What is the definition of cryptojacking?
Justin Daniels, cyberlaw attorney at Baker Donelson, tells us cryptojacking is when hackers place a specific class of malware on your computer or server that turns it into a "mining rig" for cryptocurrency.
If you're the victim of a cryptojack, you provide the electricity, the bandwidth, and the processing power—and cyber criminals get the Bitcoin or other digital currency they mine.
You pay for the cryptomining while hackers take the profit.
Why is cryptojacking increasing?
This growing type of cyber attack was discussed in detail, in an understandable way, during the complimentary SecureWorld web conference, Cryptomining Malware: A New Major Headache with Hidden Risks, which you can listen to on-demand.
The crime of cryptojacking is powered by the demand for different types of anonymized cryptocurrencies that remove financial institutions and the eyes of law enforcement from the picture.
"Cryptocurrency is the most mature use case we have today for blockchain technology. Blockchain is a digital ledger that allows you to create digital transactions," says Daniels. If your device is cryptojacked, then it is essentially helping to verify these blockchain or digital ledger transactions.
Is cryptojacking a victimless crime?
Erich Kron, Security Awareness Advocate at KnowBe4, says of crypojacking, "The problem is probably worse than we know. A lot of these attempts are operating in the background."
And Kron says cryptojacking is creating victims, despite what he often hears about it.
"A lot of people feel like its a victimless crime. I can tell you there is no such thing. If they can get this onto your system, what else can they do? We've actually seen cryptominers dropped as a post exploitation payload. Where they try to make a couple of bucks while your team is trying to get to the bottom of what is going on."
He says the fact that a cryptojack was a success means there's an opening somewhere in your system which can also be exploited in other ways.
Manufacturers should watch for cryptojacking attacks
And Col. Cedric Leighton, CNN military analyst, USAF (ret.), and CEO of Cedric Leighton Associates, says there are other dangers from cyrptojacking.
"This includes ICS, industrial control systems. There are serious safety concerns when they are hijacked to do crytpomining. Safety of workers can be put at risk and the safety to nearby communities. It can interfere with the operation of a facility."
He says most cryptojacking attacks occur through known exploits that have not been patched. He also says nothing is safe from cryptojacking because even Linux and Apple systems have been compromised, and too often, companies are not aware they've been attacked in this way.
“We need to get better at anticipating cryptojacking, at deterring cryptojacking, detecting cryptojacking, and responding to cryptojacking.”
KnowBe4's Kron says the number one thing you can do is to train your users. “Most of the time phishing emails are the access they use. This makes the biggest impact dollar for dollar when you are fighting these things.”
During Cryptomining Malware: A New Major Headache with Hidden Risks, he lists five top methods for reducing the risk of being crypojacked.
This is critically important, especially when you consider that the threat landscape around cryptojacking is expanding.
Daniels sums it up like this: "Cryptomining and blockchain and Bitcoin is in its infancy. While some of this innovation is great, if you don’t pay attention to security on the front end, think about the potential issues you’ll create when you have to react.”
