Cb Defense: How To Use Cb Defense to Help Protect Against Binary Cryptojacking

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Explain how to use Cb Defense to help protect against binary cryptojacking attacks

Environment

• Cb Defense Sensor: Version 3.x 
• Cb Defense Web console: Version .40 and above
• Microsoft Windows: All Supported Versions
• Apple MacOS: All Supported Versions

Resolution

The "Advanced" Policy in Cb Defense provides the best protection against this kind of attack.

NOTE: as with any policy changes, please test any changes first before putting into production to help mitigate performance and false positive blocking issues.

Navigate to your Cb Defense Console, go to the "Advanced Policy" ( or copy the advanced policy) and make the following policy changes:

1. In the "Local Scan Settings" tab, enable On-Access File Scan mode to "Normal".
2. Enable "Allow Signature Updates" and choose a reasonable Frequency and Staggered Update Randomization Window for your environment ( default is 4 hours).
3. Save the changes to your policy.
4. go to "Cb Defense Settings" and Check " Submit unknown binaries for analysis".

After the changes have been made, Put the endpoints you want to protect into the policy. 

 

 

Additional Information

• Cryptojacking is the secret use a computing device to mine cryptocurrency by malicious actors.
• Binary-based cryptojacking involves downloading and writing a binary onto the file system (as opposed to in-memory of a browser) containing a cryptominer.
• This downloaded binary is then executed to mine for cryptocurrency.
• Complex calculations are done on the endpoint to update cryptocurrency blockchains. This generates new fees, which the attacker then deposits into a cryptocurrency wallet, while the victim bears the cost of excessive electricity use and negative endpoint performance.