A new addition to the threat landscape started to appear in mid 2017 2018 it is a form of malware that
hijacks your C-p you cycle's to mine.
Cryptocurrency the rising popularity of cryptocurrency for both purchasing and for mining has led to
a significant growth of the mining community and cryptocurrency market worldwide.
These in turn produce a new kind of tool used to generate revenue.
A crypto miner in cryptocurrency networks mining is a validation of a transaction for doing the mining.
Successful miners obtain new cryptocurrency as a reward.
So mining makes money.
The more mining you do the more money you make especially if you use other people's machines to do the
mining and you end up paying for the electricity tools used by malicious actors.
I've seen call things like crypto mining malware C.P you highjackers crypto jackers.
We've not really settled on a name yet.
So all of those names are used.
There are a few ways your device might be subjected to running a crypto on the common and obvious ways
through things like phishing attacks social engineering exploiting a vulnerability.
Downloading a bad app from a store or any any untrusted coding device can result in getting crypto mining
malware on your device.
Another major attack vector to be aware of is javascript based mining tools which can be injected into
Web sites both by the website owners themselves or by threat actors.
So imagine you visit a Web site and unbeknown to you your browser is running it will see you for no
known good reason.
The site is running Javascript based mining tools.
Sometimes the Web sites have crypto reminders as an alternative to advertising.
So are doing it openly and honestly so that that model is actually fine.
But sometimes sites aren't open about it and try to secretly use your machine as a minor and run up
the CPQ too hard all the times the site has been taken over in some way by an adversary and is ruining
the code without the permission of the owner of the site.
The bottom line though they are all taking CPQ cycles to mine cryptocurrency to make money.
You need to be aware of this and if you don't want this to be happening on your machine then you need
to stop it.
The ones are particularly nefarious will ruin your Sipa you too hard that it will affect the performance
of your machine.
Let me give you some examples to make you aware of the current threat landscape Pirate Bay the popular
torrent site which I'm sure you're aware of has been found to be used in user CPQ power to mind cryptocurrency
without notification.
Well there are examples of sites that do it without notification or sites thought up to box and also
vids that I TV up to boxes a file hosting service vids that are adult TV is a video sharing service.
These are also known to use a super power to mine.
Manero cryptocurrency without notification there there'll be many other sites that do this and as time
passes I'm sure other sites will try to do this without notification.
Kaspersky Lab says they spotted evidence of a vulnerability in a desktop version of the messaging app
telegram that allows attackers to install cryptocurrency mining malware on the user's computer.
Zoraida ex-boy was used to trick telegram used into downloading malicious files which could then be
used to deliver crypto mining software and spyware Elmis digital currencies like Manero Zed cash Fantom
coin and others which are common coins to be mined by cryptocurrency malware cryptocurrency mining scripts
injection was found in over 4000 Web sites including those belonging to the UK and US government.
Hackers managed to hijack a popular third party accessibility plugin called Brough's allowed used by
all these affected Web sites and infected their cryptocurrency mining script into its code.
The script used to do this belongs to these guys here coign hive.
They're a legitimate service offered as an alternative to advertisement and the hackers are using coign
hive in this example as a quick way to make money.
Coin hive as been used in other attacks to crudo currency mining malware infected over half a million
PCs using an NSA ex-boy Researches from proof point discovered a massive global botnet called sumon
men rou aka MO that is using the eternal blue SNB exploit.
That's the one the NSA discovered at s.a.a exploit leaked by the shadow brokers to infect Windows computers
to secretly Manero cryptocurrency is mo as been active since at least May 2017.
And the bottleneck as of recording is infected more than 500 in 26000 Windows machines the Bahna operators
as of recording have mine approximately eight thousand nine hundred Manero which is valued at about
3.6 million dollars.
And the rate of roughly 24 mineros per day which is around eight thousand five hundred dollars per day
by stealing computing resources of millions of systems so crypto mining does pay.
This is a valid threat to be talking about on the threat landscape Android malware is taking over phones
to mine for cryptocurrency for scrutinizing is now also affecting mobile phones and tablets on mass
not only via Trojan apps but also via redirects and pop Ponder's while mobile platforms are less powerful
than their desktop counterparts.
There is also a great number of them so they are a viable target.
IOS is probably safer.
Android is less safe but the last thing you want to do is be downloading from untrusted app stores.
Even the mighty huge he was caught serving ads with CPQ draining cryptocurrency mine.
Is this an example of times man a man of the times campaign that let attackers profit while all unwitting
users were watching videos.
This was quickly taken down.
But it goes to show you that cryptocurrency minors can be injected into sites via mail all the time
and even on top top sites like YouTube.
So what can we do to mitigate this.
Well you'll need to monitor your CPQ usage and see if any process looks like it's running too high.
You will most often notice this from your browser processes due to the javascript based attacks from
web sites Firefox Chrome etc..
Those processes if the browser process is running high close the browser tab or window that is running
the high process is hard to say what normal CPQ usage looks like since computer processing power applications
people run vary so much.
Boy a suddenly elevated level of CPQ usage would indicate an abnormal increase in demand for processing
power.
Some sneaky sites load hidden browser windows so you will need to end the process as you might not even
be able to see the window browser window in or to close it to check out your CPP usage.
Look at Task Manager in Windows activity monitor on Mac and top on Linux to see if your browser processor
is running faster than it should be and any browser process that is running normally high in the core
section on browser security we discuss and blockers and hasty ETP filters installing an ad block a lot
you block origin that you can see here can help to prevent these crypto minors.
Also here is a known coin mynahs you are a blacklist to add to your ad blocker.
This block known coign mine is install in your book origin or your blocker of choice.
So see the browser security section for more information on ad blockers.
You can also install the extension no coin into your browser.
No coin is a tiny browser extension aiming to block coin minors such as coin high that will help you
mitigate the risk to that lots round upon C-p you hijacker's crypto mining malware encrypt jackaroos.