Dine and Dash: Static, Dynamic, and Economic Analysis of In-Browser Cryptojacking

Abstract

Cryptojacking is the permissionless use of a target device to covertly mine cryptocurrencies. With cryptojacking, attackers use malicious JavaScript codes to force web browsers into solving proof-of-work puzzles, thus making money by exploiting the resources of the website visitors. To understand and counter such attacks, we systematically analyze the static, dynamic, and economic aspects of in-browser cryptojacking. For static analysis, we perform content, currency, and code-based categorization of cryptojacking samples to 1) measure their distribution across websites, 2) highlight their platform affinities, and 3) study their code complexities. We apply machine learning techniques to distinguish cryptojacking scripts from benign and malicious JavaScript samples with 100% accuracy. For dynamic analysis, we analyze the effect of cryptojacking on critical system resources, such as CPU and battery usage. We also perform web browser fingerprinting to analyze the information exchange between the victim node and the dropzone cryptojacking server. We also build an analytical model to empirically evaluate the feasibility of cryptojacking as an alternative to online advertisement. Our results show a sizeable negative profit and loss gap, indicating that the model is economically infeasible. Finally, leveraging insights from our analyses, we build countermeasures for in-browser cryptojacking that improve the existing remedies.

Browser-Based Deep Behavioral Detection of Web Cryptomining with CoinSpy

“…from NoCoin [20]. However the size of this dataset is small, only ∼150 domains many of which are simply WebSocket proxy servers for PoW communications that can also be used by benign pages [38]. While the recent work of Outguard [21] does provide a list of domains they found to be participating in cryptojacking, we found that many of these are no longer participating in mining, or simply no longer exist.…”

“…To increase the rate of PoW completions at the client, the miners typically spawn threads from the browser environment, known as WebWorkers [46]. The Web miner's servers, which actually manage the interactions with the blockchain, are often found from a rotating list of proxy servers as to avoid client-side blacklisting [21], [38]. The Web miner pays the Web server a cut of the cryptocurrency for any blocks successfully mined by the client (or a just fixed payout per compute cycles), similar in fashion to a finder's fee.…”

“…Antivirus software such as Symmantec also detect cryptomining using a static signature. The problem is that static code signatures and pattern matching can be evaded, and such evasion techniques are already being deployed by cryptominers [16], [38].…”

“…Another closely related work [38], supplements their static analyses, based on code length and complexity of cryptomining scripts, by providing a first look at how behavioral features change for sites under cryptomining. While they do not provide an explicit behavioral detector and accuracy metrics, they observe the changes in CPU Usage, Web Socket packet sizes, and browser power consumption.…”

“…To date, there has been much work highlighting the presence, economic impact, and obtrusiveness, of Web mining [14], [37], [38]. There has also been an influx of recent works that focus on extracting features, both static and dynamic, of miners to build models for determining cryptomining behavior on Web pages [21], [16], [23].…”