An Analysis of the Threats Posed by Botnet Malware Targeting Vulnerable Cryptocurrency Miners

Abstract

Since the invention and popularisation of blockchain technology, we have seen a recent surge of attacks targeting cryptocurrency infrastructure. Alongside this, botnet malware has become a staple within threat actors’ toolkits, and have often been used to target a wide range of devices. This paper explores the threats that a custom built botnet poses when used to target cryptocurrency mining software. The botnet within this project is developed in the programming language Golang, due to its effective networking and utilisation in the malware development sector. The targets of the attack will be a cryptocurrency miner, and for ethical reasons a proof-of-concept miner will be used for testing. For evaluation purposes a fully virtualised network is used, with practical exploitation taking place to evaluate some metrics of performance for the botnet. With these metrics, the potential threats posed are then explored, with the main attack vector discovered being defined as “forced pooling”. Through this attack vector we show how this unique threat facilitates a variety of different attacks, both on and off chain including a “51% attack” and password cracking; exploring how a potential distributed supercomputer can be used as an attack tool.