Blog

Security Research

Cryptominers’ Anatomy: Shutting Down Mining Botnets

Maor Dahan is a Senior Security Researcher at Akamai with more than a decade of experience in the cybersecurity industry. He specializes in operating system internals, vulnerability research, and malware analysis. Maor also has extensive experience designing and developing advanced detection and prevention mechanisms for innovative security products such as EDR, EPP, and virtualization-based security.

By executing “bad shares,” we were able to ban the mining proxy from the network — shutting down the mining operation.

Contents

\r\n \r\n Introduction

\r\n Shutting down cryptominer operations

\r\n 3.3 million to zero

\r\n What are bad shares?

\r\n Using bad shares to ban an attacker mining proxy

\r\n If you can’t beat them, ban them \r\n Communicating with the proxy

\r\n XMRogue

\r\n Testing the theory

\r\n \r\n

\r\n Using bad shares to ban an attacker that’s connecting directly to the pool \r\n Wider net, shallower…