Market cap: $102,358,789,088 / 24h Vol: $9,635,975,331 / BTC Dominance: 55.0953%
Cryptocurrencies: 2073 / Markets: 16063

How to Protect Your PC from Unsuspected Mining

Incidents of using computers of unsuspecting users to mine cryptocurrency is increasing in frequency. In the recent months, we saw the following instances:

  • In January 2018, Google’s DoubleClick, the popular ad serving service on the Internet, was targeted by miner code designed to mine cryptocurrency Monero. The attacks were noticed between 18th and 24th January, affecting users of DoubleClick in Japan, France, Taiwan, Italy and Spain.

  • On December 2nd 2017, an American, Noah Dinkin, had visited a Starbucks coffee shop in Buenos Aires, during his visit to Argentina. When he tried to connect his laptop to the wifi in the store, he experienced a 10 seconds delay. Upon inspection he found that a cryptocurrency miner code was running in his laptop. This miner code was also for Monero.

  • Earlier, a player of the popular online game Fortnite had distributed Bitcoin mining code to other players without them knowing.

Mining cryptocurrency using computers of unsuspecting users, and how to prevent it:

To understand this unethical practice, we first need to understand cryptocurrency mining at a deeper level. Cryptocurrencies are built on blockchain technology. Blockchain is a distributed database, where every node, i.e. computer connected to the network, has the latest and entire information of the blockchain. Every node is equal point of authority, and an update to the blockchain doesn’t need to be routed through any central authority. In this distributed database, two or more block records, also called ‘blocks’, are linked together by a predetermined protocol. Existing blocks can’t be deleted, or updated, and the only way a blockchain can be updated is by adding a new block. “Mining” or “Minting” a coin of a cryptocurrency requires a block to be added into the underlying blockchain. A “Miner” is a combination of powerful hardware, specially designed powerful software, and their user. The term is also interchangeably used for the user and the mining code. Since the miners gets a fraction of the cryptocurrency when they successfully mine it, mining is a very competitive endeavour.

Mining essentially requires solving a cryptographic puzzle. The miner first creates a “hash”, i.e. a seemingly random sequence of letters and numbers encapsulating the information within the block. The hash is stored along with this block at the end of the blockchain. To create a new block, the transaction data for that block is needed to create the hash, but that’s not all. The miner also needs the hash for the last recorded block in the blockchain. This is a massive number-crunching operation. Since blockchain is a decentralized system, establishing the correct order of transactions is critical for data integrity.

All blockchains use some form of consensus algorithm for this. Blockchains underlying cryptocurrencies typically use consensus algorithms that require evidence of such massive number-crunching, which is also called proof of work (POW). The speed at which the computer completes this massive number-crunching is called “hash rate”. Remember this is an intensely competitive environment, hence, the higher the hash rate is, the more chance the miner has, to mint a new coin.

Miners use specially designed software to achieve high hash rate. Since the software is so powerful, the hardware has to be powerful enough to support it, and many miners user Graphics Processing Units (GPUs) along with the Central Processing Unit (CPU) of their computer. To sum it, the more computing power you can muster, the higher is your chance of success as a miner.

We also need to take a close look at the economics of cryptocurrency mining. The early adopters had achieved good return on investment (RoI), however, the environment has become very competitive since then, resulting into diminishing RoI. Also, cryptocurrencies are mathematical money, not backed by tangible assets, and their supply is not unlimited. Cryptocurrencies have a cap on the total number of coins allowed, for e.g. 21 million for Bitcoin. This cap, along with basic demand-supply equation of economics, point to further diminishing RoI of cryptocurrency mining. For unethical miners, these are sufficient drivers to grab hold of any computing power anywhere for cryptocurrency mining, even without the consent of their users.

How to block JavaScript Cryptocurrency Miners?

Unethical cryptocurrency miners typically use JavaScripts to distribute miner code to unsuspecting users. The user would browse a seemingly normal website, and in the process a JavaScript will run in her computer without her knowledge, and hijack majority of the computing powers, even to the range of 80%, to mine cryptocurrency. Some miner scripts may even connect the computer, again without the user’s knowledge, to a private mining pool. CoinHive is a service that lets the website owners to house cryptocurrency miner scripts in their website. When unsuspecting visitors browse the website, without her knowledge the script takes over majority of her computing resources for cryptocurrency mining. Incidentally, CoinHive was the culprit in the attack on Google’s DoubleClick, as well as the Buenos Aires Starbucks incident.

Remember we discussed about the mining software being very powerful? If the user’s computer is not powerful enough to support cryptocurrency mining, it will become inordinately slow, and might even be damaged. This form of surreptitious cryptocurrency mining is not only unethical, it can be really damaging for the unsuspecting user. Not all of us are tech-savvy like Noah Dinkin, who was able to identify that a cryptocurrency miner is running in his laptop in that Buenos Aires Starbucks shop. Some of us may not even know what damaged our computer.

Communities and businesses have to collectively stand up to this unethical practice, and thankfully, that’s happening. Preventing this creepy cryptocurrency mining requires response at multiple levels, i.e. technical, legal and increasing awareness. Communities and businesses are stepping up to the challenge, for e.g.:

  • The cyber security solutions company Trend Micro, which had reported the attack on Google’s DoubleClick, has strongly advised the users to regularly update and patch their software.

  • Epic Games had sued the player that distributed the Bitcoin mining code to the other players of the Fortnite game.

  • Malwarebytes, the maker of anti-malware software, has banned CoinHive.

While some experts have recommended disabling JavaScripts, the viability of this is doubtful, since many websites use JavaScript for perfectly legitimate reasons, and disabling JavaScripts can impact functionality adversely.