[克里斯]什么是加密恶意软件以及如何检测它？

令人震惊的统计数据表明网络犯罪格局正在发生变化，表明人们越来越关注加密恶意软件。

那么，加密恶意软件到底是什么？

加密恶意软件是一类恶意软件，旨在劫持计算机或设备的处理能力以挖掘加密货币。

加密恶意软件通过称为加密劫持的过程来实现这一点。

通常，被盗的处理能力被用来挖掘以隐私为中心的加密货币，例如门罗币（XMR），这些加密货币具有先进的混淆功能，使当局难以追踪。

也就是说，第一个公开可用的加密劫持脚本由 Coinhive 于 2017 年发布。该脚本允许网站管理员在其网站上嵌入挖掘代码，以利用访问者设备的计算能力。

这标志着一种增长趋势的开始，加密恶意软件攻击在随后几年中猛增。

为什么加密恶意软件攻击不断增加，它们是如何进行的？

根据当前趋势，黑客正在从勒索软件等破坏性网络安全攻击转向被认为更加被动的加密恶意软件攻击。

网络安全专家将这种范式转变归因于几个因素。

其中最重要的是，与经常引起反犯罪机构注意的勒索软件攻击等策略相比，加密劫持攻击的风险相对较低。

而且，加密货币挖矿的非法性属于灰色地带，使得恶意团体更容易逃避审查。

加密恶意软件攻击的成本效益是促使黑客团体更加关注窃取处理能力的另一个因素。

窃取处理能力几乎不需要任何成本，而且战利品可以很容易地转换成现金，而且复杂性极低。

这使得加密货币劫持对于邪恶团体来说非常方便。

此外，与传统恶意软件不同，加密劫持攻击使用难以检测的低级漏洞，例如浏览器漏洞。

The widespread use of Internet-of-Things (IoT) devices is another contributing factor to the surge in crypto malware attacks. Because IoT devices usually have weaker security safeguards compared to computers, they are more vulnerable to exploitation. This makes them prime targets for hackers. This factor inadvertently increases the attack surface for crypto malware attacks.

Crypto malware vs. ransomware

Crypto malware and ransomware are two distinct types of malware. While crypto malware is malware used to mine cryptocurrencies on computers without users’ consent, ransomware is utilized by hackers to encrypt files on computers and demand ransom payments for their decryption.

The following is an overview of their fundamental differences:

How do crypto malware attacks spread?

Over the years, black hats have devised numerous ways of compromising computing devices in order to carry out crypto malware attacks. The following is a breakdown of some of the key strategies used by hackers:

Installing crypto-mining code

Injecting crypto-mining malware into a computer is a common tactic used by hackers to exploit the computing resources of compromised devices. In many cases, attackers install the malware on a computer by tricking victims into downloading seemingly innocuous files laden with crypto-mining malware or baiting them into clicking links that lead to malicious websites designed to deliver malware payloads.

In some cases, hacker groups spread the malware through compromised routers, further complicating detection and mitigation efforts.

Injecting crypto mining scripts into ads and websites

Cybercriminals can unleash crypto-mining malware by planting malicious scripts in ads and websites. The scripts typically exploit browser vulnerabilities to force visitors’ computers to mine cryptocurrencies the moment they open the infected pages. This can occur even if the victim refrains from clicking on the infected ads or any trigger elements that are on the website.

Exploiting vulnerabilities in software and operating systems

Hackers regularly exploit vulnerabilities in software and operating systems to install crypto-mining code on victims’ devices. In many cases, they achieve this by taking advantage of known vulnerabilities or employing zero-day exploits.

Some cryptojacking campaigns have also been found to rely on side-loading exploits to install cryptojacking modules that imitate legitimate system processes. Side loading is the injection of code that has not been approved by a developer to run on a device. The technique allows for the deployment of persistent malware, including crypto malware.

Exploiting cloud-based infrastructure vulnerabilities

Hackers have been known to exploit vulnerabilities in cloud-based infrastructure to pilfer their immense processing power for crypto mining.

In some instances, attackers have resorted to using stealthy, fileless payloads to execute crypto malware attacks. The payloads are typically programmed to disappear from memory once cloud workloads are halted, further complicating detection efforts.

Malicious browser extensions

Cybercriminals sometimes use malicious browser extensions to carry out cryptojacking attacks. The extensions, which are often disguised as plugins for legitimate purposes, force victims’ machines to mine digital assets.

