- Title
- An investigation into the current state of web based cryptominers and cryptojacking
- Creator
- Len, Robert
- ThesisAdvisor
- Irwin, Barry
- Subject
- Cryptocurrencies
- Subject
- Malware (Computer software)
- Subject
- Computer networks -- Security measures
- Subject
- Computer networks -- Monitoring
- Subject
- Cryptomining
- Subject
- Coinhive
- Subject
- Cryptojacking
- Date
- 2021-04
- Type
- thesis
- Type
- text
- Type
- Masters
- Type
- MSc
- Identifier
- http://hdl.handle.net/10962/178248
- Identifier
- vital:42924
- Description
- The aim of this research was to conduct a review of the current state and extent of surreptitious crypto mining software and its prevalence as a means for income generation. Income is generated through the use of a viewer's browser to execute custom JavaScript code to mine cryptocurrencies such as Monero and Bitcoin. The research aimed to measure the prevalence of illicit mining scripts being utilised for “in-browser" cryptojacking while further analysing the ecosystems that support the cryptomining environment. The extent of the research covers aspects such as the content (or type) of the sites hosting malicious “in-browser" cryptomining software as well as the occurrences of currencies utilised in the cryptographic mining and the analysis of cryptographic mining code samples. This research aims to compare the results of previous work with the current state of affairs since the closure of Coinhive in March 2018. Coinhive were at the time the market leader in such web based mining services. Beyond the analysis of the prevalence of cryptomining on the web today, research into the methodologies and techniques used to detect and counteract cryptomining are also conducted. This includes the most recent developments in malicious JavaScript de-obfuscation as well as cryptomining signature creation and detection. Methodologies for heuristic JavaScript behaviour identification and subsequent identification of potential malicious out-liars are also included within the research of the countermeasure analysis. The research revealed that although no longer functional, Coinhive remained as the most prevalent script being used for “in-browser" cryptomining services. While remaining the most prevalent, there was however a significant decline in overall occurrences compared to when coinhive.com was operational. Analysis of the ecosystem hosting \in-browser" mining websites was found to be distributed both geographically as well as in terms of domain categorisations.
- Description
- Thesis (MSc) -- Faculty of Science, Computer Science, 2021
- Format
- computer, online resource, application/pdf, 1 online resource (83 pages), pdf
- Publisher
- Rhodes University, Faculty of Science, Computer Science
- Language
- English
- Rights
- Len, Robert
- Rights
- All Rights Reserved
- Hits: 10109
- Visitors: 10860
- Downloads: 912
Collections
RU Department of Computer Science
| Thumbnail | File | Description | Size | Format | |||
|---|---|---|---|---|---|---|---|
| View Details Download | SOURCE1 | LEN-MSC-TR21-126.pdf | 2 MB | Adobe Acrobat PDF | View Details Download |