The computer is slowing down, maybe it is secretly mining

Visual China

Maybe you are not interested in blockchain, and you don’t care about the market price of Bitcoin, but your computer may have "its own ideas".

Recently, the Ministry of Industry and Information Technology released a cybersecurity threat situation analysis and work summary for the second quarter of 2018, pointing out that illegal "mining" poses a serious threat to cybersecurity. Tencent Cloud monitoring found that with the rise of "cloud mining", cloud hosts have become the main target for mining digital currencies such as Monero. The 360 ​​Enterprise Security Technology Team monitored and discovered a new type of "mining" virus, which spread wildly within two months, and the hackers involved made nearly one million yuan in illegal "mining" profits.

According to media reports, according to Adguard statistics, about 500 million computers around the world have been hijacked for "mining". The "2018 Internet Security Threat Report" released by Symantec pointed out that in the past year, the number of "mining" malicious programs detected on computers has skyrocketed 85 times.

"Mining" virus consumes computing and power resources

In the decentralized blockchain world, there is a basic logic of transactions: one node is responsible for constructing block data based on transaction information, and other nodes "copy" block data. The qualification to modify block data is the "bookkeeping right", and nodes that obtain the bookkeeping right can receive a certain amount of virtual digital currency as a reward.

But to obtain the "bookkeeping rights", one must win the competition in computer computing power and be the first to complete the "problem-solving task". This process consumes a lot of computer CPU, GPU resources and electricity resources, and is commonly known as "mining".

"Mining" has become an energy-intensive industry. Relying on a single computer to fight alone is really lonely. If you can use other people's computers and fight in groups, wouldn't the chances of winning be higher?

The "Tencent Security 2018 Blockchain Security Report" pointed out that the "mining" virus has developed into the most widely spread network virus in 2018. Since the controllers of the "mining" virus can directly make profits by selling the mined digital virtual currency, the influence of the "mining" virus is unprecedentedly high.

"Together with ransomware, their impact has surpassed that of other malicious software. Personal computers and corporate users have all become victims of ransomware and 'mining' Trojan viruses." Li Tiejun, senior security expert at Tencent Computer Manager, told Science and Technology Daily.

For PC users, mining Trojan viruses usually have two major attack methods: one is to infect PCs, and the other is to "live" in web pages, and once a user visits, they can enter the user's computer. "The intrusion methods are even more varied," said Li Tiejun. Some of them use security loopholes in PCs to remotely invade and then implant mining Trojan viruses. Some of them use fake game plug-ins and cracked software to deceive users to turn off antivirus software and run Trojan viruses. Others send documents, emails, and URLs to deceive victims to open and view them. "Because there are loopholes in the computer system, it is easy to be attacked," he said.

Taking precautions can reduce the chances of being attacked

The "Tencent Security 2018 Blockchain Security Report" pointed out that in 2018, the number of "mining" Trojan viruses on computers has grown at an unprecedented rate. In the first half of the year alone, there were 45 "mining" Trojan virus incidents, which is more than the number of "mining" Trojan virus incidents that broke out in the whole year of 2017.

Not long ago, the Weifang Public Security Bureau of Shandong Province cracked a major case of illegal control of computer information systems. In this case, the suspect used Trojan programs to illegally control other people's computer information systems to "mine" for profit, illegally controlled 3.89 million computers, and silently installed "mining" programs on more than 1 million of them. Since 2015, a total of more than 26 million virtual currencies of various types have been mined, with illegal profits of 15 million yuan.

The police officers in charge of the case said that after the user's computer host is implanted with the "mining" program of this virtual currency and starts "mining", it will be in a high-load operation state for a long time, and the graphics card, motherboard and memory are likely to be scrapped prematurely.

Some security teams have also warned that when the victim's computer runs a "mining" virus, the computer's CPU and GPU resource usage will increase, causing the computer to slow down. If it is a laptop, it will be easier to detect abnormalities: for example, the computer will become hot, the fan speed will increase, and the computer noise will increase.

However, some Trojan viruses are more "cunning".

Li Tiejun introduced that Tencent Yujian Threat Intelligence Center has observed that a considerable number of "mining" Trojan viruses have anti-or deception mechanisms, and some "mining" Trojan viruses are quite restrained, for example, they will not occupy more resources to "mine" when users are using their computers normally, but when the user's computer is not in use (such as a black screen), it will "mine" at full speed; and when the user checks the system process usage, the virus will stop immediately. "Currently, personal computers have high configurations, and as long as they do not occupy too much system resources, it is relatively difficult for ordinary users to detect it." Li Tiejun said that if users find that their computers are infected with "mining" Trojan viruses, it usually comes from the alarm of antivirus software.

Li Tiejun gave some very practical preventive measures: try not to download game plug-ins, software cracking patches and other tools; use security software for defense; when a website requires users to turn off anti-virus software before running a tool, be vigilant; promptly repair operating system security vulnerabilities to reduce the possibility of being attacked. (Reporter Zhang Gailun)