MineSweeper: An In-depth Look into Drive-by Cryptocurrency Mining and Its Defense
MineSweeper: An In-depth Look into Drive-by Cryptocurrency Mining and Its Defense
复制标题
MineSweeper：深入研究路过式加密货币挖矿及其防御
DOI：
10.1145/3243734.3243858
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Vigna, Giovanni
中科院分区：
文献类型：
--
作者：
Konoth, Radhesh Krishnan;Vineti, Emanuele;Moonsamy, Veelasha;Lindorfer, Martina;Kruegel, Christopher;Bos, Herbert;Vigna, Giovanni
一波可以在没有专门硬件的情况下有效开采的替代硬币，以及加密货币市场价值的激增，导致了加密货币采矿（cryptomining）服务的发展，例如Cointerve，它可以很容易地集成到网站中，以货币化其访问者的计算能力。虽然合法的网站运营商正在探索这些服务作为广告的替代品，但它们也引起了网络犯罪分子的注意：驾车挖矿（也称为加密劫持）是一种新的基于网络的攻击，其中受感染的网站秘密执行用户浏览器中的JavaScript代码和/或WebAssembly模块，以在未经用户同意的情况下挖掘加密货币。在本文中，我们对Alexa的前100万个网站进行了全面分析，以了解这种攻击的流行程度和盈利能力。我们研究了受驾车挖矿影响的网站，以了解用于逃避检测的技术，以及用于有效挖掘加密货币的最新网络技术。我们的研究涵盖了28种被汽车挖矿网站广泛使用的类似Coalmove的服务，我们确定了20种活跃的加密挖矿活动。我们的研究结果的动机，我们调查可能的对策，对这种类型的攻击。我们讨论了目前的黑名单方法和基于CPU使用率的算法是不够的，并提出了扫雷，一种新的检测技术，是基于加密代码的固有特性，因此，是弹性混淆。我们的方法可以集成到浏览器中，以警告用户在访问未征求其同意的网站时进行无声加密。
A wave of alternative coins that can be effectively mined without specialized hardware, and a surge in cryptocurrencies' market value has led to the development of cryptocurrency mining ( cryptomining ) services, such as Coinhive, which can be easily integrated into websites to monetize the computational power of their visitors. While legitimate website operators are exploring these services as an alternative to advertisements, they have also drawn the attention of cybercriminals: drive-by mining (also known as cryptojacking ) is a new web-based attack, in which an infected website secretly executes JavaScript code and/or a WebAssembly module in the user's browser to mine cryptocurrencies without her consent. In this paper, we perform a comprehensive analysis on Alexa's Top 1 Million websites to shed light on the prevalence and profitability of this attack. We study the websites affected by drive-by mining to understand the techniques being used to evade detection, and the latest web technologies being exploited to efficiently mine cryptocurrency. As a result of our study, which covers 28 Coinhive-like services that are widely being used by drive-by mining websites, we identified 20 active cryptomining campaigns. Motivated by our findings, we investigate possible countermeasures against this type of attack. We discuss how current blacklisting approaches and heuristics based on CPU usage are insufficient, and present MineSweeper, a novel detection technique that is based on the intrinsic characteristics of cryptomining code, and, thus, is resilient to obfuscation. Our approach could be integrated into browsers to warn users about silent cryptomining when visiting websites that do not ask for their consent.
登录
查看更多内容
DOI：
10.1007/978-3-642-23644-0_3
发表时间：
2011-09
期刊：
--
影响因子：
--
作者：
Felix Gröbert;Carsten Willems;Thorsten Holz
通讯作者：
Felix Gröbert;Carsten Willems;Thorsten Holz
推动网络发展
影响因子：
3.1
作者：
Luke Wagner
通讯作者：
Luke Wagner
网络挖矿的真相：衡量作为网络货币化模型的加密货币矿工的盈利能力和成本
DOI：
10.1109/icccnt54827.2022.9984339
发表时间：
2018
期刊：
ArXiv
影响因子：
--
作者：
P. Papadopoulos;Panagiotis Ilia;E. Markatos
通讯作者：
E. Markatos
DOI：
10.1145/3243734.3243794
发表时间：
2018
期刊：
Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
影响因子：
--
作者：
Constanze Dietrich;Katharina Krombholz;Kevin Borgolte;T. Fiebig
通讯作者：
T. Fiebig
SEISMIC：用于中断 Cryptojack 的安全内联脚本监视器
DOI：
10.1007/978-3-319-98989-1_7
发表时间：
2018
期刊：
Proceedings of the 11th ACM Conference on Emerging Networking Experiments and Technologies
影响因子：
--
作者：
Wenhao Wang;Benjamin Ferrell;Xiaoyang Xu;Kevin W. Hamlen;S. Hao
通讯作者：
S. Hao