Illegal "mining": Trojans attack computers and take risks for electricity

The skyrocketing value of Bitcoin in 2017 has attracted countless people to go crazy, and "mining" has become an area of ​​close concern for some people. Computer tutorials, mobile phone software, "mining with mining machines"... As the number of "mining" methods increases, some problems also arise.

In September this year, the Ministry of Industry and Information Technology's website's second quarter cybersecurity threat situation analysis and work summary pointed out that illegal "mining" seriously threatens Internet network security. Many Internet companies and network security companies have analyzed that illegal "mining" has become a serious network security issue.

"Mining" Trojan attacks computers

Wang Shuai, who is studying at Northeast Petroleum University, once used his spare time to study "mining" and virtual currency. According to him, some "miners" need to exchange high-performance computing power for virtual currency when "mining", and hackers take advantage of this feature and use illegal means to steal other people's computer resources and turn other people's computers into their own "mining machines".

"A common method used by 'mining' Trojans is to attack computers via web pages. Computers infected with 'mining' Trojans not only become stuck in use and consume more power, but also cause serious damage to the hardware," said Wang Shuai.

A programmer named Hu Yuyang recorded his experience in an article, "I bought a server and built a small website for fun. Today, I visited it and it loaded very slowly. I checked the server's operation status and found that the CPU soared to 100%. In terms of CPU consumption, the first process was a process called 'imWBR1'. I checked and found that it was a 'mining' Trojan horse."

According to Hu Yuyang, the Trojan horse took advantage of the Redis port vulnerability to sneak in.

Another Baidu Tieba user who was infected with a Monero-mining Trojan said, "The cause of the infection is unknown, as there was no such incident at home. I discovered this when I returned to school. It didn't happen before I left more than a month ago. I suspect the entire network has this Trojan, and we can only prevent it on personal computers." This netizen believes that it is difficult to find the source of this type of Trojan, and even if infected, it is difficult for current antivirus software to completely detect and kill it.

According to Wang Shuai, in addition to attacking web pages, users may also be attacked by Trojan viruses when browsing and downloading files and programs.

It is understood that the auxiliary program of a well-known game was once exposed to contain the "HSR coin mining" Trojan virus, and more than 200,000 computers were attacked in one day. Recently, Tencent Yujian Threat Intelligence Center discovered a new variant of the "Beauty Scorpion" "mining" Trojan in May, which used downloaded pictures to load malicious code to attack computers and used a variety of "mining machines" to mine coins.

"The 'mining' Trojan is different from general ransomware viruses. It directly steals computer resources without the user's knowledge and uses other people's computers for 'mining'. Its main manifestations and hazards are high memory usage and damage to graphics cards, but it is not easy to detect, making it difficult for many ordinary users to identify it. They even think that there is a problem with the computer's own hardware, so they become the victims unknowingly." Wang Shuai said.

Taking risks for electricity

According to Wang Shuai, since the income from mining is directly proportional to the computing power provided by the miner, many miners choose to buy mining machines and burn graphics cards in pursuit of higher efficiency, but burning graphics cards first requires solving the problem of expensive electricity bills.

A veteran website in the "mining" field listed "electricity theft" as the primary illegal behavior when summarizing illegal "mining" activities.

It is understood that in mid-June this year, a certain enterprise reported that the electricity consumption had increased abnormally since May. After investigation, it was found that the coin miners stole electricity to maintain 58 power-intensive "mining machines" and 12 "card machines". In order to save the cost of "mining", they stole more than 30,000 kWh of electricity in one month.

He Biao (pseudonym) is a "miner" from Anhui. He told reporters, "'Mining' is mainly a problem of electricity. Once the electricity problem is solved, other problems will disappear. Computer technical problems can be returned to the factory for repair."

"As far as I know, there are two main ways to solve the electricity problem. One is to have a custodian who specializes in collecting equipment and placing tens of thousands of 'mining machines' for centralized processing; the other is to use local connections to steal electricity," said He Biao.

"If the electricity bills are paid through normal channels, it will be difficult to make money." He Biao explained that the area where the equipment host is located usually has more cost-effective electricity resources, such as wind power or hydropower, and the electricity bill is about 30 cents. The "miner" and the host sign an agreement, for example, agreeing to place 1,000 "mining machines" and pay the hosting fees and electricity bills every day and every month, but such an agreement has no guarantee. "He Biao said.

Regarding the issue of stealing electricity for "mining", a worker at a power plant told reporters, "It could be collusion between insiders and outsiders. If someone knows someone in the power supply department, and they give some bribes, a small amount of money per month, it will be fine. Even if the electricity thief is caught, he will not give up the people in the power supply department."

When asked why he continued to pay attention to mining when the cost was so high, He Biao replied: "The mining market is indeed not very good. After accounting for electricity costs, the profit is not high. Now the miners are suffering and cannot make money. However, from the perspective of blockchain, only applications have value. Many people believe that blockchain and decentralization are still the trend of the future."

After several years in the cryptocurrency industry, He Biao has many concerns about its future prospects.

"There are many fake currencies such as air coins and pyramid scheme coins on the market now. The coins listed on the websites of several major platforms are not all formal. Although these platforms are relatively well-known, there are no specific regulations after all. New coin miners are easily confused by air coins and pyramid scheme coins. Air coins refer to currencies that have no practical use and are false and empty; pyramid scheme coins are pyramid scheme scams that lack actual benefits and are disguised as virtual currencies." said He Biao.

Regarding pyramid scheme coins, He Biao said: "The so-called pyramid scheme coins are just recruiting people. For example, I can issue them myself now, and then raise the price of the coins. After waves of people come in, I will cut the leeks and collect all the money layer by layer. Isn't this what people on the Internet call cutting leeks? At the beginning, the coin price rose, and the 10 yuan coin rose to 20 or 30 yuan. After it rose, you would definitely be reluctant to sell it. Then it fell, and it dropped to a few yuan, or even one yuan. The initial investment of 100,000 yuan, this time lost 80,000 or 90,000 yuan. This is like manipulating stocks, the coin price is also manipulated, and now many people have lost their fortunes because of this coin."

He Biao expressed to reporters his various concerns about the future development of the cryptocurrency circle and where it will go. "I personally feel it is quite chaotic. Now the country has no specific regulations on this aspect. We are not sure whether it should be retained or banned."

Source: Legal Daily