The malicious activities of such extensions are typically difficult to detect due to their seemingly legitimate functions.

Symptoms of crypto malware infection

Crypto malware infections can manifest in a number of ways, ranging from the glaringly obvious to the deceptively subtle. The following is a breakdown of some of the telltale signs of a crypto malware infection:

Increased CPU usage

Crypto malware typically tends to target the central processing unit (CPU) of a computer. The CPU is the primary processing component responsible for coordinating a machine’s hardware, operating systems and applications. It utilizes complex electronic circuitry to process instructions from various components.

As such, computers infected with crypto mining malware often experience an anomalous surge in CPU usage. CPU activity can be monitored using the Task Manager on Windows or Activity Monitor on macOS. A sudden and sustained spike in CPU usage, particularly when the system is idle, could indicate a crypto malware infection.

Slow performance

Crypto malware’s heavy reliance on CPU resources often leads to a noticeable decline in overall system performance. The performance issues can be attributed to the overburdening of the CPU with cryptocurrency mining operations.

In the presence of a crypto malware infection, the decline in performance is usually accompanied by secondary problems such as overheating issues, which sometimes force the computer’s cooling system (fans) to work harder to dissipate the heat. Often, this coincides with increased electricity consumption.

Unusual network activity

Unusual computer network activity could indicate a crypto malware infection. This is because crypto malware is usually set up to ping external servers to receive updates and instructions. As a result, irregular network patterns, such as frequent outgoing connections, could indicate potential infections.

Such activities are usually accompanied by the emergence of unfamiliar processes or applications that usually consume more CPU resources than normal.

Protection against crypto malware attacks

Crypto malware attacks can be deterred through various methods. The following is a breakdown of some of them.

Keeping the operating system and software updated

Regularly updating a computer’s operating system ensures that the software has the latest security patches and could deter crypto malware attacks. The rationale behind the precautionary measure is that the updates will prevent cybercriminals from using loopholes in outdated systems to launch attacks.

Install and use reputable antivirus and anti-malware software

Installing robust anti-malware software is a crucial step in deterring cybersecurity threats, including crypto malware. Top-rated anti-malware programs often scan devices regularly for malicious software and use sophisticated detection methods to identify threats, including crypto miners.

Many of the formidable antivirus software also have real-time scanning features that can identify and prevent crypto malware from deploying on a system.

Be cautious with email attachments and links

Email remains a favored medium for cybercriminals to spread malware, including crypto malware. To avoid falling victim to email malware distribution schemes, one should avoid opening attachments or clicking on links in emails from unknown or suspicious sources.

This is because cybercriminals regularly use deceptive emails to trick users into unknowingly downloading crypto malware onto their devices. Therefore, disregarding suspicious emails could help to avert crypto malware attacks.

Only download software from trusted sources

Downloading software from reputable sources reduces the risk of encountering malicious programs. This is because reputable platforms usually undergo stringent security checks to reduce the chances of distributing compromised software. Untrustworthy websites, on the other hand, usually lack such safeguards and are therefore likely to distribute software that contains malware, including crypto mining malware.

Use a firewall

A firewall acts as a barrier between a computing device and the internet and is usually set up to block unauthorized access by filtering incoming and outgoing connections. The added security layer makes it more difficult for crypto malware to infect machines.

Install an anti-cryptojacking extension

Installing specialized anti-cryptojacking browser extensions can help in the detection and blocking of crypto-mining scripts designed to target browser elements. Legitimate anti-cryptojacking extensions are usually available on official browser developer web stores.

An alternative, albeit more extreme approach, is to disable JavaScript support on a browser. The mitigation measure will prevent the execution of JavaScript-based cryptojacking scripts.

Future crypto malware trends

The number of recorded crypto malware attacks is likely to increase in the future, based on current trends. This is partly due to shifting law enforcement priorities toward addressing high-profile cybercrimes like ransomware and data breaches. The reduced attention from authorities is likely to embolden cybercriminals and lead to a rise in cryptojacking attacks.

过去的趋势表明，网络犯罪分子将继续开发新的加密劫持技术来利用新兴技术中的漏洞。

这种演变可能会给传统安全解决方案检测和防止此类攻击带来挑战，至少在开始时是这样。

最后，用户对加密劫持及其相关风险的认识有限仍然是打击加密恶意软件的重大障碍。

缺乏了解往往会导致忽视预防措施，使更多机器容易