Cryptocurrency Miner Hacks: How to Avoid Becoming Their Next Target?
With millions upon millions of computers connected to the Internet, conclusively saying which is the most prolific form of cyberattack out there is extremely difficult. Nevertheless, most security companies seem to agree that a few months ago, cryptocurrency miners overtook ransomware as the biggest threat.
Now, before we continue, we should point out that cryptocurrency mining could be a 100% legitimate operation. If you want to "dig out" a few digital coins, you can buy some powerful hardware, install the correct software, and wait for millions of completed calculations to fill up your wallet.
The thing is, powerful hardware consumes a lot of electricity, and you have to put all the costs into consideration before determining whether the venture will be profitable at all. Cybercriminals are not interested in any of that which is why they've found a way of using the PCs of innocent computer users to get coins without thinking about the wear and tear on the hardware or the electricity bill at the end of the month.
Table of Contents
How do cryptocurrency miners make their way to victims’ computers?
Social engineering is one of the most powerful weapons in the cybercrooks' arsenal. For years, they've been coming up with clever new ways of tricking users into launching executable files that turn out to be malicious. And they're still doing it with cryptocurrency miners.
The thing is, it's much easier to embed the miner into a website and use the PCs of people who visit it. In fact, it's the most widely used way of conducting illegal cryptocurrency mining, and it's extremely lucrative.
Indeed, the mining stops as soon as the victim closes the browser or navigates to a different website (provided the new website isn't infected as well, of course). If the host is popular enough (e.g., a news website that has a few thousand visitors at any given time), however, all that power can generate quite a few coins if it goes by undetected for long enough.
What sort of damage do miners cause?
From a user's perspective, it depends on the device. With mobile phones, the strain put on the hardware could be substantial enough to destroy the device. With PCs, such a devastating outcome is unlikely, but the mining operation will generate a lot of heat, cripple the performance, and it could shorten the lifespan of the CPU – the component that is most commonly used during this type of attack.
The damage a miner can cause to the website's reputation is extensive, though. Removing a miner that's been injected into, let's say, your blog, is easy. You just need to find the few lines of code that the crooks put in there and delete them. Restoring the blog's reputation is much harder. Your readers will know that your website has been hacked once, and they'll think that it could happen again. You're certainly better off trying to prevent the miner from appearing in the first place than cleaning up the mess later on.
How to protect my website from cryptocurrency miners (and other attacks)?
Attacks on websites could be extremely difficult to pull off. In some cases, the hackers need to exploit vulnerabilities in your web application. This requires a level of skill that not everybody can achieve, but surprisingly or not, shielding your website against this particular type of attack might not be that difficult.
Make sure that the web application you're using is up-to-date, and if your website is popular enough, think about investing in security solutions that will protect it against the bad guys. If you're making a living out of your website, it makes sense to ensure that it's as secure as it could be.
The security products might not be effective against the simpler attacks, though. To manage your website, you need to enter your admin panel or log in through FTP, SSH, or via other means. In other words, access to the backend depends on a few passwords. Hackers love cracking passwords, and they won't shy away from trying to get yours if they're motivated enough.
If your password is weak, they will have no problem doing all sorts of nasty things, including embedding a cryptocurrency miner. We've said it before, and we'll say it again – every single one of your passwords needs to be both complex and unique. Think about whether they are, and if the answer is "no," consider changing them.
Your website could be a very valuable asset if it isn't already. It makes no sense to leave it unprotected.
