Story image

Not a Bitcoin owner? You're still fair game for a cryptomining attack

21 Mar 18

​Cryptomining has been plaguing the headlines around the world – but what actually is it and who does it affect?

As it turns out, everyone.

Research from Check Point’s threat intelligence database, ThreatCloud, drawn from more than 80,000 Check Point gateways and millions of endpoints around the world has found that cryptomining attacks have undoubtedly been on the rise.

First emerging in 2011, mining attacks became extremely lucrative towards the end of 2017 with the skyrocketing values of Bitcoin and Monero.

The cryptomining industry

Check Point says put briefly, cryptomining is the process of sealing new transactions into the cryptocurrency’s public ledger using blockchain technology.

Sealing a block of transactions is like solving a complex puzzle with the ledger itself essentially a chain of sealed transaction blocks – known as a blockchain.

The first miner (i.e. person or computer) to complete this complex calculation is awarded with some fresh and highly coveted coins. This obviously takes some substantially resource-intensive computation.

According to Check Point, this has resulted in big business. Every 10 minutes Bitcoin commits a new block of transactions to its ledger and awards 12.5 BTC to its miner. At its current exchange rate that’s around US$130,000 paid to miners every 10 minutes, or $6.8 billion per year.

And that’s just Bitcoin, as Monero for example rewards its mining community with $430 million annually.

This has resulted in entrepreneurs investing heavily in massive and energy-hungry data centres that are filled with mining computers in order to get their slice of the pie.

Its dark side

There is a significant proportion of ‘entrepreneurs’ who would rather not invest in all the infrastructure. Why not just hack into other people and groups’ machines and criminally exploit their CPU power without their consent or even knowledge?

Illicit cryptominers leverage all their victims’ collective CU power in order to perform the computation-intensive blockchain calculations and essentially win earn themselves some money.

And Check Point says nobody or thing is safe as anything goes, including PCs, mobile, servers, industrial systems, and even Tesla cars.

Check Point says cryptomining attacks (often referred to as cryptojacking) are relatively simple to enact and have the potential to generate huge financial returns – in fact the company recently released a study that uncovered a single cybercriminal that had earned $3 million from mining Monero.

There are a number of other cryptocurrency attacks that try to directly steal coins or manipulate transactions, but as the majority of businesses do not (yet) accept direct payment using cryptocurrencies they are unlikely to be affected by them.

But cryptomining attacks are a huge risk for all businesses. According to Check Point, a staggering 55 percent of organisations were a target of cryptomining attacks in December 2017 alone.

Check Point says there are three main ways cryptomining attacks can impact business, including:

  • Consumption of precious server resources – Mining malware is a huge CPU hog and can easily consume the entire CPU power of your servers, drastically lowering service availability and increasing hosting and electricity cost.
  • Reduced user productivity – Mining attacks target users with malware, affected mobile apps or through malicious websites. The result of these techniques is the same, as user machines slow down and heat up while the user becomes ever more frustrated.
  • Negative impact on reputation and customer satisfaction – Check point says that in many cases hackers penetrate and infect organisation’s web servers. If this happens then you are essentially targeting your customers.

Check Point says that businesses need to become fully aware about how these attacks target organisations around the world, essentially introducing new risk vectors to the IT environment.

CERT NZ highlights rise of unauthorised access incidents
“In one case, the attacker gained access and tracked the business’s emails for at least six months. They gathered extensive knowledge of the business’s billing cycles."
Report finds GCSB in compliance with NZ rights
The Inspector-General has given the GCSB its compliance tick of approval for the fourth year in a row.
Game review: Just Cause 4 on PC
Rico Rodriguez returns to wreak over-the-top havoc for a fourth time. This time the island nation of Solís is our hero’s sandbox, ripe for destruction.
Hands-on review: Logitech G502 HERO gaming mouse
My favourite feature of the G502s is the ‘Sniper’ button, which is found on the left hand side of the device. When held, this lowers the DPI and allows you to achieve maximum accuracy whilst honing in on a kill on your favourite FPS title.
Interview: ZeniMax Online's game director talks Elder Scrolls Online
FutureFive’s Darren Price sat down with Matt Firor, ESO’s designer and now president and game director at ZeniMax Online.
IDC: Tablets stay dead, notebooks keep head above water
An IDC report predicts a soft personal PC market, slipping into further decline with the exception of notebooks, gaming PCs, and business PC upgrades.
A hands-on guide to Christmas shopping by Santa’s IT elf
Ho, ho, ho! So you’re back again for more inspiration for that hard-to-buy-for person in your life?
Govt commits $15.5m to digital identity research
“With more and more aspects of our lives taking place online it’s critical the government takes a lead to ensure New Zealanders have control of how and who uses their identity information,” says Minister Woods.