Digital Pickpockets - A Research Journey Into The World Of Cryptojacking
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
DIGITAL PICKPOCKETS: A RESEARCH JOURNEY INTO
THE WORLD OF CRYPTOJACKING Madhavan S, BA LLB., [Hons] School of Excellence in Law Smrithi Anilkumar, BBA LLB., [Hons] School of Excellence in Law
ABSTRACT
The popularity of cryptocurrency & its mining has also led to its unauthorised use resulting in cryptojacking which is a major cybercrime threat. The Initial part of the study looks at the several ways that cryptojacking is carried out as well as how to stop it. The later section of the study focuses a lot on the legal ramifications in different nations as well as previous instances of cryptojacking. Finally, the research also examines the difficulties encountered & offers suggestions for overcoming these difficulties.
INTRODUCTION
The year 2009 marked the entry into the world of cryptocurrencies since the birth of bitcoins. Since then, the digitalization and modernization of the world have mushroomed the use of several other types of cryptocurrencies, like Zcash, Ethereum, and Monero. Cryptocurrencies are well-encrypted digital currencies that have the facility for end-to-end transaction tracking without any tangible transactions. 1 The utilization of blockchain technology, which combines several computer programs and processing capabilities, is enabling the creation and trading of cryptocurrencies. The investors in this cryptocurrency seek to make quick money by processing strong transactional data for the blockchain network through the so-called cryptomining business.
Since most users cannot afford the cost of standardized or specialist equipment for mining, creative solutions to streamline the procedure and lower the required computational cost have been devised. Large cryptocurrency houses have released executable binaries and primarily 1 Aleksander Berentsen & Fabian Schär; “A Short Introduction to the World of Cryptocurrencies”, 2018. browser-side scripts so that consumers can access their pooled resources and solve problems quickly as proof of work. Unfortunately, dishonest and corrupt people have taken advantage of this functionality to sneakily collect data without the user's awareness and include malicious scripts. This type of cyberattack, referred to as "cryptojacking," is subtle and challenging to detect, opening a gap in multi-layered security measures.
These cryptojacking programs are malicious software that infects a victim's computer via phishing, compromised websites, or other malware attack techniques. They can also be little programs embedded in digital advertisements or web pages that only activate when the victim visits a certain website. The recent incidents have shown a significant hike in cryptojacking. The reports of SonicWall research show that there was an increase of about 30% to 66. 7 million attacks in the first half of 2022 compared to the same period in 2021. 2 The report also implies that the previously most affected sectors, like government, healthcare, and education, saw a decline in the volume of cryptojacking attacks in the first half of 2022. The finance industry saw a 269% increase in cryptojacking cases, while the retail sector saw a 63% increase.
3 METHODS OF CRYPTOJACKING The cryptojackers use various methods for cryptojacking. Those methods are mostly classified into two categories. The former is focused on infecting the web browser, while the latter is based on host-based approaches. Browser Cryptojacking: The way the browser-based solution operates is that it generates content that triggers cryptomining software in the user's web browser automatically when the user visits the webpage hosting it. This method is also known as drive-by cryptomining. Hackers either build a website and send traffic to it that has embedded JavaScript code for crypto mining, or they breach an already-existing website. Programmatic advertising, which includes spyware that automatically displays advertisements on websites, has the ability to infect already-existing websites.
The proprietors of the websites have limited control over whether the software operates on their site, and this is done without their knowledge.
2 Ray Wyman Jr; “Cybersecurity News & Trends”, 2022.
3 Mid-year update
2023 Sonicwall cyber threat report.
On a website, compromised advertising may appear as pop-unders, which are designed to elude detection by hiding behind windows that are already open on a victim's phone or computer. This kind of virus gets around ad blockers by using domain creation algorithms to show ads to every visitor to the website. JavaScript can be embedded on webpages by cryptojackers without the need for advertisements. Some websites even acknowledge that when people are browsing, their pages use their devices to run cryptomining software. 4 Host Cryptojacking: This tactic works similarly to standard malware and phishing campaigns. When victims click on seemingly innocent URLs, cryptojackers use deception to install cryptomining software on their devices. The effects of host-based cryptojacking can be felt on a variety of devices.
