What is cryptojacking and how does it work?

Mining cryptocurrencies through the equipment of users without their consent is known as cryptojacking.

This concept comes from the words “crypto” (cryptography) and “hijacking”. In computer science, these concepts aren’t new since they refer to the activity in which an attacker steals or takes over something. In this case, the attackers take advantage of the computational power of the victim’s device to mine cryptocurrencies.

According to the latest report published by Fortinet, during the first quarter of 2018, cryptojacking increased + 15% compared to the same period of the previous year, occupying 28% of the malware used for cyber attacks.

In fact, the data varies depending on which reports you check, but what is clear is that cryptojacking is an increasingly recurrent practice in cyber crime.

Cryptojacking is carried out in different ways. The most popular is through the installation of some type of malware on the victim’s computer, but this is not always the case. The mining of cryptocurrencies can also be carried out without installing any software and through the browser.

When it is mined through the browser, the web page that is visited executes a JavaScript code by which it is mined in the background. “Coinhive” is one of the best known scripts for allowing the mining of Monero.

When the code is executed, the demand of the processor (CPU) is triggered and the equipment starts to slow down. At the end of 2017, a team of developers released an algorithm update (XMR-STAK) that would allow the possibility of mining Monero through graphics cards (GPU).

Monero, the official crypto-currency cryptocurrency

Monero (XMR) is a cryptocurrency that uses the CryptoNote protocol. Unlike other protocols such as Bitcoin, with CryptoNote the privacy of the transaction is 100%, which means that the sender, receiver and the number of transferred tokens are unknown, except for the parties involved.

For that reason, Monero is used on the DarkWeb as a form of payment, so it has a bad reputation for being a method of financing for cybercrime.

Monero is also virtually infinite. It means that this cryptocurrency can always be mined because miners will always obtain their reward. This doesn’t happen with other cryptocurrencies such as Bitcoin, which is estimated to end in 2140, when the limit of 21 million Bitcoins is reached.

How to know that you are mining cryptocurrencies with your browser

As pointed out by the Fortinet report, cryptojacking is classified as another form of malware. Normally, we suspect that a device might be infected with a virus when it starts to run slow or gets hot because the ventilation go off.

Both are clear indications that you could be a victim of cryptojacking. There is a simple way to check it.

As explained on the website of The Cryptographer, if you suspect that you are facing an infected page, just press Ctrl + U to display the source HTML or XML of the web. You can also click on the right button of the mouse and select “View source code” or press Cmd + U if you are on OS X.

Then press Ctrl + F to search for “Coinhive” and if it appears in the code, then it is because that web executes a script to mine cryptocurrencies.

However, we must remember that there are other mining scripts that are also popular as Cryptoloot, Roughted or Firewall, according to the analysis done in 2018 of Checkpoint.

The same cybersecurity firm says in its report that the crypto industry affects 55% of worldwide companies. However, the report also affirms that it is a “legal and legitimate” activity that many pages use to generate an extra income due to the cut of advertising on some websites.

The problem arises when the mining tools use more than 65% of the computational power of the devices from users who aren’t aware of it.

Can we avoid cryptojacking of our equipment without our consent? In principle, yes.

How to avoid cryptojacking or malware for mining cryptocurrencies

The recommendations for avoiding our equipment through cryptojacking are not far from those that you need to carry out when it comes to preventing infections in the devices.

• Install an extension that blocks the encryption in your browser. In the same way that there are ad blockers, Chrome extensions like NoCoin or MinerBlock for Chrome can prevent cryptojacking.
• Use antiviruses that detect the cryptocurrency mining. There is more protection software that incorporates this possibility, although it must be kept constantly updated since the mining techniques change to avoid detection.
• Take a look at the “task manager” of your Windows or Mac. From there, you can see how much CPU is being consumed. If the value is too high, there may be a tab that is being mined. Try closing some to see if that consumption decreases.