Cryptojacking: An Overview

Definition

• Cryptojacking is the unauthorized use of someone else's computer to mine cryptocurrency.

How It Works

• Hackers utilize two main methods to execute cryptojacking:
  1. Victims click on a malicious link in an email, loading cryptomining code onto the computer.
  2. Websites or online ads are infected with JavaScript code that auto-executes when loaded in the victim’s browser.
• Hackers often use both methods to increase their return.

Effects on Victims

• Cryptojacking scripts do not damage computers or data.
• They steal CPU processing resources, often resulting in:
  • Slower computer performance.
  • For organizations, increased IT costs and effort to resolve performance issues.

Case Study

• At the 2018 EmTech Digital conference, Darktrace shared a case of a European bank experiencing unusual server traffic.
  • Discovery of unauthorized servers set up by a rogue staffer for cryptomining.

Prevalence and Appeal

• Exact amount of cryptocurrency mined through cryptojacking is unknown, but it's widespread due to economic incentives:
  • More money with less risk.
  • Availability of inexpensive kits on the dark web.
  • Low technical skill requirement.
• Cryptomining delivery methods derive from malware delivery techniques (e.g., ransomware, adware).

Notable Incidents

• 2017 Kaspersky Labs Discovery:
  • Google Chrome extension 'Facexworm' used Facebook Messenger to infect computers.
  • Originally delivered adware.
• 2018 Trend Micro Discovery:
  • 'Facexworm' targeted cryptocurrency exchanges, capable of delivering cryptomining code.
  • Stole web accounts and credentials for cryptojacking code injection.

Prevention Strategies

1. Awareness and Education
   • Learn to identify phishing emails to avoid clicking on malicious links.
2. Adblocker Installation
   • Blocks cryptojacking scripts delivered through web ads.
   • Some blockers detect cryptomining scripts specifically.
3. Antivirus Software
   • Use updated antivirus programs with crypto miner detection features.
   • Provides a layer of protection against cryptojacking.