For instance, Trojan horse cryptojacking attacks can be launched against Google Android phones through Google Play Store applications. Furthermore, public application programming interfaces (APIs) and open-source code can be contaminated by cryptojacking malware, which can then infect computers that download the code or API and any apps created using it. Cloud storage that is not secured can be accessed by cryptojackers. Once within a victim's endpoint, cryptojacking malware propagates throughout the network, infecting servers, cloud infrastructures, and software supply chains. IMPACT OF CRYPTOJACKING: - The act of Cryptojacking can have a substantial financial and technical impact on both individuals and organisations. Its adverse impacts can be classified into two major heads, which are: -
1. Financial Impact
Cryptojacking often leads to a substantial increase in electricity costs due to the extensive processing power it requires, resulting in higher bills for unwitting individuals whose devices are compromised. The excessive utilization of CPU resources in cryptojacked devices frequently leads to decreased performance, negatively affecting individual productivity and impairing operational efficiency in corporate settings.
4 A First Look at Browser-Based Cryptojacking by S Eskandari, 2018.
Moreover, in commercial environments, it introduces an opportunity cost as resources are diverted to mining instead of being utilized for regular operations or legal tasks, impacting overall business performance and revenue generation. The cost of remediation, including eradicating malware, fixing vulnerabilities, and implementing cybersecurity measures to prevent future attacks, imposes financial burdens on those encountering cryptojacking occurrences. Finally, businesses may suffer from a damaged reputation among stakeholders, partners, and customers as a result of becoming the victim of cryptojacking. It could result in a decline in credibility and trust, which could have an effect on partnerships and sales. 2.
Technical Impact Cryptojacking typically seizes control of a device's CPU resources, causing a significant spike in CPU usage and leading to a notable slowdown in system performance. Over prolonged periods, this can contribute to the posing a risk of overheating, potential damage, wear and tear of hardware components, potentially shortening their lifespan. For individuals, this may translate to additional expenses for repairing or replacing devices. In organizational settings, the strain on hardware can result in higher maintenance costs and the need for premature technology replacements. In corporate environments where multiple devices are affected, network congestion may ensue, impacting the performance of essential programs and services. The consequences of cryptojacking also extend to system and application stability, with the potential for freezes, unresponsiveness, and crashes.
In severe cases, the entire operating system may become unstable, leading to data loss and system breakdowns. DETECTION AND PREVENTION OF CRYPTOJACKING Cryptojacking effects leave behind the common signs of malware infection: an abnormally high CPU or GPU load. Given that the primary motivation of cryptojackers is computational power, it is difficult to hide the malware's influence. The issues to consider while detecting cryptojacking are: Check for loud computer ventilation systems and overheating of gadgets: - It indicates that cryptomining operations are being completed in the background. Thus, the system shouldn't overheat unless there is a computationally demanding task. If it occurs, it may indicate the presence of malware.
Checking if the Browser Is Covertly Still Up to Date: Open the Task Manager or Activity Monitor after shutting down the browser to see if the programme is still active. Cryptojackers typically operate through browsers, and they can produce a small "pop-up" window that hides behind the Start button or toolbar and continues to demand computer resources even after it is closed. Paying Special Attention to Cloud Bills: The issue wouldn’t be identifiable until the end of the month, but cybercriminals can steal the users cloud login credentials and use them to mine. Regretfully, the cost of this surgery could be high. According to the proverb, "An ounce of prevention is worth a pound of cure," it is preferable to take preventative action to stop cryptojacking.
The primary reason for this, despite the fact that stopping cryptojacking online is become increasingly difficult, is that the user has no control over the files they install on other websites. Nevertheless, efforts must be made to minimise the likelihood of cryptojacking. The following are typical techniques used to prevent cryptojacking: To thwart cryptojacking attempts, employing an ad-blocker proves effective as cryptomining scripts often lurk behind website ads. Additionally, specialized extensions play a crucial role in detection; extensions like NoMiner and minerBlock are adept at recognizing and preventing the deployment of cryptomining scripts by hackers on websites. Utilizing antivirus software stands as a defense against cryptojacking.
