Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

11/12/2018
09:35 AM
Dirk Morris
Dirk Morris
News Analysis-Security Now
50%
50%

Cryptojacking: Why SMBs Need to Stay on High Alert

Cryptojacking is one of the biggest threats circulating these days. While all businesses are at risk, SMBs are especially prone to these types of attacks. Here's how smaller firms can protect themselves.

Cryptojacking, which is how many people refer to an array of cryptomining malware, continues to make headlines as one of the biggest security attacks happening today. And it's only getting worse.

However, while cryptojacking is a growing threat for businesses of all sizes, small and midsized businesses (SMBs) are increasingly becoming targets. While cryptomining may seem relatively innocuous compared to other cybersecurity threats, it can rack up significant computing costs. This is specifically detrimental to SMBs that have few IT resources or funds to spare. (See Majority of Cyber Attacks Against Small Businesses Can Cost $500K.)

Several studies have found that most malware attacks today are intended for cryptojacking, which involves infecting systems with malicious code that uses CPUs to mine for cryptocurrency. Mining involves the solving of complex computational challenges that validate cryptocurrency system transactions, adding them to the cryptocurrency's blockchain. (See Blockchain & Cryptocurrency Becoming Greater Security Concerns.)

In return, miners may obtain cryptocurrency back as a reward. Cryptomining can go undetected while continuing to use resources in the background.

How it works
Hackers often use links in emails or other phishing tactics to load cryptomining code onto computers, working in the background while unsuspecting users are watching what's happening on the screen. One of the unique problems to cryptojacking malware is that, unlike ransomware, it does not want to make its presence known.

Instead, it aims to silently mine cryptocurrency using your processing power for months.

Typically, rootkits are installed to maintain access, and the compromised hosts are controlled by a central server. This leaves the exploited device vulnerable, sometimes by more than just the original attacker, for long periods of time.

Cryptomining utilizes computing resources to create blocks that are traded for cryptocurrency. Since cryptomining requires costly computing resources, cybercriminals will try to breach business networks to use their computing resources instead of their own. However, systems running high CPU loads can rack up costs to a business and could lead to bricking or destroying the end device, if the mining malware is especially aggressive. (See Cryptomining: Paying the Price for Cryptocurrency.)

Why SMBs are at risk
SMB employees are often not trained on the latest cybersecurity threats and may not realize why their PCs or servers are slowing down from a drive-by cryptojacking attack. It is crucial that SMBs realize the potential impact that cryptojacking can have on their businesses and take measures to protect their precious resources.

What makes SMBs vulnerable to cryptojacking? Here are a few examples:

  • Lack of IT personnel to identify a breach or lack of visibility on the network
  • Out-of-date network security solutions that may not stop hackers or identify threats
  • Network security solutions do not proactively block new and emerging threats
  • Computing costs from cryptomining could be astronomical, causing possible financial ruin
  • Running computing resources on high could ruin or destroy devices
  • Lack of employee training to understand what a threat and breach looks like

Protecting SMBs
Not sure how to protect your business? It doesn't need to be overwhelming. By regularly monitoring and updating your networks, you can do a world of good.

Here are a few steps you can take to arm yourself against cryptojackers:

  • Monitor the network for any threats or unusual activity
  • Utilize virus blocking and website filtering with URL categorization that includes cryptocurrency, blockchain and other cryptomining categories
  • Implement web filtering, ad blocking and spam blocking solutions for basic defense features to protect businesses from rogue websites, ads and spam emails
  • Train employees on emerging threats and how to identify a hacker's attempt to gain access to their system
  • Inspect file downloads for malicious files in emails or links
  • Invest in a unified threat management solution (UTM) that provides a simplified approach to network security, including firewalls, intrusion detection/prevention, web filtering and more for small and midsized businesses with limited IT resources

Next steps
Vigilance is key when it comes to combating cyber threats. If you don't have a cybersecurity expert in your organization, finding the time and resources to properly monitor your network and protect against threats may feel overwhelming, but it is imperative. You may consider distributing security responsibilities among employees and connecting for regular meetings to share information.

It's also essential that you continue to update training for all employees to make certain that you are covering the latest protocols for new threats. Ensuring that you are using tools that are frequently updated, and unifying your security solution to streamline efforts, will also help you to have a more seamless security strategy.

If you still feel uncertain about your ability to manage security threats, consider utilizing a managed services provider or hiring a consultant to come in periodically and assess potential weak spots in your organization, train employees and update security measures.

If you take these steps, you should be fairly well-armed against cryptojackers, as well as other security threats.

Related posts:

Dirk Morris is the Founder and Chief Product Officer of Untangle. Prior to Untangle, Morris was Chief Architect at Akheron Technologies, where he invented the patent-pending High Bandwidth Transparent Vectoring used in the company's proxy firewall engine. He earned a Bachelor's degree in Computer Science with a minor in Mathematics from Carnegie Mellon University.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Malware Attacks Declined But Became More Evasive in Q2
Jai Vijayan, Contributing Writer,  9/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15216
PUBLISHED: 2020-09-29
In goxmldsig (XML Digital Signatures implemented in pure Go) before version 1.1.0, with a carefully crafted XML file, an attacker can completely bypass signature validation and pass off an altered file as a signed one. A patch is available, all users of goxmldsig should upgrade to at least revisio...
CVE-2020-4607
PUBLISHED: 2020-09-29
IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security restrictions due to improper input validation. IBM X-Force ID: 184884.
CVE-2020-24565
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25770
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...
CVE-2020-25771
PUBLISHED: 2020-09-29
An out-of-bounds read information disclosure vulnerabilities in Trend Micro Apex One may allow a local attacker to disclose sensitive information to an unprivileged account on vulnerable installations of the product. An attacker must first obtain the ability to execute low-privileged code on the ...