that use your computer time while you are browsing their site. Some consider it a good alternative way to monetize their website. With such sites there will be a disclaimer and an opt-in/opt-out choice. But these options are often not very easy to understand or find. Taking your computer’s power gets a little less legitimate when the site gives the visitor a five-second warning at the bottom of their web page.
Case in point: If your computer fan suddenly comes on while you are browsing a website, you could be hosting cryptomining time for the website owner. And it’s not likely that you’ll know that your computer is doing this.
Cryptojackers sneak onto your computer through the usual sources:
- Malware
- Clicking on infected ads
- Clicking on infected browsers
- Phishing attacks
All these known risks can be combated with proper Security Awareness Training. But unlike the websites that give you an opt-in feature and use your computer time while you browse, cryptojackers stay on your computer or network, take up permanent residence, and start mining. It’s like Hotel California. You can check out, but you can never leave. They don’t leave your computer. Why should they, they’re getting what they need for free.
Cryptocurrency mining has become more lucrative than ransomware and many cyber criminals are turning to this as an easier payday.
Cryptojacking provides a steady income stream. With ransomware you can infect 100 computers and get a few people to pay. With cryptojacking, all 100 computers will generate a steady stream of money.
The risk vs money generation is good enough in cryptojacking that some areas of the world have, in the last few months, experienced as much as a 1,200% increase in incidences. This is an epidemic sweeping through the IT world.
What cryptojacking does for cybercriminals is, quietly (that’s what they are hoping, at least) run in the background of your system, solving complex problems and earning money.
What it does for you, the regular computer user, is slow your system, use up processing time, electricity, and put stress on your hardware. It’s hard to detect and can cost hours of time as your help desk and IT personnel try to track down the problem.
And here’s the part that makes cryptojacking really attractive. If malware is found running on your organization’s server, chances are you’ll purge the system of it, use a lot of colorful language and move on with your day. You’ll be relieved that the intruders didn’t steal any sensitive data. It wasn’t Ransomware. They didn’t encrypt your data or demand any money. They didn’t steal anything that is easily quantifiable. The motivation to track them down and prosecute is much lower.
Where it has most potential for substantial harm, however, is in the public services sector. Many of those systems are not hardened and once infected, if run at 100%, could actually cause physical damage, like Stuxnet, but using tried and true everyday infection vectors common to the cybercriminal world.
So how does an organization respond?
A good start would be to add cryptomining to your Security Awareness Training efforts, install ad blockers to prevent infection, and update web filters.
Train your help desk to consider looking further into a rash of overheating systems or unexplained spikes of slow computer complaints. Train your IT staff in what to look for.
Once detected, IT departments can block problem URLs and purge browser extensions.
Cryptojacking is the new ransomware
Cryptocurrency mining is a lucrative business that is on the rise, and we need to be aware of this new epidemic. Whether you are concerned with a personal computer or are responsible for a whole network of computers, be aware of how this epidemic will affect your systems, as well as how to identify and get rid of it.
Recent Comments