These tools, effective in quarantining and removing scripts akin to traditional malware, often incorporate features designed for detecting cryptomining scripts. Additionally, maintaining an updated firewall, is crucial. If suspicion arises about a webpage hosting a cryptomining script, upgradation can prevent users from accessing the potentially malicious content over the internet. Disabling JavaScript, a common vehicle for hidden cryptomining software on websites. Additionally, users should exercise caution with phishing emails and messages, as they often serve as entry points for malware that can initiate cryptojacking. By employing these precautions, individuals can significantly reduce the risk of falling victim to unauthorized cryptocurrency mining activities.
5 LEGAL AND ETHICAL IMPLICATIONS It is important to first investigate the legal ramifications associated with the cryptocurrency industry before diving into the legal ramifications of cryptojacking. Since its introduction, Bitcoin has been a contentious issue; some nations support its decentralised nature, while others do not. The legal status of crypto is varied from country to country.
1. U.S. - Because the United States has two systems of government, different states are
permitted to have separate cryptocurrency legislation. For instance, after introducing the "Bit License" licencing system for bitcoin and commercial exchanges in 2016, New York has been supportive of cryptocurrencies. Although there are a few states with unclear policies, largely, the United States supports the trading community and allows cryptocurrencies.
2. The European Union - The 27 member nations that make up the European Union must
negotiate a complicated legal framework. 2020 saw the European Commission approve a virtual asset regulation scheme that was well-liked throughout the Union. The purpose of the legislation is to prevent the fragmentation of the financial regulatory systems. The commission also makes sure that the general public can utilise cryptocurrencies in a secure manner.
3. The United Kingdom - The United Kingdom has not yet formulated any separate
legislation for cryptocurrency regulation, considering it property rather than as a legal tender. The Financial Conduct Authority (FCA) oversees cryptocurrency-related business, and has a firm set of rules, and the ones that are seeking a license have to strictly follow them. Crypto trading is subject to gaining taxes, and businesses that are involved in cryptocurrency and crypto exchanges have to follow corporate tax rules.
4. Canada - Canada has a cryptocurrency-friendly stance and cryptocurrencies are viewed
as taxable items by the Canada Revenue Agency (CRA). The country has been more motivated than others when it comes to crypto regulations, being the first to accept a bitcoin-traded fund (ETF) on the Toronto Stock Exchange. They are considered to be
5 A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware MH Khan Abbasi · 2023
money service businesses that require registration under the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) for compliance with anti-money laundering laws. In several other countries, the regulatory stance on the usage of cryptocurrencies is prohibitive. In countries such as China, Bangladesh, Egypt, Morocco, Nepal, Iraq, Tunisia and Qatar the transaction of cryptocurrencies has been banned. Cryptocurrencies are not illegal in India, yet there exists no regulatory framework6 governing them. The government's effort to introduce the Cryptocurrency and Regulation of Official Digital Currency Bill, 2021 aims to establish guidelines for digital currency issued by the Reserve Bank of India7 (RBI). However, delays in its introduction have persisted, leaving cryptocurrencies currently unregulated as a payment medium in India8.
Trading in cryptocurrency carries inherent risks, as there are no centralized rules or guidelines for dispute resolution9. As a consequence, currently there are no viable solutions available for individuals who fall victim to cryptojacking, primarily due to the challenge of tracing the responsible individuals. CASE STUDIES
1. Prometei botnet exploits Microsoft
Prometei is a multi-stage, modular bitcoin botnet available for Linux and Windows. Cybereason discovered in 2021 that Prometei was abusing Microsoft Exchange's vulnerabilities. It infiltrated the user network, causing harm such credential harvesting, malware distribution, and more. After that, it exploited the compromised credentials to mine the cryptocurrency, Monero. 2. Attack on Windows by BadShell In the year 2018, Comodo Cybersecurity10 discovered a certain type of malware in one of their client’s computers; it was named as BadShell. This malware was utilizing Windows processes
6 Manoj Sharma, Cryptocurrency in India
What's the govt's stand, legal status, its future, 2021.
