What enterprises need to know about cryptojacking
Of all the modern cyberthreats enterprise IT managers have on their radar, cryptojacking is most often dismissed as a low-tier priority. While the practice does not have as many immediate risks as malware or ransomware attacks, it can lead to serious device and network performance issues if left unchecked. To prevent costly inefficiencies, corporate security personnel have started to take a closer look at the specific consequences of large-scale crypto-mining operations, though it can be helpful to start with the basics.
What is cryptojacking?
According to CSO, cryptojacking refers to the "unauthorized use of someone else's computer to mine cryptocurrency." Over the past few years, digital currencies have become increasingly popular, leading many tech-minded entrepreneurs to develop new methods for making a profit. Cryptocurrencies are created using computer programs that require a lot of operating power, often much more than a single device can produce. All transactions are recorded on the "blockchain," a peer-to-peer network that timestamps every monetary interaction as a hash-based proof of work. While there are a variety of different cryptocurrencies on the market, Bitcoin is considered the most valuable, though it has become difficult to mine of late, due to its popularity and the massive processing power involved.
In its 2018 Internet Security Threat Report, Symantec outlined two primary methods used to mine cryptocurrencies on personal and business computers:
- File-based coin mining: An executable file is downloaded onto a computer or IoT device and runs in the background.
- Browser-based coin mining: Scripted languages execute mining operations inside a web browser when a user visits specific websites.
The consequences of cryptojacking
Compared to other more aggressive forms of cybercrime that cause immediate damage and financial harm, cryptojacking may sound like a benign threat. While it's true that most coin mining scripts do not harm computers or steal users' data, they often severely impact the overall performance of personal and business devices. Cryptojacking saps CPU processing resources to support its coin mining operations, slowing down the execution of programs and applications in the process. Consumers may consider this a minor inconvenience, but enterprise organizations can suffer notable losses in the form of increased IT support tickets, higher electrical bills and decreased productivity.
Generally speaking, the presence of cryptocurrency-mining malware in an organization's IT infrastructure points to broader issues with its cybersecurity protocols. As a 2019 article from Info Security Magazine pointed out, a vast majority of illicit crypto mining programs capitalize on poor cybersecurity hygiene and inefficient patch management to infiltrate and spread throughout enterprise networks. Researchers from Check Point found that close to 55% of organizations were impacted by the activities of crypto miners, with the following malware programs standing as the most common culprits:
- Rig ek: Delivers exploits for Flash, Java, Silverlight and Internet Explorer by redirecting users to an infected landing page that checks for vulnerable plug-ins.
- Roughted: Uses "malvertising" tactics to distribute various payloads - from scams and adware to exploit kits and ransomware infections - and is able to bypass most ad-blockers.
- Fireball: Hijacks web browsers to act as full-functioning malware downloaders, executing malicious code and stealing user credentials.
- Ramnit: Steals a range of personal data, including banking credentials, browser cookies, FTP passwords and more.
Using these (and other) malware tools, crypto miners are able to link several disparate computers and mobile devices into a massive botnet, which is much more profitable than using browser-based mining tactics. According to Symantec, cybercriminals operating a botnet of 100,000 devices could generate up to $750,000 by mining cryptocurrencies in just 30 days, compared to $30,000 for operations of equal size that rely on web browser scripts. It's clear that cryptojacking is a lucrative form of cybercrime that will likely continue to expand over the next decade. To keep pace with existing and emergent crypto-mining tactics, companies must deploy robust system and network security protocols that can identify vulnerabilities and remove malicious code before it spreads.
Perle offers industry-grade connectivity tools that can help organizations safeguard their mission critical operations and maintain their system sustainability over the long term. Read some of our customer stories to find out how we've helped other enterprises improve their infrastructure and stay connected when it mattered most.