Many college students are hogging university networks and power consumption because of cryptomining

[captain_to_fire]

Secondary Sources: Bleeping Computer, Marketwatch, Stanford University

Primary Source: Vectra

 

Quote

*This student makes $30 a week mining bitcoin in his room.

 

Cryptocurrency mining, the process by which people use computing power to verify transactions on the blockchain, can be lucrative. And it’s happening more frequently on college campuses, according to a study released Thursday by cybersecurity company Vectra.

 

Miners who solve the complicated math problems called ‘proof of work’ to verify a transaction get a monetary cut of the transaction as a reward. Joey Dilliha, an 18-year-old freshman at Western Kentucky University, says he’s making $30 a week on his Bitmain Antminer rig simply by leaving it plugged in in his dorm room and running it with the school’s free electricity.

 

“I believe more people should be doing it,” Dilliha told MarketWatch. “It’s a super fun, and cool cheap way to be introduced to the market of mining.”

*Dilliha’s mining set-up in his dorm.

It's no surprise that cryptocurrecies especially Bitcoin created a monster. At the moment cryptocurrencies are associated with the following such as:

• Money Laundering
• Tax Evasion
• Cybercrime

This guy shown above have to cover his mining rig with a blanket during dorm inspection. I'm not surprised if mining rigs like that one above are banned in college dormitories simply because of the fact that students are abusing university resources including power. There's only so much that tuition covers and it will be too much financial burden for the university to pay a high electric bill. Also I think those mining rigs can pose a danger of catching fire if overclocked and not cooled properly. That's why other universities such as Stanford called for a complete ban of cryptomining inside campus saying:

Quote

Cryptocurrency mining allows “miners” to earn financial rewards for validating cryptocurrency transactions. Michael Duff, the university's chief information security officer, explained that “Cryptocurrency mining is most lucrative when computing costs are minimized, which unfortunately has led to compromised systems, misused university computing equipment, and personally owned mining devices using campus power.”

 

Per university policy, Stanford resources must not be used for personal financial gain. As such, community members are prohibited from using university resources (including computing equipment, network services, and electricity) for cryptocurrency mining activities outside of faculty sanctioned research and course work.

But from the perspective of the student named Dilliha, he got to do what it takes to offset costs of living and taking advantage of the university's tuition paid electricity is one of them. He bought the mining rig from eBay and he said he's earning $30 a week which may not seem a lot but in a month that would be enough to pay his phone bill and save the excess in a bank or spend it on something else. But students also have to understand that they are abusing their privileges so it shouldn't piss them off if school authorities come knocking at their dorm rooms and seizing their mining rigs.

 

Another incident is in Arizona State University when a college student posted something on Reddit last year about mining Bitcoin using Nice Hash with two GTX 1080TI. 

Some people suggested using a VPN but OP said it made things slower. As reported by Vectra, higher education is one of the targets in cryptojacking.

One reason they point out is sloppy as Bleeping Computer says,

Quote

University networks are poorly secured

"Corporate enterprises enforce strict security controls to prevent cryptocurrency mining behaviors," Vectra researchers say. "However, universities do not have the same luxury with students."

 

Instead, university networks include minimal security controls, which often aren't enough to prevent or even detect infections in time.

Universities usually leave students and professors alike to secure devices on their own, and don't provide any additional protection except occasional warnings to patch systems and avoid opening suspicious emails.

 

Unless this changes, researchers see more malware-related activities finding a cozy home on university networks in the future, and cryptocurrency mining gaining wider adoption among students as they realize they could abuse university networks to redeem some of their tuition costs.

Just like the student from University of Iowa who cheated by changing his grades 90 times and later got kicked out, it makes me wonder how do school administrators allocate and spend all their earnings because security is something not to be taken seriously. I'm by no means an IT administrator or a CISO/CSO but they can implement deep packet inspection to their networks to block access to mining sites as well as blocking VPN access, tighter firewall rules and enabling "default deny" in computers within campus like computer labs and librariers. Windows 10 Pro, Enterprise and Server 2016 has built in default deny feature called "AppLocker" which is integrated to Windows Defender Antivirus.

Quote

AppLocker advances the app control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps.

