360 Mining Trojan Research Report: Uncovering the Secrets of Bitcoin Mining

Recently, blockchain technology has been praised continuously, but Bitcoin, which is based on blockchain technology, has been like a roller coaster, with market fluctuations. In early 2018, media reported that the Leading Group of the Internet Financial Risk Special Rectification Office issued a document requiring all localities to guide enterprises within their jurisdiction to orderly withdraw from the "mining" business and regularly report on the progress of the work.

Although the policy targets large-scale mining farms, small-scale miners and retail investors are still affected to a certain extent and may withdraw from the mining market. Some miners are quietly planning to "go overseas" and move overseas. In fact, the Bitcoin mining industry is very profitable. Driven by profit, in addition to normal mining operations, a large number of mining Trojans have also emerged, lurking in computers and web pages, secretly using other people's resources to mine for themselves.

Bitcoin has high costs and high profits. Big miners can earn 70 million in two months!

In 2017, the domestic bitcoin transaction price soared, attracting a large number of "miners" to join the industry, and the bitcoin mining army is growing. According to netizen Lao Wu, although he had been involved in bitcoin trading in 2014, the bitcoin craze in 2017 made him spend 40,000 yuan to buy two mining machines and started a new mining life.

Figure 1: Bitcoin transaction prices from 2013 to 2017, according to 360’s mining trojan research report

The netizen briefly introduced the cost of mining. If the mining operation is carried out for 24 hours a day, 0.0018 bitcoins can be mined. It takes about 556 days to successfully mine one bitcoin. The electricity cost is about 9,367 yuan, accounting for 70% of the total cost. The other 30% comes from the loss of mining machines and labor costs. According to this calculation, the cost of successfully mining one bitcoin is about 13,000 yuan.

The current price of Bitcoin is above 70,000 yuan. It can be seen that although the cost of Bitcoin mining is high, high profits can still be earned. The policy affects retail investors and small miners, but for large miners who have hundreds or thousands of mining machines in their hands, they have already earned back the cost before the policy was issued. Large miners are still watching the market trend, or taking the opportunity to buy mining machines at a low price to make a big move, or planning to move overseas.

In 2017, a senior domestic miner decided to pick up Bitcoin mining again because his friend developed a software that can remotely monitor the operation of 5,000 mining machines at the same time. He spent 20 days and invested nearly 100 million yuan to configure 4,000 mining machines for mining. As the price of Bitcoin rose too quickly, it took only about 2 months to successfully recover more than 70 million yuan, which was more than half the expected time.

The tightening of regulatory policies has increased the pressure on retail investors and small miners. Not only do they sell the bitcoins they have received immediately, but they have even started to sell their mining machines, intending to withdraw from the mining stage. Only the big miners are sitting on the Diaoyutai. From mining machine sales to bitcoin mining, this mining area, which is full of treasures, has also bred countless "parasites" that quietly suck blood - mining Trojans.

Mining Trojans are making money crazily. Zombie networks and web mining are exploding on a large scale

The issuance of digital currencies such as Bitcoin has directly led to the birth of mining Trojans. Digital currencies are obtained by mining machine programs through a large number of calculations based on specific algorithms. Criminals implant mining machine programs into the victim's computer and use the computing power of the victim's computer to mine. This mining machine program that the user is unaware of is a mining Trojan.

According to the first domestic blockchain security report "2017 Mining Trojan Report" released by 360, mining Trojans mainly make money through two methods: botnets and web mining scripts. As the transaction price of digital currency rises, the number of mining Trojans is also increasing. 2017 was not only a year of great harvest for miners, but also a year of massive outbreak of mining Trojans.

Figure 2: Mining Trojan attacks disclosed in China from 2013 to 2017

According to the report, mining Trojan botnets are formed by hackers who invade other computers and implant malicious programs and mining Trojans, and then use the malicious programs to invade more computers, thereby establishing a huge puppet computer network for mining. In April 2017, the leakage of vulnerability attack tools such as EternalBlue allowed mining Trojan botnets to spread widely with the help of EternalBlue.

The large-scale mining Trojan botnets such as "Bondnet", "Adylkuzz" and "Hiddener" that broke out in 2017 all used EternalBlue to gain a foothold. The absolute advantages of not needing a carrier for attack and having a wide range of targets made EternalBlue the standard for mining Trojan botnets this year, which directly led to the explosive growth of mining Trojan botnets.

In September 2017, web mining came into the public eye after the pirated resource distribution center Pirate Bay was found to have embedded mining scripts in its web pages. According to research reports, web mining can cause users' computer resources to be severely occupied, causing the computer to slow down or even freeze, seriously affecting the normal use of users' computers.

Hiding in the corners of vulnerable security, 360 security experts give tips on preventing mining Trojans

Compared with network security threats such as ransomware, mining Trojans are more hidden and quietly consume computer resources. Due to their difficult-to-detect characteristics, mining Trojans are more rampant. In response to the above phenomenon, 360 security experts provide tips for everyone to prevent mining Trojans.

For mining Trojan botnets, server administrators should avoid using weak passwords, upgrade systems and patch computers in a timely manner to prevent mining Trojan botnets from using vulnerabilities and weapons to spread attacks, regularly maintain servers, and check for persistent mining Trojans from aspects such as CPU usage and suspicious items in task execution.

For web mining scripts, users need to pay attention to the CPU usage when browsing the web. If the computer CPU usage soars and most of the CPU usage comes from the browser, then the web page may have been implanted with a mining script. In addition, experts also recommend that users use security software such as 360 Security Guard to avoid visiting malicious websites marked as high-risk and reduce attacks by mining Trojans.

For the digital currency mining industry, 2017 is a year of both opportunities and risks. While the transaction price continues to rise, mining Trojans have gradually come to the fore from little-known corners, and together with threats such as ransomware, they are undermining the security of cyberspace. To prevent mining Trojans, users and server managers need to raise their security awareness, and to curb the rise of mining Trojans, security vendors such as 360 need to detect and kill them in a timely manner to protect the security of users' computers in all aspects.