How to block Crypto Miner (javascript)

[Indorama_Ventures]

This week I noticed a "CoinHive Javascript Detection" in the logs of our Palo Alto.

When reading on the subject I noticed that there are websites around that use Javascript to start mining Crypto coins on the users' computer.

https://live.paloaltonetworks.com/t5/Community-Blog/Unauthorized-Coin-Mining-in-the-Browser/ba-p/183...

Detailed description can be found here :

https://researchcenter.paloaltonetworks.com/2017/10/unit42-unauthorized-coin-mining-browser/

I noticed in the Palo Alto blog that : PANDB is able to block URLs hosting Coinhive JavaScript.

My question:

How does one actually block this?

When I visit for example https://coinhive.com/ and push the button "Start Mining" the CPU goes up to 100%.

[mivaldi]

Sinkhole is meant to discover infected hosts when the only thing the firewall sees is queries sourced from an internal DNS server. (Internal DNS server obscuring real source IP's of hosts querying for malicious domains). The idea is that infected hosts may carry out a subsequent connection after resolving a malicious domain, and these will initiate new traffic to the *sinkhole ip* - therefore you would use the traffic logs to see which hosts are attempting to initiate traffic to the *sinkhole ip* (and discover which hosts are infected).

If that's not your topology, then it's better to block.

By the way, you can also set an EDL of type Domain to action 'sinkhole' in the Anti-Spyware profile.

[kalakai]

It is my understanding that you cannot use a "Domain" type EDL in a security policy as there is no way to select it. Domain type EDL's only show up in anti-spyware DNS Signature settings. Upon double checking all the lists that are available on the link I provided earlier, I do see an IP list, which can be used in a security policy; so you can directly block that way in addition to sinkholing.