This course aims to help learners understand and unveil the "stratum" of mining pools. By the end of the course, students will be able to identify stratum servers, hunt for interesting samples, perform static and dynamic analysis, extract stratum configurations from PCAPs, and utilize various tools like Stratum TCP Scanner. The teaching method includes theoretical explanations, practical demonstrations, and hands-on exercises. This course is intended for individuals interested in cybersecurity, particularly in the field of cryptomining malware and mining pool security.
Trick or Treat - Unveil the "Stratum" of the Mining Pools
Overview
Syllabus
Intro
ryptomining malware is still a thing
Mining pools 101
We developed different strategies to identify Stratum servers
Let's hunt for interesting samples
Processing workflow (static analysis)
Here are some way to specify Stratum server
Dynamic analysis
Extracting Stratum configuration from PCAPS
Looking for stratum servers over the Internet
Search Engines for Connected Hosts
Keywords to identify stratum servers
Identifying Mining Pool Websites
Extracting config: JS config file + API call
Extracting config: parsing HTML
Extracting config: (Parsing HTML) + API Call
Stratum TCP Scanner
Collected data
Default ports?
Scanning Internet
Docker exploitations?
Killing the competition
Very persistent miner
Taught by
NorthSec
