Cryptocurrency adds a new layer of complexity in the quest for secure internet operations.
These new digital currencies are created through complex calculations that require a lot of computing power. Cryptocurrency miners have created new ways to access that computing power for free – thanks to your company website.
This topic can be quite complicated, as there’s a lot of moving parts. We’re going to cover a brief introduction into what cryptocurrencies are and how they’re made, before drawing the link between them and the need for heightened browsing security in your business.
What are cryptocurrencies?
Bitcoin, monero, ethereum, dash – you’ve probably heard of at least one of these. Cryptocurrencies are an alternative form of currency that are independent, decentralised, secure, and largely anonymous. There’s no physical cash, they only exist digitally.
They’ve been in existence for less than 10 years, and while they remain out of the limelight for most, there is a growing interest in how the value of these currencies translate into real dollars and pounds for those who understand how to make the system work.
How are they generated?
Very briefly, digital currencies have the potential to be counterfeited like regular money. To keep the system honest, all transactions must be verified.
Miners can work to verify these transactions, which makes them eligible for payment. When a user has verified 1MB of transactions, they can then race to find a hexadecimal number that’s equal to, or below the randomly assigned number for that data set. The first user to offer an eligible code earns newly generated currency.
So, even if you do the work of confirming the transaction, you still must be the first to randomly generate this additional code. Generating the right hexadecimal number takes an incredible amount of computing power. Recently, there has been a shift toward a kind of outsourcing of this computing power, which leads us to the next point – cryptojacking.
What is cryptojacking?
Cryptocurrencies are being digitally minted every day. As we explained, the way to mint these new coins is incredibly complex, and to be efficient and profitable, it must be undertaken on a very large scale.
It takes a lot of computational power, and instead of purchasing hardware, the cryptocurrency miners have recently created a way to use another source of processing.
They are now mining currency by installing mining JavaScript on (often unsuspecting) websites. When a user visits the website, the scripts run silently in the background, effectively hijacking a portion of their computing power to generate those hexadecimal codes for as long as they’re viewing the page.
If there’s no malicious download and they aren’t after your data, why is it a problem?
This is the crux of the issue. Unless you’re looking for it, you’re unlikely to notice anything different in occurring (your computer may slow down fractionally but not enough to effect performance). The problem is that these scripts are being installed without the permission of website owners, and end users are not able to stop the websites from hijacking their CPUs.
If this happens on a large scale, it can take up a lot of power and even degrade hardware over time. Miners are harnessing someone else’s computing power, hardware, internet connection and electricity to run the calculations. It creates vulnerability because the scripts can crash, taking down websites with them.
The trouble for businesses is that someone needs to install that code into your website to begin with – if it happens without permission, it’s hacking. Some websites have engaged with their users, offering to allow this process instead of being forced to view traditional display advertisements. There are versions of the code that require authorisation of the process, but first code that was released operates automatically.
It’s also a problem because cryptocurrency mining are not the only malicious scripts that can be run in the background. Scripts can be used to deliver malware to computers or redirect traffic to other websites, or force ads to be displayed. These sorts of scripts can be very dangerous, for both businesses and website users. If your website is vulnerable to cryptocurrency miners, it’s vulnerable to hackers with more malicious intentions.
What does this mean for your business?
There are three ways to look at it. As a consumer of websites through your business network, it’s prudent to install ad blockers, and to add any websites with known mining scripts to your block list. This will save your resources being diverted. Some browsers also offer extensions that can detect infected sites and warn against them.
As a website owner, you need to be vigilant to ensure a miner hasn’t been maliciously installed into your website. If you’re unsure how to identify them, these sorts of scripts can be identified through professional security audits.
Remember that it effects the people who visit your site – your customers, and offers you no benefit. They run the risk of tying up your company computing resources, and if there are flaws in the mining scripts, there could be negative results for your website (crashes, data loss and security weaknesses).
As mining scripts are becoming better known, and sought out by cyber security teams, the risk is that script-based malware developers will create hacks that are even more difficult to detect.
The third way is that cryptocurrency mining could potentially become a revenue stream for your business. By replacing visual advertisements with almost imperceptible mining, it has the potential to change your website and income streams.
As the innovation is so recent, it’s very much a grey area, particularly around end user permissions and authorisations, so it will take some investigation on your part to determine if the time is right, or if it’s appropriate for your business.
Cryptojacking is a very new development in the still evolving landscape of digital currency. It will take some time for developers and interested parties to establish how to use currency mining to everyone’s benefit, and to develop methods of protection against those who seek to exploit unwilling participants for profit.
About EC-MSP, your cyber security services partner
EC-MSP are one of the most trusted IT support providers in London. If you would like more help advice and support establishing your cyber security protocols, or updating your current set-up, contact us today to see how we can help.