Using AppLocker, you can:

• Control the following types of apps: executable files (.exe and .com), scripts (.js, .ps1, .vbs, .cmd, and .bat), Windows Installer files (.mst, .msi and .msp), and DLL files (.dll and .ocx), and packaged apps and packaged app installers (appx).
• Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. For example, you can create rules based on the publisher attribute that is persistent through updates, or you can create rules for a specific version of a file.
• Assign a rule to a security group or an individual user.
• Create exceptions to rules. For example, you can create a rule that allows all Windows processes to run except Registry Editor (Regedit.exe).

Third party enterprise solutions also has default deny features and are extended to USB flash drives which will not only block blacklisted programs but also access to USB flash drives that might be harboring cryptomining malware. Some people in the forum have suggested "No Script" but as it turns out, it not only cripples your web browsing it can easily be circumvented as some cryptojacking techniques are way sneakier than merely injecting mining scripts in websites as many of them take advantage of unpatched vulnerabilities. [Sources here, here, here, here]

Quote

Cryptojacking and cryptocurrency mining are profitable, opportunistic endeavors that will likely increase as they replace ransomware and adware as the de facto method for individuals looking to make a fast buck. - Vectra

I agree that ransomware has lost its spotlight in a matter of months and cybercriminals have shifted to mining cryptocurrency. But it only shows that some broke college students have to resort to mining just to pay their dues even using electricity and internet that is not their own. I've said it once in a status update but I'll say it again, I want to see cryptocurrencies to crash and burn.

[RagnarokDel]

if these universities internet is getting clogged by miners, it's time they upgraded from their landlines.

[RAM555789]

I have a friend who mines Etherum with his GPU when he's not gaming and doing stuff on it, but he's never gotten in trouble for it. ALso, my speeds have never been affected, or slowdown, ect. Right now on a google speed test, I'm getting 315 megabits per second download and 190 megabits per second upload. (I'm also using an ethernet cable)

[captain_to_fire]

4 minutes ago, huilun02 said:

Such enterprising kids they grow up so fast

Does cryptomining take a lot of bandwidth though?

I'm sure this usage just ends up paid for as part of school fees

Bandwidth may not be but electricity on the other hand can get very expensive with mining

[Asche]

5 minutes ago, huilun02 said:

Such enterprising kids they grow up so fast

Does cryptomining take a lot of bandwidth though?

I'm sure this usage just ends up paid for as part of school fees

No. Drop in the ocean. You can mine with a cellular connection.

[leadeater]

Wow, I'm one of the only 3 that have actually mined at work/school. Surprised it's not more than that, or maybe people aren't owning up to it..... .

 

Though I was only testing and didn't enter my wallet ID.

[captain_to_fire]

4 minutes ago, huilun02 said:

And can be included in school fees

Do you think students and parents would be so pleased that tuition will increase because of paying higher electric bills because of miners?

[Sauron]

@hey_yo_ 30$ per week? By the time that asic pays for itself he'll be almost out of college... and it will only pay for itself because he's stealing power. I don't have a lot of simpathy for US private colleges though and they don't use taxpayer money, so... I find it hard to condemn the guy.

[Ryujin2003]

6 minutes ago, huilun02 said:

And can be included in school fees

Yes, because it's fair for others to have to pay increased tuition to offset the increased power bill from other students who are mining? It's definitely a minority of the population.

 

Should should make their networks better, but will probably Jack up tuition because that's easier.

[captain_to_fire]

1 minute ago, Sauron said:

@hey_yo_ 30$ per week? By the time that asic pays for itself he'll be almost out of college... and it will only pay for itself because he's stealing power. I don't have a lot of simpathy for US private colleges though and they don't use taxpayer money, so... I find it hard to condemn the guy.

Most college students in the US have student loans so the extra $120 a month is not enough to cover up the interest alone.

[captain_to_fire]

4 minutes ago, leadeater said:

Wow, I'm one of the only 3 that have actually mined at work/school. Surprised it's not more than that, or maybe people aren't owning up to it..... .

 

Though I was only testing and didn't enter my wallet ID.

No deep packet inspection?

[CommandMan7]

I've done this kinda - my university contracted a private entity to run and manage the official "dorms" on campus, so I figured if they wanted to screw me with 900$ rent for a crappy windowless room, they can support me using $20 more of electricity. If the dorms were actually university owned and operated, that'd be different.

[Ryujin2003]

1 minute ago, Sauron said:

@hey_yo_ 30$ per week? By the time that asic pays for itself he'll be almost out of college... and it will only pay for itself because he's stealing power. I don't have a lot of simpathy for US private colleges though and they don't use taxpayer money, so... I find it hard to condemn the guy.

