Measuring Cryptocurrency Mining in Public Cloud Services: A Security Perspective

Abstract

Cryptocurrencies, arguably the most prominent application of blockchain systems, have been on the rise with wide mainstream acceptance. A central entity in cryptocurrencies is “mining pools”, groups of cooperating cryptocurrency miners who agree to share block rewards in proportion to their contributed mining hash power. Despite the many promised benefits of cryptocurrencies, they are equally utilized for malicious activities, e.g., ransomware payments, stealthy command, and control, etc. Thus, understanding the interplay between cryptocurrencies, particularly the mining pools, and other essential infrastructures for profiling and characterization is necessary.

In this paper, we initiate the study of the interplay between mining pools and public clouds by analyzing their communication association through passive domain name system (pDNS) traces. We observe that 24 cloud providers have some association with mining pools as observed from the pDNS query traces, where popular public cloud providers, namely Amazon and Google, have almost 48% of such an association. Moreover, we found that the cloud provider presence and cloud provider-to-mining pool association exhibit a heavy-tailed distribution, emphasizing an intrinsic preferential attachment model with both mining pools and cloud providers. We measure the security risk and exposure of the cloud providers, as that might aid in understanding the intent of the mining. Among the top two cloud providers, we found almost 35% and 30% of their associated endpoints are positively detected to be associated with malicious activities, per the virustotal.com scan. Finally, we found that the mining pools presented in our dataset are predominantly used for mining Metaverse currencies, highlighting a shift in cryptocurrency use and demonstrating the prevalence of mining using public clouds.