Crypto Mining Threats and Prevention

1©2018 Check Point Software Technologies Ltd.©2018 Check Point Software Technologies Ltd.
Elier Cruz | Global Enterprise Security Architect
CRYPTO MINING, A THREAT
IMPACTING THE BUSINESSES
What is it? How to prevent?

2©2018 Check Point Software Technologies Ltd.
The Global Risks Report 2018

So, which is it?

Weekly Mining Attacks Detected by ThreatCloud
0
1,000,000
2,000,000
3,000,000
4,000,000
5,000,000
6,000,000
7,000,000
8,000,000
9,000,000
6-Aug-17 6-Sep-17 6-Oct-17 6-Nov-17 6-Dec-17 6-Jan-18 6-Feb-18
Nov-28:
Bitcoin crosses $10K

It’s everywhere
55% of organizations attacked in December

©2018 Check Point Software Technologies Ltd.
20M USD STOLEN IN THE
MEXICAN FINANCIAL
SYSTEM..... REALLY?!

THE CRYPTO-CURRENCY MINING INDUSTRY

ADD TRANSACTIONS INTO A CRYPTO-CURRENCY PUBLIC LEDGER
What is crypto mining?
SOLVE A PUZZLE GET A REWARD

SHOW ME THE MONEY
BITCOIN
MINING
REWARD
12.5 BTC
Every 10 minutes
$98,225.00=
Every 10 minutes=
ANNUAL MINING REVENUE$5.4B
and that’s just bitcoin…
…
1 = $7,858 May 23rd , 2018 exchange rate

27 Nov 2017

22 Feb 2018

What’s a
mining attack?

The Cryptojacking Motto:
In every CPU
there’s a hidden miner
 Abuse someone else's hardware
 Let someone else pay the electricity bill

MINING ON SOMEONE ELSE’S CPU
1. MINING MALWARE
2. MINING APPS
• Infect endpoints & servers
• Mine 24/7
3. MINING JAVASCRIPT
• Install on mobile devices
• Mine till the battery dies
• Infect websites & ad networks
• Mine the surfers
$3MMINED BY A SINGLE ATTACKER
Source: Check Point research, February 2018

BUSINESS IMPACT OF MINING ATTACKS
Exhaust server CPU  Poor Service / Denial of Service
CONSUME
SERVER RESOURCES
MINING HACKERS
LOVE THE CLOUD

21 Feb 2018

Large Telco, US
Recently…
“Something penetrated our cloud.
Our monthly AWS bill is up from
under $10K to over $100K”
FINDINGS
 AWS instance penetrated
 Infected with mining malware
 Auto-scaled to dozens of instances

LOWER
USER PRODUCTIVITY
Slow down PC
Drain mobile/laptop battery
Trigger cloud auto-scale  $$$
CONSUME
SERVER RESOURCES

JAVASCRIPT MINING IN THE BACKGROUND

LOWER
USER PRODUCTIVITY
Slow down PC
Drain mobile/laptop battery
Trigger cloud auto-scale  $$$
CONSUME
SERVER RESOURCES
HARM REPUTATION &
CUSTOMER SATISFACTION
By exploiting a company website to mine it’s customers

23 Feb 2018

PREVENTING MINING ATTACKS

1. PATCH YOUR SYSTEMS!
BUT KEEP IN MIND…
• Perfect patching & hardening for 100% of systems is usually impractical
• It won’t protect you from zero-day vulnerabilities
• It won’t protect your users from social engineering

Protect users from
websites with mining javascript
2. USE AN IPS
USERS
SYSTEMS
ORGANIZATION
ATTACKER
IPS Protect servers and endpoints
from vulnerability exploitation
Real-time virtual
patching for the
entire organization

Financial opportunity drives
attack sophistication
3. ZERO DAY PREVENTION
Majority of attacks can’t be
detected by signatures
May
2017
Known
Unknown43%
57%

WHAT IF YOU’RE ALREADY INFECTED?

The difficult way…
MONITOR THE CPU
Look for anomalous
usage patterns
Constantly monitor
on all your systems

INTERCEPT MINING CnC
Use ANTI-BOT
Detect and block mining traffic (and all other infections)
 Stops the mining activity
 Alerts on infected host
Anti-Bot
activated
PC infected with XMRig miner
The recommended way…

SandBlast empowers you to achieve
the best cyber protection in the
industry
Make sure you
̶ Cover all attack vectors
̶ Utilize all technologies
̶ Integrate with your infrastructure (Mail
system, Proxy, DNS, …)
̶ Optimize and monitor
Summary
MINING ATTACKS CAN BE PREVENTED
Patch your systems
Implement advanced protection technologies
Enterprise Security Architecture
THE SAME PRINCIPLES PREVENT ALL CYBERATTACKS

36©2018 Check Point Software Technologies Ltd. [Internal Use] for Check Point employees
Forrester Zero Trust & Check Point Software

Cybersecurity is Human problem, not Machine
problem

Enterprise Security Architecture
https://research.cloudsecurityalliance.org/tci/index.php/explore/information_services/

NETWORK
Shared Threat Intelligence
Consolidated
Security
Management
[Internal Use] for Check Point employees
Multi & Hybrid Cloud
Headquarters Branch
Access Control
Multi Layered Security
Advanced Threat Prevention
Data Protection
Access Control
Multi Layered Security
IoMT & BMS
MOVIL
Network Protection
Device Protection
App Protection
Capsule
WorkSpace/Docs
Remote Access
Secure Business Data
Protect Docs Everywhere
ENDPOINT
Anti-Ransomware
Forensics
Threat Prevention
Access/Data Security
Access Control
Secure Media
Secure Documents
NUBE
Adaptive Security
Automation and Orchestration
Cross Environment
Dynamic Policies
Infrastructure
Identity Protection
Sensitive Data Protection
Zero-Day Threat Protection
End-to-end SaaS Security
Applications

Check Point Software Free Tools

ENFORCEMENT
GESTION
INTELIENCIA CLOUD & INFRASTRUCTURA
APPLIANCES CASB 160+PARTNERS
TECNOLOGICOS
MOVILES
COMUNICACIONESICS
CHECK POINT PROVEE A SUS CLIENTES UNO DE LOS MAS GRANDES
ECOSISTEMAS EN LA INDUSTRIA DE SEGURIDAD
Source: https://www.checkpoint.com/partners/opsec

42©2018 Check Point Software Technologies Ltd.©2018 Check Point Software Technologies Ltd.
THANK YOU! / ¡GRACIAS! / OBRIGADO!
DANKE! / TAK! / GRÀCIES! / MERCI! / СПАСИБО!
!‫תודה‬
[Restricted] for designated teams

Crypto Mining Threats and Prevention

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Crypto Mining Threats and Prevention

Similar to Crypto Mining Threats and Prevention (20)

Recently uploaded

Recently uploaded (20)

Crypto Mining Threats and Prevention