SoK: Cryptojacking Malware Ege Tekiner∗, Abbas Acar∗, A. Selcuk Uluagac∗, Engin Kirday, and Ali Aydin Selcukz ∗Florida International University, Email:fetekiner, aacar001, suluagacg@fiu.edu yNortheastern University, Email:
[email protected] zTOBB University of Economics and Technology, Email:
[email protected] Abstract—Emerging blockchain and cryptocurrency-based According to a recent Kaspersky report [2], 19% of technologies are redefining the way we conduct business the world’s population have bought some cryptocurrency in cyberspace. Today, a myriad of blockchain and cryp- before. However, buying cryptocurrency is not the only tocurrency systems, applications, and technologies are widely way of investing. Investors can also build mining pools to available to companies, end-users, and even malicious ac- generate new coins to make a profit. Profitability in mining tors who want to exploit the computational resources of regular users through cryptojacking malware. Especially operations also attracted attackers to this swiftly-emerging with ready-to-use mining scripts easily provided by service ecosystem. providers (e.g., Coinhive) and untraceable cryptocurrencies Cryptojacking is the act of using the victim’s com- (e.g., Monero), cryptojacking malware has become an in- putational power without consent to mine cryptocurrency. dispensable tool for attackers. Indeed, the banking indus- This unauthorized mining operation costs extra electricity try, major commercial websites, government and military consumption and decreases the victim host’s computa- servers (e.g., US Dept. of Defense), online video sharing platforms (e.g., Youtube), gaming platforms (e.g., Nintendo), tional efficiency dramatically. As a result, the attacker critical infrastructure resources (e.g., routers), and even transforms that unauthorized computational power into recently widely popular remote video conferencing/meeting cryptocurrency.