How to detect crypto mining?

Question

I would like to make a Nagios plugin which can detect crypto miners.

The problem is if the miner is single threaded and running on a multi core host, then the load avg will be below 1, which isn't by definition a problem.

Also I would like the plugin to handle hosts with different numbers or CPU's.

Question

If a host is running a miner (single or multi threaded) will I then always detect it if I say: crypto miner detected if the 3 load avg from uptime are almost the same?

That way I don't have to worry about number or CPU's. Correct?

Answer 1

If your cryptominer can be detected with a 100% usage on a single core you can use

mpstat -P ALL

And check if on %user column

mpstat -P ALL | awk ' { print $3 " " $4 } ' | grep -E "^[0-9]"

exist a single core that is near 100% continuously, I think that this can be done with a single awk line

Answer 2

I realize this tread is for programming and other higher level operations that I know nothing about

BuuuuT;

As someone with experience with crypto miners running on company hardware (E.G. I work at a family business and have been semi-allowed to run crypto miners) I can only offer the knowledge I have for myself.

IDS is not stopping me. We are running a Cisco Meraki MX67 with the AMP and IDS/IPS and I tested with all Blocked Website Categories, full lists, not top sites, and I am still getting through.

TLS and SSL on public ports (80, 443, etc)

my other option was to just use a VPN, which would be far less likely, as it is very noticeable. Even with split tunnelling, there would be settings on the local device to find.

The best bet is to log traffic, and look for outliers; crypto miners will always contact the servers listed in it's configuration.

Also crypto mining on CPU would stress the L2/L3 cache.

re-reading OP, web based attacks are tough, I am not sure how they work; but there would be a consistent connection made to a static server.

here is a link to a pool based web mining script meant to be implemented on a webpage; to run on a persons computer when they visit the site. It is old a defunct, but it may help give you some insight into how they function.

Answer 3

There are a few good answers here that may work in some cases, but they all assume the same thing: That you'd like to detect the presence of a miner after it's already running.

This would generally be best accomplished with a heuristic scanner and a library of hashes for detecting already-known applications. I'm not aware of the existence of such a project, but it may be an integrated function in some kind of security suite / malware scanner. However, if a malicious application of any kind is already running then you're very late to the game.

All of that aside, a more reasonable (and easier) approach here would be to keep that miner from getting onto your machine at all. Depending on what kind of avenue you're expecting these miners to come in via and what these systems do, you should lock down access to your systems to prevent this from happening. It generally shouldn't be permissible in any way that a user can install and subsequently execute a functional program of any kind unless that's exactly what they are supposed to be doing with a given resource.

While the above describes a methodology, it does not describe exactly how to mitigate this sort of thing. There are answers to that, but they'll be entirely dependent on your implementation beyond the most generic of recommendations.

For example, the audit daemon or rkhunter can be a good way to determine if anything "foreign" is running and who/what put it there. selinux provides a solid way to keep unapproved files from being executed in a context they should not. A good imaging/deployment system can help to allow graceful "nuking from orbit" and establish guarantees for a consistently "clean" system. Good security practices and scrappy deployment models make most of the worries regarding detecting threats irrelevant.

Answer 4

Most miner attacks that I have seen exploit a web application vulnerability such as Drupal's Drupalgeddon vulnerability, and subsequently add an entry to crontab to download the miner at certain intervals.

So surprisingly a good option might be to monitor your crontab file. This has the added benefit of detecting other similar attacks as well.

You can use the file monitoring plugin https://www.nagios.com/solutions/file-monitoring/ for example, to monitor the file size of /etc/crontab or whatever crontab file your web user (ie drupal or www-data) has access to.

Sidenote:

In addition you can install the nagiosgraph plugin http://nagiosgraph.sourceforge.net/ and manually review the graphs to identify spikes in CPU Load.

Answer 5

This comes down to awareness of your infrastructure, something 95% of all companies do not have.

First thing is that i would setup a monitoring system that will monitor CPU usage and process count, create a baseline for what is normal, what is yearly peaks and so on.

Monitor active processes. Together with my documentation and baseline i would decide what is normal and what is not. Example, if the server is a Tomcat server, i would expect to see processes that handles the Tomcat service itself, Java, HTTP-Requests, backup and so on. But if a rogue process suddenly appear i havn't seen before or the active process count suddenly jumps by 16, 32 or something in that regard, outside of peak and stays their, i can determine that it is not a normal process or processes for the operation of the server and i can investigate.

Havign a Intrusion Detection System in place is also critical, for a process to get initiated it needs to ask for CPU time in one way or another. The IDS system can monitor this, log it, and again if i see anything outside the norm i can investigate.

Based on the crypto "service" it might not ram up the CPU very high on the server, since you can throttle processes or spread it out over 32 cores or what ever your server is capable of. So i would monitor multiple things and from that determine what is going on.

In this regard i would say their is no direct way to determine this, unless you target a specific crypto miner.