Story image

Exclusive: 'Bad guys aren't so bad' as cryptomining is a sign of conscience

22 May 2018

Ransomware wreaked havoc on the world in 2016 and 2017, but recent studies show that it has been usurped as the cybercrime method of choice.

Cryptomining surged to popularity on the back of the meteoric rise of cryptocurrencies, with reports from Comodo and Sophos (among others) proving it has overtaken ransomware.

At the recent SolarWinds MSP Empower MSP event held in Amsterdam, I had the chance to sit down with SolarWinds MSP VP security architecture Tim Brown who spoke about the cybercrime landscape as a whole and what he thinks of cryptomining’s ascent.

“Cryptomining as an exploit when compared to other available methods isn’t so harmful. I think it's a sign that the bad guys aren’t so bad and don't want to cause harm unless necessary. The problem is that those machines that have been hacked for cryptomining could have easily been infected with ransomware or financial trojans, among many others,” says Brown.

“That machine is owned and therefore can take another role next time. Depending on what the miner did, the level on compromise on the device might be very benign and some of them are really good in only taking around 10 percent of your processor! They're designed not to disrupt, firstly to avoid detection but I believe also to cause less harm.”

Brown believes that with the imminent GDPR just around the corner, we will see a lot more breaches publicised – not necessarily because cybercriminals are becoming more prominent, but simply because they will be obliged to.

“Already businesses are disclosing a lot more than what they used in the past, as we’ve seen the negative impact of not disclosing in cases like Equifax and Uber. The original mindset for many was 'what can we get away with', but now businesses are realising that if they hide details then it's going to get a lot worse,” says Brown.

“Recently there have been some information disclosures where the system was just compromised, undoubtedly a result of the aggressive cryptomining that is going on. In the past the question that businesses would then ask was ‘if our system gets exposed to one of those, do we really have a breach as no data was stolen?’ This is why I see breach disclosures to increase.”

I then asked Brown about how businesses can protect themselves against internal threats, as they can spend infinite amounts of money on cybersecurity against external threats, but often the biggest breaches come from the inside.

“What you do is put controls in place so that very few single people can do full amounts of harm to your business. For example, a business that needs to provide updates to millions of end points can only do so with the permission of a number of people, not a single person. This effectively means the key to the 'crown jewels' are guarded by a team,” Brown says.

Brown also shared an interesting solution for the internal security conundrum that he is yet to implement with his team at SolarWinds MSP, but one that he would like to put in place in the near future.

“For people that have more access, you treat them specially. I'm a big fan of compensating and watching my 'crown' people more. I want to be able to take those people that need very high levels of access like my system admin and monitor their internal and external activities - and pay them 10 percent more for the hassle,” says Brown.

“To ensure the safety of our business, you have to give up some of your privacy but in return I will pay you more. That's the world we now live in.”

Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.