Thanks to hackers, you might be mining cryptocurrency without realizing it

Cryptocurrencies have been on a wild ride this year, and criminals are cashing in.

The number of cryptomining attacks — a kind of malware that harnesses a user’s computer power and uses it for mining cryptocurrencies — are up 629% in the first quarter of 2018, according to a report released Wednesday by McAfee.

Thousands of people are being targeted by these attacks, said Martin Hron, a security researcher at Avast, a Prague-based computer security company. Mining is the process of verifying transactions on the blockchain, the digital ledger on which cryptocurrencies are built. Solving the cryptography behind a transaction and verifying it releases a financial reward to the users who do it, incentivizing the mining process.

The hack causes minimal disruption for users, so it’s easy for hackers to take over a machine for months. If your smart TV isn’t running well, for instance, a cryptojacker could be to blame. Some people don’t know they’re targeted until they see they have unusually high electricity bills, Hron said.

In one experiment conducted by Avast, a cell phone’s plastic casing actually melted because it was being used to mine cryptocurrencies.

It can be more obvious, though: In one experiment conducted by Avast, a cell phone’s plastic casing actually melted because it was being used to mine cryptocurrencies. Cryptojacking can significantly lower the lifespan of your devices, he said.

Some miners claim to make hundreds of dollars per day doing relatively little work mining. Splitting up the mining work between many computers allows hackers to cash in on the rewards without monopolizing their own computer’s power, saving them on an electric bill. Mining is a power-heavy process that requires more power per year than the entire country of Denmark.

Hackers recently targeted websites

Hackers have recently exploited a vulnerability in content management systems (the templates on which websites are built) that allowed to gain complete control of certain websites.

Drupal, the content management system that was exploited in this alleged attack, is used by 4.1% of websites, and hackers have infected about 1% of those with malicious content, according to Jessica Ortega, a researcher at website security provider SiteLock.

These hackers are most often harnessing computer power to mine Monero a cryptocurrency that’s popular with criminals due to its anonymity and because it doesn’t require as much computer power as other currencies to mine, said Chris Morales, head of security analytics at Vectra, a San Jose, California-based provider of automated threat management solutions.

Bitcoin  is built on a public ledger, while Monero’s ledger does not publicly connect transactions to one another.

He said many hackers have started to use cryptomining attacks rather than ransomware, which requires more work to deploy. “This can lead to a much higher return on investment for attackers,” he said.

Here’s how you can find out if your computer is being used to mine cryptocurrencies:

Are your electronic devices acting strangely?

The first sign your device is being used to mine cryptocurrencies is that it will start slowing down or not working as well, Hron said. Because smart devices like cameras or light bulbs that connect to the internet are often targeted with these hacks, users can’t see that they are malfunctioning because they don’t have screens. “That is a big issue,” Hron said. “The only way to know the device is infected is just by detecting some unusual behavior of the device.”

Do you have 1234abc as your password?

Because these attacks are difficult to detect, it’s important to prevent them before they happen. That means, at the very least, changing passwords on devices right when they are activated. If the password on your router is still the long string of numbers it came with, it’s time to change it—if not, it’s possible your devices could be vulnerable.

The router is the most important device to secure, Hron noted, because it is the gateway to every other connected device in your home. “It is very convenient for a user to take a router out of a box and plug it in, but we should change the way we approach this,” he said. “The only solution to securing your devices at home is to protect your home network.”

The router is the most important device to secure, because it is the gateway to every other connected device in your home.

Does your laptop or desktop use protection?

While they won’t catch everything, virus protectors like McAfee Antivirus, Symantec Norton AntiVirus, Avast Pro Antivirus, and F-Secure are good ways to keep an eye on whether a harmful virus has been installed on your computer. Most retail for $30-50.

You can also download an antivirus app on your phone, but it may slow down the speed of the device, exacerbating the same problem cryptojacking creates that you are trying to prevent.

When did you last download security updates?

Or, better yet, keep your phone up to date to avoid vulnerabilities. Never ignore pop-ups or prompts on your phone or computer to install security updates. The majority of attacks in 2017 exploited known vulnerabilities, according to Avast, which means they could have been prevented if users had properly installed security update patches.