The popularity of cryptocurrency is at an all-time high. However, many are jumping onto the bandwagon without understanding how it works. While the inventor of Bitcoin, Satoshi Nakamoto, never intended to invent a currency, what we know is that cryptocurrency emerged as a byproduct of the blockchain technology. The decentralized nature of it has become an inciting idea to many. Furthermore, as the value of some of the biggest cryptocurrencies rise (e.g., Bitcoin is currently valued at approximately $9,100), many are scrounging to invest in cryptocurrency. It’s to no surprise that many hackers and cryptocurrency enthusiasts are finding creative ways to “mine” for cryptocurrency. Here are some of the known methods:
Supercomputers
Mining for cryptocurrency requires a lot of computing power. Supercomputers are perfect for the task, but they have their limitations. For one, they are extremely expensive, so it’s unlikely the average person could afford or even build one. Recently, engineers from the All-Russian Research Institute of Experimental Physics (RFNC-VNIIEF) were arrested for mining Bitcoin cryptocurrency using the institution’s computers, which actually belong to a secret federal nuclear facility in Russia. The supercomputer is said to be capable of performing quadrillion operations within a second. The perpetrators were caught when attempting to connect the computers to the internet, an act that violated the institution’s policies.
Smartphones
Another new trend involves using a combination of malvertising and smartphones’ CPU (Central Processing Unit) to carry out cryptomining campaigns. One recently-discovered campaign targeted Android devices using “drive-mining techniques,” which is best understood as an automated process for exploiting the CPU’s power. In the campaign, unsuspecting users were redirected to malicious sites after visitors were asked to solve a CAPTCHA, claiming suspicious behavior was detected on their devices. In reality, when users solved the CAPTCHA and clicked continue, their smartphones started mining for cryptocurrency, using 100% of the phone’s CPU power. Millions of Android devices are believed to have been used in this cryptomining campaign to mine Monero coins, a popular open-source cryptocurrency.
Advertising Screens
As previously mentioned, a large amount of CPU is required when mining cryptocurrency, making the process extremely costly. Some hackers have thus turned to using the CPU power of computer systems that don’t belong to them. In one such case, hackers used cryptomining code issued by NiceHash, the world’s largest cryptocurrency mining marketplace. NiceHash provides cryptocurrency mining codes to create software for embedding in websites, which is what the hackers did. It then hijacked the CPU power of website users to mine for Bitcoin. Fortunately, the computer systems infiltrated for the cryptomining campaigns were used to project advertisements, so hackers were caught before reaping any real benefits.
Malware/Google Ads
Malware is one way hackers can reach unsuspecting victims. The concept of using Google ads for malicious schemes is not entirely new. A recently-exposed scam was reported to have claimed new victims. Hackers bought ad space using Google’s AdWords and redirected users to malicious sites. Users who searched for Bitcoin related search terms would see the malicious ads and upon clicking on the spoofed ones, they were tricked into logging into their wallets. The spoofed sites served to steal login credentials of users’ cryptocurrency wallets and ultimately gain access to cryptocurrency. In this scam, hackers were able to elicit $50 million in cryptocurrency — but not all in one go. The campaigns spanned over the course of several months before it was exposed.
MS Word
Besides malware, hackers are also diverting their attention to Microsoft Word documents that contain executable programs known as macros. In a recent scam, phishing emails posing as a Hong Kong-based job recruitment firm posted a job announcement. Applicants were sent emails containing a Dropbox link with a malicious Microsoft Word file, which once clicked and enabled, infected the device with a malicious macro that scanned for cryptocurrency wallets. It also established an “implant for long-term data-gathering.” Because hackers now had a pool of registered computers with known wallets, they were able to make other scams like phishing even more personalized.
Mining for cryptocurrency is becoming more lucrative with many “miners” competing with one another. At the same time, another trend has been on the rise in which miners are joining forces to maximize their payouts. Known as mining pools, they consist of miners working together to mine for cryptocurrency and share the rewards. To stay ahead, it’s no wonder hackers are finding new ways to mine or steal others’ cryptocurrency in less-than-honest ways. Curious to find out what other trends are popular in the hacker community? Make sure to check back on our blog!