To some degree or another, most of us have heard of the term “Virtual Currency”. This is essentially the cloud-based version of the traditional paper money. For example, with Ransomware a Cyber attacker wants to be paid with this new type of currency, usually in the form of Bitcoin. There are other types of virtual currencies that are out there, and collectively, these are also known as “Cryptocurrencies”.
There was a time earlier this year, when Cryptocurrencies were all the rage, especially in the financial markets. Futures contracts and even indexes were created and tracked for them and were traded heavily. For a period of time, the value of them went sky high and people thought that this would be the real thing again, similar to the .com craze back in the early 90’s.
Cryptojacking Defined
As that came to a crashing end, so did the volatility of the Cryptocurrencies. Although they are still being traded, just not with the volume and the market capitalization that it once had. Now, here is another twist to the story. The Cyber attacker is entering into this realm, with a new threat called “Cryptojacking”, which is essentially mining the various Cryptocurrencies for monetary value.
But first, it is important to define what Cryptomining is all about, and it is as follows:
“Bitcoin mining is done by specialized computers. The role of miners is to secure the network and to process every Bitcoin transaction. Miners achieve this by solving a computational problem which allows them to chain together blocks of transactions (hence Bitcoin’s famous “blockchain”). For this service, miners are rewarded with newly-created Bitcoins and transaction fees.” (source 1)
Technically, Cryptojacking can be defined as follows:
“Cryptojacking is the unauthorized use of someone else’s computer to mine cryptocurrency. Hackers do this by either getting the victim to click on a malicious link in an email that loads crypto mining code on the computer, or by infecting a website or online ad with JavaScript code that auto-executes once loaded in the victim’s browser.” (Source 2)
Cryptojacking Explained
Now that we have defined Cryptomining and Cryptojacking, we can put these in simpler terms. We all have an idea of what a virtual currency is. Since there is no way to actually track down this digital currency, it needs to be made secure on the Internet.
So, this is where the mining aspect of it comes into play. It is their job to protect all of these currencies and transactions, by having the ability to solve very complex math problems.
Once this has been done in a successive fashion, all of these transactions then form a “block” (aka the “Blockchain”) which creates the line of defense to protect these virtual currencies and their associated transactions. In return for their services, these miners (which are legal entities), are paid a certain fee percentage.
How a Cryptojacking Attack is Launched
The cyber attacker now wants to gain their foot into this game because of the return that is associated, and become cryptominers themselves, but of course illegally. Keep in mind, there are very complex mathematical problems to solve in order for the miner to be rewarded. This of course takes a lot of computing and processing power.
The Cyber attacker does not want to spend the money in terms of procuring the extra hardware to do this, so he or she will hijack your computer. From there, steal the processing power as well as the electricity in order to mine the Cryptocurrencies. You may be asking at this point; how can they do this to your computer?
It’s quite easy. All they have to do is send you a Phishing like Email, which contains a malicious link or attachment. Once you have fallen victim to this, a specialized Cryptomining code is then installed onto your computer or even mobile device.
An even stealthier way is when you visit a website, there could be infected pieces of Java source code running behind the site you are viewing and the Cryptomining code can then be covertly loaded onto your computer. At this point in the game, the Cryptomining code is now technically malware.
The problem with this new malware is that it is very difficult to spot on your computer, and can installed and deployed in a very sneaky manner. In these instances, the Cyber attacker is not just exclusively targeting computers and wireless devices, they will go after anything that will give them free electricity. This includes servers, routers, cable modems, firewalls, network intrusion devices, etc.
It is also important to keep in mind that there is no specialized package that the Cyber attacker has to deploy onto a device – the malware is just a few lines of infected source code, which makes it all the more difficult to detect. Because of the extremely low overhead that is required, and its sneaky nature, the rise in Cryptojacking has increased significantly.
For example, McAfee has just discovered almost 3 million new cases of it, which is a staggering 629% increase from 2017. So, what are some of the telltale signs if your computer has been hijacked for the purposes of Cryptojacking? Here are some clues:
- Slowdown in the speed of your computer;
- Very slow load times when trying to connect to the Internet;
- A slow increase in your electricity bill.
Conclusions
In response to all of this, tech giants like Google and Apple whom have mobile app stores are taking proactive actions to protect their customers. For example, with the former, they no longer allow for browser extensions in its Web Store that mine cryptocurrencies. The Google Play Store allows for customers to pick extensions and apps that personalize their Chrome web browser, but this will now become highly restricted. In fact, a recent study (conducted by a Cyber security firm known as Sophos) detected 25 rogue mobile applications which had the infected Cryptojacking source code in them. These mobile apps were downloaded at least 120,000 times by different end users.