7 Nikita Tambe, All You Need To Know About India’s Crypto Bill, 2023.
8 Venkatesh Aggarwal, CRYPTOCURRENCY
LAWS IN INDIA,2020.
9 Supra note x.
10 Comodo Cybersecurity, Global Threat Report, 2018.
in cryptomining. The effect of which was that it injected malware codes in the usual running processes. Additionally, it worked with a scheduler to have consistency and also had a registry that held the malware’s binary codes, all of which was used to partake in a calculated mining through the user’s device. 3. Cryptojacking through GitHub Researchers discovered a cryptojacking campaign in 2023 that copies GitHub repositories without human intervention and takes use of the exposed AWS credentials. Avast Software revealed in 2018 that certain hackers were mining cryptocurrencies on GitHub. The hackers would search the platform for legitimate projects before moving on to smaller ones within them. These smaller project directories included secret malware codes.
The crypto hackers would then utilise phishing schemes to trick individuals into downloading these files, disguising them as adult software. 4. Piration of Apple’s Final Cut Pro The cybersecurity firm Jamf Threat Labs has found viruses inside pirated editions of Final Cut Pro, as 9to5Mac reported in 2023. What's more worrisome is that Jamf Threat Labs discovered that the crypto-mining malware was evading macOS's standard defences when it was installed on the user's machine. Subsequently, the malware penetrated the user's device and proceeded to mine Monero without any detection. These case studies highlight important cybersecurity takeaways. Firstly, in order to stop vulnerabilities from being exploited, it is crucial to keep software updated through regular patching. Secondly, it's critical to take preventive steps against spear-phishing assaults, such as storing credentials securely.
Thirdly, it's critical to keep an eye out for odd activity occurring within genuine system processes in order to identify and stop malware. Finally, even in trusted contexts, improving detection systems is essential to detect crypto-mining malware.
CHALLENGES
FACED AND COUNTERMEASURES Cyber threat actors' strategies are always changing in the fast-paced world of digital innovations. According to the SonicWall Mid-Year Cyber Threat Report for 2023, cybercriminals are evolving into more crafty and covert actors, and this is reflected in the evolving forms of malicious attacks. The data from SonicWall shows a startling 399% rise in the number of cryptojacking worldwide, pointing to a change in the patterns of cybercrime. In India, on the other hand, ransomware and Internet of Things (IoT) assaults have become much more prevalent, whereas cryptocurrency attacks have increased relatively less there. In light of this, it is also crucial to examine the difficulties that people and organisations encounter when trying to protect their digital assets.
1. The changing face of ransomware - The threat posed by ransomware has not
diminished globally. Ransomware attacks have surged by 133% in India. This highlights how important it is for businesses to protect their digital assets by being proactive and watchful. According to the research, there was a notable upsurge in ransomware attacks in the second quarter, indicating a possible recovery.
2. The IoT vulnerability - Industries that rely significantly on connected devices are at
serious risk from the global increase in IoT attacks, which is most pronounced in India (311%) and other countries. Cybercriminals use IoT vulnerabilities to conduct attacks, actively focusing on weak access points. Organisations must now prioritise bolstering their IoT security protocols and keeping a careful eye on the gadgets that are connected to their networks.
3. The stealthy encrypted threats - The increasing use of encrypted threats by malevolent
entities is a worrying trend. The number of these attacks increased by 22% worldwide, posing a special difficulty for cybersecurity experts. Since encrypted threats are more difficult to identify, CIOs and CISOs must use sophisticated security technologies to identify and stop these kinds of attacks.
4. Diversified cyberattack strategies - The study indicates that threat actors are using a
wider range of cyberattack tactics. Small and medium-sized businesses, governments, and corporations are now among the victims, in addition to vital infrastructure targets and state-sponsored activities. This emphasises how crucial it is to implement proactive threat intelligence, a multi-layered security approach, and security awareness training for staff members.11.