They don't use tax payer money, but they still have links to any cities they are in. The private University I'm at, I'm pretty sure they pay reduced bills because of how much revenue they bring into the city with athletic events, tourists, and the sheer student population.

[MyName13]

Parasites...

[leadeater]

9 minutes ago, Ryujin2003 said:

Should should make their networks better, but will probably Jack up tuition because that's easier.

Really has nothing to do with their networks, it's mostly power. It's also not simply because it costs money per kwh used either. When buildings are constructed the power design for the building only take in to account it's normal purpose so all the electrical work is done only with that in mind.

 

To upgrade a building's capability from say 10kwh to 30kwh is tens of thousands of dollars, if not hundreds and would require significant power outage.

 

That's what the colleges are actually worried about, it's not the cost of power it's the load. 

[Ryujin2003]

1 minute ago, CommandMan7 said:

I've done this kinda - my university contracted a private entity to run and manage the official "dorms" on campus, so I figured if they wanted to screw me with 900$ rent for a crappy windowless room, they can support me using $20 more of electricity. If the dorms were actually university owned and operated, that'd be different.

Actually, that's a good point. I don't live in the dorms, so I forget it's seriously a small jail cell... I mean the kid pictures doesn't even have drywall, he's got painted cinder block... Do I can understand with that. Schools need to do better with that.

[captain_to_fire]

Just now, huilun02 said:

Student and parents will be pleased to know that they are paying for what they use. The university should not take the hit as they did nothing wrong. Let parents and students sock each other for the repercussion of their own deeds.

But remember that universities and colleges are the ones paying the bills including power and bandwidth and they have the right to restrict what's allowed and what's not so college students have no choice but to suck it up once school authorities came seizing mining rigs as they can be considered as contraband. Just look at what Stanford did.

[leadeater]

6 minutes ago, hey_yo_ said:

No deep packet inspection?

Systems Engineer, liberties were taken to feed the "I wonder" monster. Wasn't done in secret either, we all wanted to know what all our old servers collectively could do 

[Ryujin2003]

Just now, leadeater said:

Really has nothing to do with their networks, it's mostly power. It's also not simply because it costs money per kwh used either. When buildings are constructed the power design for the building only take in to account it's normal purpose so all the electrical work is done only with that in mind.

 

To upgrade a building's capability from say 10kwh to 30kwh is tens of thousands of dollars, if not hundreds and would require significant power outage.

 

That's what the colleges are actually worried about, it's not the cost of power and the load. 

I would think there would be was to try and block crypto traffic to try and hinder the students abilities.

 

But you bring up other good points too that I didn't think about. Considering many forms are old AF, I'm sure the construction isn't even close to being able to hold this load for long before things start dipping and shorting.

[captain_to_fire]

1 minute ago, leadeater said:

Systems Engineer, liberties were taken to feed the "I wonder" monster. Wasn't done in secret either, we all wanted to know what all our old server collectively could do 

I don't know if my university will do a similar ban to mining granted that dorms inside are very limited but power outages happen at least ten to twenty times a year especially during typhoons and they have to rely on big and noisy diesel generators so it makes sense if they're going to ban mining rigs as those can hasten diesel consumption.

[iRileyx]

16 minutes ago, leadeater said:

Wow, I'm one of the only 3 that have actually mined at work/school. Surprised it's not more than that, or maybe people aren't owning up to it..... .

 

Though I was only testing and didn't enter my wallet ID.

The pc's in my work are literally from the 90s/early 2000s (post office) so they're not even worth mining on haha. 

 

Oh there's a sticker on the case.. Apparently its running an Intel pentium II.

[leadeater]

5 minutes ago, RKRiley said:

Oh there's a sticker on the case.. Apparently its running an Intel pentium II.

You're going to pass up a free 1c per week?

[Ryujin2003]

2 minutes ago, leadeater said:

You're going to pass up a free 1c per week?

He's gonna pop a capacitor, lol

[leadeater]

2 minutes ago, Ryujin2003 said:

He's gonna pop a capacitor, lol

Just hit the turbo  slow down button.

 

[Teddy07]

I talked to someone with the students association. He said that someone was caught their association PCs to mine Bitcoin. I don't quite understand it, because I assume it only makes a cent a week or so. I don´t mine so I don´t know.