Truth in Web Mining: Measuring the Profitability and the Imposed Overheads of Cryptojacking

Papadopoulos, Panagiotis; Ilia, Panagiotis; Markatos, Evangelos P.

doi:10.1007/978-3-030-30215-3_14

Cited by 13 publications

(11 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Cryptojacking Dataset Sample Type Focus of the Study [138] 2000 executable binary the practice of using compromised PCs to mine Bitcoin [139] 33282 websites script prevalence analysis [140] --how cybercriminals are exploiting cryptomining [65] 5190 websites script campaign and domain analysis [141] XMR-stak, cpuminer-multi binary attack impact on consumer devices and user annoyance [142] 5700 websites script static, dynamics and economic analysis [143] CoinHive cryptominer script sample characteristics and network traffic analysis [104] 1.2 million miners binary currencies, actors , campaign and earning analysis, underground markets [144] 107511 websites script profitability and the imposed overheads [15] 3.2 TB historical scan results script investigation of a new type of attack that exploits Internet infrastructure for cryptomining [145] --business model, threat sources, implications, mitigations, legality and ethics [146] 53 websites script sample characteristics [147] 2770 websites script activeness analysis [148] XMRig miner binary sample characteristics [135] 156 domains, 25892 proxies script impact on the web users also some new methods [150] proposed by researchers for better and more optimized blacklisting, but even dynamic blacklisting methods are not fully effective nor protective [151] against domain fluxing methods.…”

Section: Refmentioning

confidence: 99%

“…Table 4 shows cryptojacking malware analysis studies in the literature. In these studies, cryptominers are either in the format of binary [104], [138], [141], [148] or script [65], [135], [139], [142]- [144], [146], [147] except [140], [145] where the findings in these studies are based on the other studies and publicly available documents.…”

Section: Cryptojacking Analysis Studiesmentioning

confidence: 99%

“…In addition, the studies in [135], [141] performed the impact analysis. Particularly, [141] analyzed the attack impact on consumer devices and user annoyance, and [135] analyzed the impact of cryptojacking malware on web users, while [144] analyzed the overhead of cryptojacking samples. In an interesting study, the authors in [15] investigated a new type of attack exploiting the Internet infrastructure for cryptomining, which is indeed has an impact on 1.4M infected routers.…”

Section: Cryptojacking Analysis Studiesmentioning

confidence: 99%

“…Moreover, there are also studies performing the economic analysis of cryptojacking samples such as [104], [142], [144]. Other than that, the authors in [65], [104] performed a campaign analysis of the cryptojacking samples and [147] analyzed the activeness of cryptojacking threat after the discontinuation of Coinhive.…”

Section: Cryptojacking Analysis Studiesmentioning

confidence: 99%

See 3 more Smart Citations

SoK: Cryptojacking Malware

Tekiner

Acar

Uluagac

et al. 2021

2021 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

Emerging blockchain and cryptocurrency-based technologies are redefining the way we conduct business in cyberspace. Today, a myriad of blockchain and cryptocurrency systems, applications, and technologies are widely available to companies, end-users, and even malicious actors who want to exploit the computational resources of regular users through cryptojacking malware. Especially with ready-to-use mining scripts easily provided by service providers (e.g., Coinhive) and untraceable cryptocurrencies (e.g., Monero), cryptojacking malware has become an indispensable tool for attackers. Indeed, the banking industry, major commercial websites, government and military servers (e.g., US Dept. of Defense), online video sharing platforms (e.g., Youtube), gaming platforms (e.g., Nintendo), critical infrastructure resources (e.g., routers), and even recently widely popular remote video conferencing/meeting programs (e.g., Zoom during the Covid-19 pandemic) have all been the victims of powerful cryptojacking malware campaigns. Nonetheless, existing detection methods such as browser extensions that protect users with blacklist methods or antivirus programs with different analysis methods can only provide a partial panacea to this emerging cryptojacking issue as the attackers can easily bypass them by using obfuscation techniques or changing their domains or scripts frequently. Therefore, many studies in the literature proposed cryptojacking malware detection methods using various dynamic/behavioral features. However, the literature lacks a systemic study with a deep understanding of the emerging cryptojacking malware and a comprehensive review of studies in the literature. To fill this gap in the literature, in this SoK paper, we present a systematic overview of cryptojacking malware based on the information obtained from the combination of academic research papers, two large cryptojacking datasets of samples, and 45 major attack instances. Finally, we also present lessons learned and new research directions to help the research community in this emerging area.

show abstract

Section: Refmentioning

confidence: 99%

Section: Cryptojacking Analysis Studiesmentioning

confidence: 99%

Section: Cryptojacking Analysis Studiesmentioning

confidence: 99%

Section: Cryptojacking Analysis Studiesmentioning

confidence: 99%

See 2 more Smart Citations

SoK: Cryptojacking Malware

Tekiner

Acar

Uluagac

et al. 2021

2021 IEEE European Symposium on Security and Privacy (EuroS&P)

View full text Add to dashboard Cite

show abstract

“…Despite the various alternative monetization systems [1][2][3][4], there is no doubt that digital advertising is still the dominant way of funding the web. However, digital advertising has fundamental flaws, including market fragmentation [5,6], rampant fraud [7][8][9][10][11], centralization around intermediaries (e.g., Supply/Demand-side platforms, Ad exchanges, Data Management Platforms), who absorb half of spent advertising dollars [12], and cause unprecedented privacy harm by extensively track users [13][14][15].…”

Section: Introductionmentioning

confidence: 99%

THEMIS: A Decentralized Privacy-Preserving Ad Platform with Reporting Integrity

Pestana¹,

Querejeta-Azurmendi²,

Papadopoulos³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Online advertising fuels the (seemingly) free internet. However, although users can access most of the web services free of charge, they pay a heavy cost on their privacy. They are forced to trust third parties and intermediaries, who not only collect behavioral data but also absorb great amounts of ad revenues. Consequently, more and more users opt out from advertising by resorting to ad blockers, thus costing publishers millions of dollars in lost ad revenues. Albeit there are various privacy-preserving advertising proposals (e.g., Adnostic, Privad, Brave Ads) from both academia and industry, they all rely on centralized management that users have to blindly trust without being able to audit, while they also fail to guarantee the integrity of the performance analytics they provide to advertisers. In this paper, we design and deploy THEMIS, a novel, decentralized and privacy-by-design ad platform that requires zero trust by users. THEMIS (i) provides auditability to its participants, (ii) rewards users for viewing ads, and (iii) allows advertisers to verify the performance and billing reports of their ad campaigns. By leveraging smart contracts and zero-knowledge schemes, we implement a prototype of THEMIS and early performance evaluation results show that it can scale linearly on a multi-sidechain setup while it supports more than 51M users on a single-sidechain.

show abstract