How DNS stops cryptojacking

DNS may be the most reliable way to detect and eliminate cryptojacking cybercrime at an enterprise level. Learn how BlueCat Edge can help.


August 9, 2018

Cryptojacking – the use of remote computing power to mine cryptocurrency – wasn’t always a threat. Just a few months ago, online news outlets openly declared their intention to use the computing power of site visitors to generate Bitcoin, Ethereum, Monero, and other digital currency. The incentive: to replace lost ad revenue. Given that Bitcoin mining generates about 12.5 BTC every 10 minutes, or over $80,000 at today’s value, that’s about $4.2 billion year.

However, once this idea caught on with criminals, cryptojacking quickly morphed into a serious cybersecurity problem and has begun to overtake ransomware as the more attractive form of malware.

Ransomware dominated as the most prevalent threat over the past few years, but has declined recently in favor of cryptojacking malware. Ransomware also requires a victim that can afford to or is willing to pay to retrieve their files. With new tools to prevent ransomware or services to decrypt files, and the cost of backup storage decreasing, the success of a ransomware attack has started to become less likely.

However, the profit potential with cryptojacking is greater and less likely to be discovered — victims generally just think their computer is running slower. There’s also a lot more simplicity on the cryptojacker’s end – it’s relatively easy for cybercriminals to embed javascript code and other cryptojacking code in the websites they compromise.

Now there are stories of entire networks slowing to a crawl as malware mines in the background, devices catching fire because their CPUs are overtaxed, and gaming software serving as a cover for cryptocurrency scams.

The role of DNS in cryptojacking

Most filters, firewalls, and ad blockers have been reprogrammed to stop common cryptomining malware and browser extensions like Coinhive. Unfortunately, this hasn’t done much to stop the spread of cryptomining on mobile and other IoT devices, many of which are easily compromised through hard-coded credentials and the use of unsecured public networks.

Finding and eliminating the source of cryptojacking can be difficult – it can be hiding just about anywhere on the network. Yet all cryptojacking attempts do have one thing in common: they have to communicate out.

DNS may be the most reliable way to detect and eliminate cryptojacking at an enterprise level. Filters, firewalls, and ad blockers can stop some communication with remote servers or identify malicious payloads, but often lack insight into the source IP and are unable to deal with infected IoT devices.

With a client-facing DNS security system like BlueCat Edge, cryptojacking can be easily traced to a source device in real-time and blocked until the device has been cleansed. Perhaps just as importantly, BlueCat Edge can monitor those devices after remediation to ensure that the malicious activity has stopped.

Mitigating cryptojacking on a customer network

BlueCat Edge recently helped a BlueCat customer discover and remediate wide-scale cryptojacking on its network. After installing BlueCat Edge, the customer was able to quickly identify multiple DNS queries of sites associated with known crytojacking software such as Coinhive and Coinimp. The mining operations were highly coordinated and targeted, occurring largely at times of day where use of computing resources were low and the activity was less likely to be discovered.

The customer’s existing firewall settings were able to treat the symptoms of cryptojacking, but not eliminate the underlying problem. The firewall effectively blocked execution of the cryptomining results back to the remote server based on blacklists applied to payload data. Yet the firewall failed to block DNS-based command and control functions, and was unable to identify the source IP of infected devices. The clients were still infected and using up valuable computing resources, even if the results of that compute weren’t making it to the outside internet.

With the comprehensive client-facing logs produced by BlueCat Edge, the customer was able to quickly associate cryptojacking activity with individual devices and direct its remediation activity accordingly. With the security policy functions of BlueCat Edge, the customer will be able to disrupt the full range of communication between the cryptojacking software and remote servers.

Staying one step ahead

The presence of multiple layers of cryptojacking on the customer network suggests that this is an evolving threat in which malicious actors will use a variety of methods to infiltrate and exploit large networks. Thankfully, the ubiquitous nature of DNS and its central role in exfiltration of cryptomining data allows BlueCat Edge to quickly identify and mitigate against this growing threat.

Learn more about how to make DNS your first line of defense.

Published in:

An avatar of the author

BlueCat provides core services and solutions that help our customers and their teams deliver change-ready networks. With BlueCat, organizations can build reliable, secure, and agile mission-critical networks that can support transformation initiatives such as cloud adoption and automation. BlueCat’s growing portfolio includes services and solutions for automated and unified DDI management, network security, multicloud management, and network observability and health.

Related content

Detect anomalies and CVE risks with Infrastructure Assurance 8.4 

The Infrastructure Assurance 8.4 release features an anomaly detection engine for outliers and a CVE analysis engine to uncover device vulnerabilities.

Read more

Get fast, resilient, and flexible DDI management with Integrity 9.6

With Integrity 9.6, network admins can get support for new DNS record types, architect and configure multi-primary DNS, and automate IP assignments.

Read more

Deepen your security insight with Infrastructure Assurance 8.3

BlueCat Infrastructure Assurance 8.3, with an enhanced analytics dashboard, including interactive widgets and top 10 alerts, is now available.

Read more

Security, automation, cloud integration keys to DDI solution success

Only 40% of enterprises believe they are fully successful with their DDI solution. Learn how to find greater success with new research from EMA and BlueCat.

Read more

Our commitment to Micetro customers and product investment

From CEO Stephen Devito, a word on BlueCat’s ongoing commitment to supporting Micetro customers and Micetro’s evolution as a network management tool.

Read more

Seven reasons to rethink firewall monitoring and boost automation 

With BlueCat Infrastructure Assurance, you can better protect your network with automated alerts and suggested remedies for hidden issues in your firewalls.

Read more