Story image

Exclusive: 'Bad guys aren't so bad' as cryptomining is a sign of conscience

22 May 2018

Ransomware wreaked havoc on the world in 2016 and 2017, but recent studies show that it has been usurped as the cybercrime method of choice.

Cryptomining surged to popularity on the back of the meteoric rise of cryptocurrencies, with reports from Comodo and Sophos (among others) proving it has overtaken ransomware.

At the recent SolarWinds MSP Empower MSP event held in Amsterdam, I had the chance to sit down with SolarWinds MSP VP security architecture Tim Brown who spoke about the cybercrime landscape as a whole and what he thinks of cryptomining’s ascent.

“Cryptomining as an exploit when compared to other available methods isn’t so harmful. I think it's a sign that the bad guys aren’t so bad and don't want to cause harm unless necessary. The problem is that those machines that have been hacked for cryptomining could have easily been infected with ransomware or financial trojans, among many others,” says Brown.

“That machine is owned and therefore can take another role next time. Depending on what the miner did, the level on compromise on the device might be very benign and some of them are really good in only taking around 10 percent of your processor! They're designed not to disrupt, firstly to avoid detection but I believe also to cause less harm.”

Brown believes that with the imminent GDPR just around the corner, we will see a lot more breaches publicised – not necessarily because cybercriminals are becoming more prominent, but simply because they will be obliged to.

“Already businesses are disclosing a lot more than what they used in the past, as we’ve seen the negative impact of not disclosing in cases like Equifax and Uber. The original mindset for many was 'what can we get away with', but now businesses are realising that if they hide details then it's going to get a lot worse,” says Brown.

“Recently there have been some information disclosures where the system was just compromised, undoubtedly a result of the aggressive cryptomining that is going on. In the past the question that businesses would then ask was ‘if our system gets exposed to one of those, do we really have a breach as no data was stolen?’ This is why I see breach disclosures to increase.”

I then asked Brown about how businesses can protect themselves against internal threats, as they can spend infinite amounts of money on cybersecurity against external threats, but often the biggest breaches come from the inside.

“What you do is put controls in place so that very few single people can do full amounts of harm to your business. For example, a business that needs to provide updates to millions of end points can only do so with the permission of a number of people, not a single person. This effectively means the key to the 'crown jewels' are guarded by a team,” Brown says.

Brown also shared an interesting solution for the internal security conundrum that he is yet to implement with his team at SolarWinds MSP, but one that he would like to put in place in the near future.

“For people that have more access, you treat them specially. I'm a big fan of compensating and watching my 'crown' people more. I want to be able to take those people that need very high levels of access like my system admin and monitor their internal and external activities - and pay them 10 percent more for the hassle,” says Brown.

“To ensure the safety of our business, you have to give up some of your privacy but in return I will pay you more. That's the world we now live in.”

Veeam releases v3 of its MS Office backup solution
One of Veeam’s most popular solutions, Backup for Office 365, has been upgraded again with greater speed, security and analytics.
Too many 'critical' vulnerabilities to patch? Tenable opts for a different approach
Tenable is hedging all of its security bets on the power of predictive, as the company announced general available of its Predictive Prioritisation solution within Tenable.io.
Industrial control component vulnerabilities up 30%
Positive Technologies says exploitation of these vulnerabilities could disturb operations by disrupting command transfer between components.
McAfee announces Google Cloud Platform support
McAfee MVISION Cloud now integrates with GCP Cloud SCC to help security professionals gain visibility and control over their cloud resources.
Scammers targeting more countries in sextortion scam - ESET
The attacker in the email claims they have hacked the intended victim's device, and have recorded the person while watching pornographic content.
Cryptojacking and failure to patch still major threats - Ixia
Compromised enterprise networks from unpatched vulnerabilities and bad security hygiene continued to be fertile ground for hackers in 2018.
Princeton study wants to know if you have a smart home - or a spy home
The IoT research team at Princeton University wants to know how your IoT devices send and receive data not only to each other, but also to any other third parties that may be involved.
Organisations not testing incident response plans – IBM Security
Failure to test can leave organisations less prepared to effectively manage the complex processes and coordination that must take place in the wake of an attack.