MineSweeper

Abstract

A wave of alternative coins that can be effectively mined without specialized hardware, and a surge in cryptocurrencies' market value has led to the development of cryptocurrency mining (cryptomining) services, such as Coinhive, which can be easily integrated into websites to monetize the computational power of their visitors. While legitimate website operators are exploring these services as an alternative to advertisements, they have also drawn the attention of cybercriminals: drive-by mining (also known as cryptojacking) is a new web-based attack, in which an infected website secretly executes JavaScript code and/or a WebAssembly module in the user's browser to mine cryptocurrencies without her consent. In this paper, we perform a comprehensive analysis on Alexa's Top 1 Million websites to shed light on the prevalence and profitability of this attack. We study the websites affected by drive-by mining to understand the techniques being used to evade detection, and the latest web technologies being exploited to efficiently mine cryptocurrency. As a result of our study, which covers 28 Coinhive-like services that are widely being used by drive-by mining websites, we identified 20 active cryptomining campaigns. Motivated by our findings, we investigate possible countermeasures against this type of attack. We discuss how current blacklisting approaches and heuristics based on CPU usage are insufficient, and present MineSweeper, a novel detection technique that is based on the intrinsic characteristics of cryptomining code, and, thus, is resilient to obfuscation. Our approach could be integrated into browsers to warn users about silent cryptomining when visiting websites that do not ask for their consent. CCS CONCEPTS • Security and privacy → Browser security; Malware and its mitigation; • Social and professional topics → Computer crime;

Detection of illicit cryptomining using network metadata

“…A similar study has addressed the clandestine ecosystem of malicious Monero mining binaries [20]. Other longitudinal studies addressed in-browser cryptojacking, most prominently MineSweeper [28], presenting a new detection technique using static JavaScript analysis and monitoring CPU cache events during Web-Assembly execution. An analysis of Alexa's top 1 million sites provided insights into campaigns' earning estimates, distribution networks, pools, proxies and services.…”

“…Previous longitudinal studies investigated the distribution of well-known cryptomining services in web pages [25,28,27]. Our collection included the top 3: Coinhive, CoinIMP [109], and CryptoLoot [22].…”

“…Section 3. The majority of previous work focused on understanding and assessing profitability of in-browser mining [24,25,26,27]; other work discussed its detection and mitigation [28,29,30,31]. Much less attention has been paid to binary-based cryptomining, comprising essentially the early investigation of Bitcoin mining botnets [32] and the comprehensive study of Monero mining malware [20].…”

Introdução às tecnologias dos blockchains e das criptomoedas

“…Utilizar todo o poder computacional dos usuários pode prejudicar as suas experiências ao navegar na própria página, impactando negativamente na sua popularidade. No entanto, atacantes podem bene ciar-se economicamente de ataques de in-browser cryptojacking ao infectar páginas que oferecem entretenimento e conteúdo envolvendo pirataria, pois usuários passam mais tempo procurando por recursos nessa categoria de páginas Konoth et al (2018), Hong et al (2018).…”

Untitled

“…• Ponzi schemes (Vasek & Moore, 2015;Esoimeme, 2018;Bartoletti, Pes, & Serusi, 2018;Zhang, Kang, Dai, Chen, & Zhu, 2021;Wang, Cheng, Zheng, Yang, & Zhu, 2021); • money laundering (Levin, O'Brien, & Zuberi, 2015;Rivera, 2019;Hendrickson & Luther, 2022;Bartoletti et al, 2018;Barth, Herath, & Xu, 2020;Broadhead, 2018;van Wegberg, Oerlemans, & van Deventer, 2018;Dupuis & Gleason, 2021;Wronka, 2022); • mining botnets (Huang et al, 2014;Konoth et al, 2018) and the theft of "brainwallets" (Vasek, Bonneau, Castellucci, Keith, & Moore, 2016).…”