Cryptomining has surpassed even ransomware as the revenue generator of choice according to a Cisco Talos report, which claims crypto-mining botnets can earn hackers up to $500 dollars a day and a dedicated effort could equate to more than $100,000 dollars a year.
Representing the perfect balance of stealth and wealth for cybercriminals and some unscrupulous, but legitimate online businesses, cryptomining is quickly becoming a major concern for enterprise IT who frequently don’t know their digital assets have been compromised.
With stringent privacy laws coming online in 2018, it is imperative that organizations know all partners that execute code on the website. This information is critical for not only identifying the rogue source but also communicating expectations and enforcing compliance—key mitigating factors when it comes to regulatory penalties.
Criminals cash out
Hackers are able to break the bank by mining for cryptocurrency which requires mass computing power to solve complex mathematical problems. Once solved, cryptocurrency is exchanged for the answers.
Even some legitimate websites turn to cryptomining to boost their bottom line. Instead of selling ads or promotional content, these websites run cryptomining code during browser sessions. When browsing the website, the code executes to harness the device’s processing power to mine cryptocurrency; in some cases, the code can persist after closing the browser session. For the most part, websites are not transparent to their visitors about this activity. What’s worse is that cryptomining is not technically categorized as malware and thus, is not illegal.
No harm no foul?
Several argue that cryptomining is a victimless crime. It’s easy to use automated bots to siphon processing power without user interaction, which is hassle for ransomware incidents. What’s the harm in accessing underutilized processing power? Plenty. In a worst-case scenario, unthrottled processing can unexpectedly drain batteries and even damage devices. It’s more likely that device owners feel cheated; someone is leveraging their property without permission and compensation.
Website operators bear the blame, for not only consumer discontent but also regulatory violations. The ability to inject code into a website signals a weak security posture, which can lead to additional exploits of consumer data. With tightened consumer data privacy and protection regulations coming into force, the threat of regulatory penalties is real.
To put this threat into perspective: 220 popular websites have recently been found to contain cryptomining code, according to research from AdGuard. Even Tesla isn’t safe.
Detecting the crypto crime
A variety of scams are now in play, but an emerging one is particularly crafty. Predominantly targeting the mobile environment, this cryptominer executes behind the presentation of a gift card popup.
Most consumers will not realize their device has been infected. If anything, they may notice performance lags but not think twice about the cause. To detect this cryptominer, a website operator would need to perform a line-by-line code analysis to identify and remediate the root cause. Knowing all digital partners would truncate this extensive process making it easier to discover anomalous code, possibly at the time of compromise.
The root of all evil is in the code
With more than 500 million PCs actively mining cryptocurrency worldwide, you have to wonder how many compromised websites exist. All it takes is the insertion of a small crypto mining script on a website and the operation is up and running. The challenge for enterprise websites is knowing if and when this occurs—a daunting prospect for the dynamic nature of today’s websites. It all starts with documenting the website partners executing in the website.
Enterprise IT is flying blind. More than 80% of code rendering on a website is provided by third parties. Identifying onsite vendors and enforcing best practices is the foundation for a cleaner, safer Internet environment that can lock out nefarious activities such as cryptomining and ensure the online safety of customers and the integrity of the corporate brand.