Cryptojacking
Hijacking a victim's computing power or cloud infrastructure to mine cryptocurrency without its knowledge, whose harm takes the form of an outsized energy or cloud bill.
Cryptojacking means installing, on a victim's machines or in its cloud environment, a program that mines cryptocurrency for the attacker. Unlike ransomware, the attacker seeks to remain invisible as long as possible: it steals no data, encrypts nothing, and simply consumes resources. The harm is therefore of a kind traditional cyber policies did not see: no data breach, no interruption, but an electricity bill or, more often, a cloud services bill that can reach considerable amounts within days when the attacker launches hundreds of compute instances. Hence a specific cover, sometimes called resource fraud or utility fraud, which reimburses these costs under a sublimit. For the underwriter, cryptojacking is above all an indicator: it reveals exposed cloud credentials, administration consoles without authentication and no cost monitoring, exactly the defects a more ambitious attacker will exploit next.
In February 2018, security researchers revealed that attackers had entered the Kubernetes administration console of a large US carmaker, left without a password, to mine cryptocurrency on its cloud infrastructure, deliberately throttling consumption to avoid detection.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.