Mitigation of Cryptojacking Attacks Using Taint Analysis

Yulianto, Arief Dwi; Sukarno, Parman; Warrdana, Aulia Arif; Makky, Muhammad Al

doi:10.1109/icitisee48480.2019.9003742

Cited by 13 publications

(11 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A majority of the detection mechanisms do not focus on preventing or interrupting of cryptojacking malware; however, there are still several studies [116], [122], [123] focusing on both the detection and prevention of cryptojacking malware. Using dynamic features to detect ongoing cryptojacking is like other dynamic analysis studies, but their prevention methods vary.…”

Section: Cryptojacking Prevention Studiesmentioning

confidence: 99%

See 1 more Smart Citation

SoK: Cryptojacking Malware

Tekiner

Acar

Uluagac

et al. 2021

2021 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

Emerging blockchain and cryptocurrency-based technologies are redefining the way we conduct business in cyberspace. Today, a myriad of blockchain and cryptocurrency systems, applications, and technologies are widely available to companies, end-users, and even malicious actors who want to exploit the computational resources of regular users through cryptojacking malware. Especially with ready-to-use mining scripts easily provided by service providers (e.g., Coinhive) and untraceable cryptocurrencies (e.g., Monero), cryptojacking malware has become an indispensable tool for attackers. Indeed, the banking industry, major commercial websites, government and military servers (e.g., US Dept. of Defense), online video sharing platforms (e.g., Youtube), gaming platforms (e.g., Nintendo), critical infrastructure resources (e.g., routers), and even recently widely popular remote video conferencing/meeting programs (e.g., Zoom during the Covid-19 pandemic) have all been the victims of powerful cryptojacking malware campaigns. Nonetheless, existing detection methods such as browser extensions that protect users with blacklist methods or antivirus programs with different analysis methods can only provide a partial panacea to this emerging cryptojacking issue as the attackers can easily bypass them by using obfuscation techniques or changing their domains or scripts frequently. Therefore, many studies in the literature proposed cryptojacking malware detection methods using various dynamic/behavioral features. However, the literature lacks a systemic study with a deep understanding of the emerging cryptojacking malware and a comprehensive review of studies in the literature. To fill this gap in the literature, in this SoK paper, we present a systematic overview of cryptojacking malware based on the information obtained from the combination of academic research papers, two large cryptojacking datasets of samples, and 45 major attack instances. Finally, we also present lessons learned and new research directions to help the research community in this emerging area.

show abstract

Section: Cryptojacking Prevention Studiesmentioning

confidence: 99%

“…Using dynamic features to detect ongoing cryptojacking is like other dynamic analysis studies, but their prevention methods vary. While Yulianto et al [122] only raises a notification, Bian et al [116] sleep the mining process, and Razali et al [123] directly kill the related process.…”

Section: Cryptojacking Prevention Studiesmentioning

confidence: 99%

SoK: Cryptojacking Malware

Tekiner

Acar

Uluagac

et al. 2021

2021 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

show abstract

“…All blocks contained in the blockchain are connected with different or unique hashes and nonce. The node spreads decentralized, then the blocks in the node cannot be changed and can be verified by many parties [2,17]. Blockchain uses many nodes scattered in the network, so that the number of nodes scattered will complicate the attacker in the breach of the system.…”

Section: Blockchainmentioning

confidence: 99%

“…Blockchain uses many nodes scattered in the network, so that the number of nodes scattered will complicate the attacker in the breach of the system. One of the uniqueness of blockchain technology is the existence of mining which is called a miner if succeeds in solving a mathematical problem it will get a coin [17].…”

Section: Blockchainmentioning

confidence: 99%

Electronic document authenticity verification of diploma and transcript using smart contract on Ethereum blockchain

Chaniago

Sukarno

Wardana

2021

regist. j. ilm. teknol. sist. inf.

Self Cite

View full text Add to dashboard Cite

Ethereum is one of the oldest examples of blockchain technology provides a system that converts centralized storage to distributed and records transactions by way of decentralized and not by a centralized system and can be verified by each node, therefore it is suitable for storing fingerprints from official diploma documents and transcripts that are published. Smart contract is needed for making contract transactions to Ethereum with programming code, so contracts such as diplomas and transcripts uploaded on the Ethereum blockchain can distribute and produce diploma validation and the authenticity of transcripts with transaction hash, consensus, and comply with ERC-721 token standardization. The results showed that a sample of 5 electronic documents in pdf format with a transaction speed of 1 second on each file that were published and secured with Ethereum blockchain technology can be easily verified for authenticity, the system proposed and developed by us takes in consideration invalid and failure cases by giving the necessary feedback to the user.

show abstract

“…Hackers who succeed in getting the user passwords from one platform can also stole the user data on another platforms. Therefore, password-based authentication cannot accommodate the security and confidentiality of account data [8,9,10].…”

Section: Introductionmentioning

confidence: 99%

Two factor authentication framework based on ethereum blockchain with dApp as token generation system instead of third-party on web application

Putri

Sukarno

Wardana

2020

register. jurnal. ilm. teknologi. sistem. inf.

Self Cite

View full text Add to dashboard Cite

Authentication is a method for securing an account by verifying the user identity by inputting email with a password. Two factor authentications is an authentication system that combines the first-factor authentication with the second factor. General two factor authentication by entering an email or username with a password are similar. However, two factor authentication requires additional information that must be inputted by the user. Additional information can be in the form of tokens or one-time passwords (OTP). Two factor authentications generally still uses third-party services to generate token or OTP still have vulnerable because can attacked from tokens steal through MITM and found that the generated tokens with the same value. Therefore, we propose a two-factor authentication framework based on ethereum blockchain with dApp as token generation system. Firstly, outcome from the analysis of the system, next succeeded in creating a two-factor authentication system without using third-parties. Second, token system generate up to 3164 different tokens in one second and has been collisions tested. Third, security method to protect token from MITM attack. The attacker unable to get access caused all the checking are done by dApp user authentication.

show abstract

Mitigation of Cryptojacking Attacks Using Taint Analysis

Cited by 13 publications

References 13 publications

SoK: Cryptojacking Malware

SoK: Cryptojacking Malware

Electronic document authenticity verification of diploma and transcript using smart contract on Ethereum blockchain

Two factor authentication framework based on ethereum blockchain with dApp as token generation system instead of third-party on web application

Contact Info

Product

Resources

About