Cryptocurrencies are essentially digital currencies that operate independently of a central bank, and examples include Bitcoin, Litecoin, Ethereum and Monero, to name just a few. Given the appreciation in value of these cryptocurrencies, they have come to be seen as an attractive investment.
Aside from actually purchasing them outright, one way to procure these cryptocurrencies is to engage in a process called cryptomining. Cryptomining involves using a computer’s processing power to solve complex mathematical equations to verify that cryptocurrency transactions are legitimate. As a reward for this task, the cryptocurrency in question provides a certain amount of that cryptocurrency to the individual who verified the transactions the fastest. One way to improve your chances of being the first to verify a transaction is to have more computers at your disposal: the more computers you have working for you, the quicker you can mine cryptocurrency. However, utilising all this processing power can be an intensive process, using up bandwidth, increasing electricity costs and slowing down computers.
And this is where the concept of cryptojacking comes in. Rather than bear all of the processing costs associated with cryptomining themselves, cybercriminals look to pass these onto innocent individuals and businesses instead.
There are two main ways in which cybercriminals carry out cryptojacking. One way is to dupe victims into downloading cryptomining code onto their computer systems. This is typically done through the use of phishing emails. For example, a legitimate-looking email might arrive in the victim’s inbox and ask them to click on a link or an attachment. Once this link or attachment is clicked on, code is downloaded onto the computer, which then utilises that computer’s processing power to mine cryptocurrency.
Another method used by cybercriminals is to insert cryptomining code on a website or online advertisements. If the victim visits an affected website or if one of these ads pops up, the code works in the background and surreptitiously mines cryptocurrency whilst the victim browses on that page. In both cases, the cybercriminals reap all the rewards from the cryptomining activity, whilst the victim is left with all the processing costs.
A similar risk that businesses face is when their computer resources are used as part of what is known as a botnet. Botnets are essentially computer systems that have been hijacked by malicious actors, which are then used to carry out attacks against third parties, most commonly in the form of denial of service attacks.
As both cryptojacking and botnetting can go undetected for a long period of time, the costs incurred in terms of electricity and bandwidth use can be considerable. That’s why CFC’s cyber policy includes cover for the financial losses associated with cryptojacking and botnetting as standard, providing a valuable safety net to policyholders for these growing risks.