11 CIO&Leader, 2023 SonicWall Report Reveals Surging Cryptojacking and IoT Attacks in India, 2023.
Investigating practical answers becomes crucial as people and organisations struggle with these issues. This takes us into the study of strategies ready to fend off any threats. To lessen the hazards related to cryptojacking, researchers and security specialists have concentrated on creating efficient detection and prevention methods. These methods cover a wide range of strategies, including behaviour analysis, network monitoring, machine learning algorithms, and user education.
1 Machine learning algorithms
Algorithms such as Support Vector Machine (SVM) and Random Forest (RF), offer a solution by analyzing features, behaviors, and network activities of cryptojacking malware. A real-time hybrid approach proposed by IEEE12 integrates static and dynamic features for effective detection.
2 Network Monitoring
Complementing this, network monitoring leverages data analysis from network devices to spot signs of increased activity or resource consumption indicative of cryptojacking attacks. Studies, like the one by MDPI13, advocate for utilizing network monitoring to discern in-browser cryptojacking malware through the examination of its network traffic patterns.
3 User Education and Awareness Training
User education emphasizes the importance of regular software updates14, employing antivirus solutions with cryptojacking detection, and integrating ad-blockers or browser extensions targeting mining scripts. Additionally, users must also be aware of cryptojacking efforts includes spotting phishing efforts, creating secure passwords, and keeping up with the most recent advancements in cybersecurity.
4 Behaviour Analysis
behaviour analysis serves as a guard, monitoring user and device interactions for anomalies. This technique plays a pivotal role in the early detection of suspicious web pages or scripts, enabling a proactive response to potential cryptojacking threats.
12 Supra note x
13 Khan Abbasi, M.H.; Ullah, S.; Ahmad, T.; Buriro, A. A Real-Time Hybrid Approach to Combat In-Browser Cryptojacking Malware. Appl. Sci. 2023, 13, 2039.
14 Vlad Constantinescu, Cryptojacking Explained - Everything You Need to Know about Silent Digital
Robberies,
2023 RECOMMENDATIONS
In light of the identified risks and the consequences that follow, it is pertinent that we mitigate the plausible impact of these attacks on both individual users and organizational systems. By following these recommendations, users can fortify their overall security against these cyberthreats. Security Upgradation through Multi Factor Authentication - Establishing a strong patch management system is essential for individuals and companies to guarantee that all software, including operating systems and security apps, is updated on a regular basis. Reliable endpoint protection solutions can strengthen the defenses against cryptojacking that a business has in place. Additionally, Multi Factor Authentication (MFA), adds an extra degree of security to the system by lessening the likelihood of unwanted access and its effects.
Foster Ethical Behavior - Cryptojacking methods frequently involve cryptocurrencies. Promoting ethical behavior among cryptocurrency users, such following rules and laws, might lessen the likelihood that these digital assets can be misused for nefarious ends. Involvement of Government - A unified front against cybercriminals should be formed by governments, law enforcement, and commercial sector entities. For cybercrime to be systematically addressed, a comprehensive and harmonized worldwide regulatory framework must be developed. This entails establishing uniform sanctions for cybercrime, discouraging possible perpetrators, and promoting cross-border collaboration in inquiries.
CONCLUSION
The investigation into the world of cryptojacking has been thorough, analysing the many techniques used and the resulting effect on the financial domain as well as the technical foundations of systems, which emphasises how urgent it is to take preventative action. The facet of detection and prevention tactics, illuminating practical avenues to strengthen our digital defences against attacks by cryptojackers has also been discussed. This discourse's inherent legal and ethical concerns have emphasised the need for a strong regulatory framework to handle this growing cyberthreat. Case studies have enhanced our comprehension of the obstacles encountered and underscored the necessity of taking pre-emptive action by providing an insight into actual situations.
The suggestions made as we make our way through this complicated terrain serve as both a helpful roadmap as well as a practical guide for strengthening our defences against the everchanging and complex threats posed by crytojacking, thereby safeguarding the security of the digital ecosystem. By staying ahead of the curve, users can protect themselves from potential digital assaults and ensure a secure and resilient future.
