How Chia Mining Can Enable Cloud Storage Cryptojacking
Summary
The article explains why Chia’s proof-of-storage model may appeal to cryptojackers and how large cloud storage usage can evade some common monitoring. It outlines cost, logging and detection considerations for defenders.
Key points
- Chia mining uses large proof-of-space plot files rather than the compute resources used by proof-of-work mining.
- The article argues that Chia may appeal to cryptojackers because miners do not need to provide upfront collateral for stored data.
- Mining can abuse cloud storage such as S3, and costs can scale substantially while the attacker avoids paying the cloud bill.
- Storage use may be harder to spot than compute abuse: AWS CloudTrail does not record S3 data-level events by default, and using an existing resource may not generate a creation event.
- Suggested detection measures include monitoring unexpected cloud-cost increases, identifying mining binaries or 108GB plot files, checking for accessible TCP port 8447, and investigating lookups to subdomains of chia[.]net.
- The article says proof-of-storage cryptojacking is less common than proof-of-work mining, but recommends defenders remain aware of it.
Article Details
- Topic
- Proof-of-storage cryptojacking using Chia in cloud environments
MITRE ATT&CK
Vendors
Amazon Web ServicesWhen cryptojacking is used against compute resources, there are a number of service quotas on AWS that an attacker is likely to bump into that require them to request limit increases. A common service limit people reachGCPa 5PB limit per storage account. With roughly 60 regions in Azure, this means an account can use 7.5 EB. GCP doesn’t appear to have storage limits. Microsoft Azuresomeone can create, there are no limits on the amount of data someone can put into a single S3 bucket. On Azure, there is a limit of 250 storage accounts that can be created per subscription per region, with a 5PB
Products
AWS LambdaProof-of-work mining can abuse any sort of compute, such as EC2 instances, containers, or Lambda. Similarly, proof-of-storage could abuse any sort of storage. Therefore, someone could use multiple, massive EBS volumes,ChiaIt mentioned a lesser-known cryptocurrency they had seen, named Chia.CloudTrailWhen AWS EC2 instances or other compute resources are created, there are CloudTrail events which makes proof-of-work cryptojacking easier to identify and remediate.EBSproof-of-storage could abuse any sort of storage. Therefore, someone could use multiple, massive EBS volumes, or they could use S3, along with many of the other storage options. We’ve seen one tutorial (thatEC2Proof-of-work mining can abuse any sort of compute, such as EC2 instances, containers, or Lambda. Similarly, proof-of-storage could abuse any sort of storage. Therefore, someone could use multiple, massive EBS volumes,S3abuse any sort of storage. Therefore, someone could use multiple, massive EBS volumes, or they could use S3, along with many of the other storage options. We’ve seen one tutorial (that was removed) that showed how