10-31-2017 05:54 AM
Detailed description can be found here :
How does one actually block this?
When I visit for example https://coinhive.com/ and push the button "Start Mining" the CPU goes up to 100%.
12-12-2017 03:05 AM
12-29-2017 11:13 AM
I'm really surprised this is classified as low severity? This can get onto servers and spike CPU to 100% to take down applications.
Also, I don't think these mining websites should be listed as
Auctions?? coinhive malware was going around injecting user's PCs......
They're saying minexmr.com is malware because it was recently used in a malware mining injection incident, however couldn't you use any miner website with the injection?
Needs to be a new URL PAN-DB category for Cryptocurrency, in my opinon.
Clean this up PAN, this is going to be one of the biggest issues in 2018 against networks in my opinion. Make this a priority.
02-06-2018 01:45 PM
I feel that the Palo Alto Networks response to crypto jacking is disappointing. There is a security reaseacher that is actively tracking cryptomining domains and (as of now) is maintaining up-to-date lists of these domains. You can add the first two lists "all domains" and "all optional domains" to an External Dynamic List and then edit your exsiting Anti-Spyware policies to sinkhole those domains. As of this post, there are 3,898 domains in those two lists (combined).
02-06-2018 08:19 PM
I see the two CoinHive signatures have have had their severity increased to medium which is set to reset-both in our environment.
02-07-2018 07:21 AM
Thanks @kalakai for the links. Good stuff.
What is the advantage over using a sinkhole over just using a DBL and setting the rule to block completely?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!