Outguard: Detecting In-Browser Covert Cryptocurrency Mining in the Wild

Kharraz, Amin; Ma, Zane; Murley, Paul; Lever, Charles; Mason, Joshua; Miller, Andrew N.; Borisov, Nikita; Antonakakis, Manos; Bailey, Michael

doi:10.1145/3308558.3313665

Cited by 64 publications

(73 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…10 See Appendix C for details about other sources crawled. 11 For a detailed analysis, see Table XV from Appendix D. # campaigns with wallet addresses for: # samples seen in: Monero 2,449 Bitcoin 1,535 zCash 178 Electroneum 150 Ethereum 132 Aeon 57 Sumokoin 18 Intensecoin 8 Turtlecoin 3 Bytecoin 1 Year BTC XMR 2012 9 1 2013 23 3 2014 223 281 2015 Out of all the samples with wallets, we rely on the first seen value (obtained from the metadata of the samples provided by Virus Total) to analyse the evolution of number of samples mining Bitcoin and Monero. Rightmost side of Table IV shows the number of samples with wallets by year for the most prevalent cryptocurrencies, i.e.…”

Section: B Longitudinal Analysismentioning

confidence: 99%

See 1 more Smart Citation

A First Look at the Crypto-Mining Malware Ecosystem

Pastrana

Suárez-Tangil

2019

Proceedings of the Internet Measurement Conference

View full text Add to dashboard Cite

Illicit crypto-mining leverages resources stolen from victims to mine cryptocurrencies on behalf of criminals. While recent works have analyzed one side of this threat, i.e.: webbrowser cryptojacking, only commercial reports have partially covered binary-based crypto-mining malware.In this paper, we conduct the largest measurement of cryptomining malware to date, analyzing approximately 4.5 million malware samples (1.2 million malicious miners), over a period of twelve years from 2007 to 2019. Our analysis pipeline applies both static and dynamic analysis to extract information from the samples, such as wallet identifiers and mining pools. Together with OSINT data, this information is used to group samples into campaigns. We then analyze publicly-available payments sent to the wallets from mining-pools as a reward for mining, and estimate profits for the different campaigns. All this together is is done in a fully automated fashion, which enables us to leverage measurement-based findings of illicit crypto-mining at scale.Our profit analysis reveals campaigns with multi-million earnings, associating over 4.4% of Monero with illicit mining. We analyze the infrastructure related with the different campaigns, showing that a high proportion of this ecosystem is supported by underground economies such as Pay-Per-Install services. We also uncover novel techniques that allow criminals to run successful campaigns.

show abstract

Section: B Longitudinal Analysismentioning

confidence: 99%

“…This approach misses informed consent acquired by other means, such as images or additional documents. Thus, some works also look for AuthedMine scripts, which require explicit action from users to start mining [8], [11]. In our work, we rely on AV reports and other heuristics to classify binaries into malware or goodware.…”

Section: Related Workmentioning

confidence: 99%

A First Look at the Crypto-Mining Malware Ecosystem

Pastrana

Suárez-Tangil

2019

Proceedings of the Internet Measurement Conference

View full text Add to dashboard Cite

show abstract

“…This script runs in their browser in the background, exploiting their compute resources. There has been an 8500% increase in cryptojacking Web pages [40] and 0.06 -0.08% of the Alexa Top 1 Million sites have been shown to be delivering cryptojacking scripts [21], [37]. This is largely made possible by the popularization of new families of cryptocurrency (e.g., Monero coin [25]) that enable mining for coins without custom hardware.…”

Section: Introductionmentioning

confidence: 99%

“…To date, there has been much work highlighting the presence, economic impact, and obtrusiveness, of Web mining [14], [37], [38]. There has also been an influx of recent works that focus on extracting features, both static and dynamic, of miners to build models for determining cryptomining behavior on Web pages [21], [16], [23].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Browser-Based Deep Behavioral Detection of Web Cryptomining with CoinSpy

Kelton¹,

Balasubramanian²,

Raghavendra³

et al. 2020

Proceedings 2020 Workshop on Measurements, Attacks, and Defenses for the Web

View full text Add to dashboard Cite

Although the cryptocurrency hype over the past year may be seen by some as a benign social fad, to the Web community it is the center point for a series of ethically dubious ransomware attacks. Browser based cryptomining, or cryptojacking has gained widespread attention. Cryptojacking consists of Web servers delivering cryptocurrency mining scripts to clients, and using the client resources to play part in a distributed coin mining scheme. Although Web server operators defend the ethics of their involvement by quoting mining as a substitute for advertisement revenue, these scripts can hog massive amounts of client-side resources and can be delivered without client consent, presenting a high potential for abuse. Regardless of how ethical these campaigns are, what remains constant is the need for their detection. While there has been an array of work in defending against such cryptojacking campaigns, these defenses remain quite preliminary. We present CoinSpy, an entirely in-browser tool built using deep learning techniques for the detection of cryptomining activity within Web pages. A key challenge is that there is limited visibility into the client resource usage from within the browser sandbox. CoinSpy extracts several signals from information available from the browser and combines them using deep learning to build a powerful cryptojacking classifier. We argue why CoinSpy is the most robust defense against current and future cryptojacking attacks as compared to recent work, and show that it can detect various cryptojacking campaigns with 97% accuracy.

show abstract