STE WILLIAMS

Cryptomining – performing the zillions of cryptographic calculations you need to earn hot-topic cryptocurrencies such as Bitcoin, Monero or Ethereum – is a massive global industry these days.

With Bitcoins worth about $10,000 each, you can see the attraction.

But to get serious about cryptomining, you’re looking at setting up hundreds or thousands of high-powered compute servers, which typically means renting space in a data centre where electricity is cheap and cooling is easy – such as Iceland.

Or you can cheat.

Break into someone’s network and install cryptomining software onto their computers so you can steal their electricity and CPU power – laptops are good, servers are better, and supercomputers are the best of all.

Or break into their web server and sneakily add in browser-based cryptomining code, written in JavaScript, that mines whenever anyone visits their website.

Or take over their guest Wi-Fi access point and inject cryptomining content wherever their customers go.

There’s even an open-source toolkit called CoffeeMiner that will inject rogue cryptomining code into Wi-Fi traffic automatically – all you have to do is to plug in your own anonymous cryptomining ID and the earnings come to you.

When mining turns into jacking

When cryptomining is done illegally, without authorisation, it turns into the aptly-named crime of cryptojacking.

And cryptojacking has become a serious global problem.

There’s even a malware family known as WannaMine – a portmanteau name that borrows the “Wanna” from the exploit-based spreading technique of the WannaCry ransomware worm, and “Mine” from, well, from the process of cryptomining.

Frankly, WannaJack would be a better name: in this sort of attack, the crooks don’t just break in and find a couple of computers to take over – they set loose a worm that automatically distributes their cryptojacking attack around your network.

The criminal equation behind a worm-driven cryptojacking attack is very simple: the more CPUs you have mining for you, the more money you make.

Cryptojacking may feel like a victimless crime, at least when you compare it to ransomware – what’s a few dollars of electricity between you and the crooks?

But cryptojacking is a clear and present danger:

• There’s a reputational cost. What else did the crooks implant during the breach?
• There’s a regulatory cost. What happens after you report the breach, which you’ll need to do?
• There’s an opportunity cost. How many customers couldn’t access your services because the crooks were using all your processing power?

Fighting back!

Find out more about cryptojacking, how it works, and what you can do about it, in our plain-talking new threat report Standing up to cryptojacking – Best practices for fighting back. (Direct link – no registration required.)

Learn the practical steps you can take to avoid being a victim of cryptojacking!

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/HlUHVYfDEHY/