REFERENCES
1 Gilberto Gomes, Luis Dias, Miguel Correia, "CryingJackpot
Network Flows and Performance Counters against Cryptojacking", 2020 IEEE 19th International Symposium on Network Computing and Applications (NCA), pp.1-10, 2020.
2. Marius Musch, Christian Wressnegger, Martin Johns, Konrad Rieck; “Thieves in the
Browser: Web-based Cryptojacking in the Wild”, 2019.
3. Ashtha
Goyal, Priya Matta, "Cryptojacking: Detection and Prevention Techniques", 2023 9th International Conference on Smart Computing and Communications (ICSCC), pp.385-389, 2023.
4. Xiaoyan Hu, Boquan Lin, Guang Cheng, Ruidong Li, Hua Wu, "Detecting
Cryptomining Traffic Over an Encrypted Proxy Based on K-S Test", ICC 2023 - IEEE International Conference on Communications, pp.3787-3792, 2023.
5. Giorgio Di Tizio, Chan Nam Ngo, "Are You a Favorite Target For Cryptojacking? A
Case-Control Study On The Cryptojacking Ecosystem", 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pp.515-520, 2020.
6. Dmitry Tanana, "Behavior-Based Detection of Cryptojacking Malware", 2020 Ural
Symposium on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT), pp.0543-0545, 2020.
7. Peiran Wang, Yuqiang Sun, Cheng Huang, Yutong Du, Genpei Liang, Gang Long,
"MineDetector: JavaScript Browser-side Cryptomining Detection using Static Methods", 2021 IEEE 24th International Conference on Computational Science and Engineering (CSE), pp.87-93, 2021.
8 E. Tekiner, A. Acar, A. S. Uluagac, E. Kirda and A. A. Selcuk, "SoK
Cryptojacking Malware," 2021 IEEE European Symposium on Security and Privacy (EuroS&P), Vienna, Austria, 2021, pp. 120-139, doi: 10.1109/EuroSP51992.2021.00019.
9. A. Firdaus, G. S. AlDharhani, Z. Ismail and M. F. Ab Razak, "The Summer Heat of
Cryptojacking Season: Detecting Cryptojacking using Heatmap and Fuzzy," 2022 International Conference on Cyber Resilience (ICCR), Dubai, United Arab Emirates, 2022, pp. 1-5, doi: 10.1109/ICCR56254.2022.9995891.
10. D. Tanana, "Behavior-Based Detection of Cryptojacking Malware," 2020 Ural
Symposium on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT), Yekaterinburg, Russia, 2020, pp. 0543-0545, doi: 10.1109/USBEREIT48449.2020.9117732.
11. N. Lachtar, A. A. Elkhail, A. Bacha and H. Malik, "A Cross-Stack Approach Towards
Defending Against Cryptojacking," in IEEE Computer Architecture Letters, vol. 19, no. 2, pp. 126-129, 1 July-Dec. 2020, doi: 10.1109/LCA.2020.3017457.
12 S. Varlioglu, N. Elsayed, Z. ElSayed and M. Ozer, "The Dangerous Combo
Fileless Malware and Cryptojacking," SoutheastCon 2022, Mobile, AL, USA, 2022, pp. 125- 132, doi: 10.1109/SoutheastCon48659.2022.9764043.
13. Mubarak, “A Study on Cryptocurrency in India”, IJRAR 2021, Volume 8, Issue 1
14 Giudici, G., Milne, A. & Vinogradov, D. Cryptocurrencies
market analysis and perspectives. J. Ind. Bus. Econ. 47, 1–18 (2020). https://doi.org/10.1007/s40812-019- 00138-6
15. DeVries, Peter. (2016). An Analysis of Cryptocurrency, Bitcoin, and the Future.
International Journal of Business Management and Commerce. Vol. 1. Pages 1-9.
16. Morbale, Rohit & Patil, Bhushan & Nrip, Nripesh. (2022). Effect of Cryptocurrency on
Indian Economy -An Overview of Current Status and Future Prospects. 2663-4007. 10.5281/zenodo.6653926.
17. Shukla, Varun & Misra, Manoj & Chaturvedi, Atul. (2022). Journey of Cryptocurrency
in India In View of Financial Budget 2022-23.