The new miners: Wave of crypto mining at colleges, businesses raising hacking concerns
- An enterprising Penn State student turned his dorm room into a makeshift bitcoin mining operation, underscoring the risks of the practice.
- Mining cryptocurrency consumes vast amounts of electricity, and insecure networks can be hacked easily.
It was the first day of freshmen year at Penn State's State College campus, and along with bed sheets, clothing and books, Patrick Cines had an unusual looking computer. He did not plan to write term papers or do research on it.
Instead, Cines planned on using it to make money while he was out experiencing campus life.
"I had basically a box, maybe a foot and a half by a foot and a half tall. It was sitting in, right at the foot of my bed. Had several graphics cards," said Cines, who graduated Penn State in 2017.
That odd computer box was what is known a cryptocurrency miner, a special machine used to find virtual currency. Cryptocurrency mining is a process used to create digital coins, like bitcoin. Computers are used to solve complex math problems to find coins that can be potentially worth a fortune.
Many currencies require specialized, high powered machines that use large amounts of electricity, and create excess heat.
"It felt like passive income because when you're at school, when you're taking an exam or you're doing your homework, you're prepping or going to student meetings, it's still back in your dorm room making money for you," Cines told CNBC.
But there was a problem…too much heat.
"It was unbearable… I had fans running, I had the window open," Cines said, describing what it was like when we first plugged his homemade miner in. "The first day I was living there, went to Home Depot, bought some dryer tubes, strapped them to the front, and used that to push all the hot air outside of my room."
But the heat is not the only issue. Some cryptomining software contains malware that could attack the campus's network.
"Cryptomining is largely viewed as a nuisance attack because somebody else is downloading malware to a machine you own and using it to make money for themselves," said Mike Banic, the vice president of marketing at Vectra, a cybersecurity company that makes software to detect mining and other issues.
"What they are not thinking about is the pivot where that attacker could then use that machine to then attack the organization. And then it becomes something that they do worry about," he added.
Cines is not alone. Vectra did a study of mining on 11 college campuses and found instances on mining at every school. In fact, the universities were seeing students set up mining operations between one to four times every day.
Yet many types of mining software communicate with computers across the globe, making it easier for them to be attacked by hackers. That breach can then spread from a student's personal computer across the university's network, according to Banic.
Cines said he heard of computers, but not at Penn State, that had been taken over by malware, but thinks the risk is low. "I think that's a separate vulnerability, and it goes more to the security that the schools have, or should have. I think mining itself does not open up schools."
Source: Patrick Cines
Sticker shock for electricity
Still, malware is not the only risk to universities. Mining by itself can send electricity bills soaring.
"I think there are a lot of universities that don't know this is happening. I don't think that they would want it to happen either, considering it costs $4,700 to mine one bitcoin. That's about 10 percent of the annual tuition at a private university," Banic said.
Cines was not paying his electric bill — Penn State was.
"I think students should be allowed to" mine for crypto, he told CNBC. "They're paying tuition. Their parents are paying tuition. That's covering electricity," he said. Cines was open about his mining activity and never hid it, but he never asked if it was allowed.
In a statement sent to CNBC via email, Penn State said it has "policies in place to oversee use of our campus' network, Internet and other IT resources, including the following policy: AD96 Acceptable Use of University Information Resources. All members of the University community have individual and shared responsibilities to protect the University's information assets and comply with applicable federal and state laws and regulations, and University policies."
However, the policy Penn State pointed out CNBC to does not mention cryptocurrency. With that in mind, other universities are more specific with their goal of stopping miners.
"We have an acceptable usage policy, which all students and employees have to view and agree to. And in the policy it says that you can't use institutional resources for personal gain, or for a crypto currency," said Patricia Patria, the vice president for information technology and chief information officer at Massachusetts' Worchester Polytechnic Institute (WPI).
Patria declined to say how often WPI detects cryptominers, but said "we see an increase in frequency as the value of Bitcoin increases."
WPI has sophisticated software that can detect mining down to the I.P. address of the computer it is coming from. When a student mining operation is detected, "We have a process to bring them into our IT office, they sit down with our security officer, we explain what they might've done wrong, because this is a university, so we educate here," Patria said.
"Sometimes they wonder why they can't do it, and we explain what a resource drain it is to our equipment and to electricity."
Additionally, the mining problem is not just happening on campus.
"Cryptomining is up 4.5 to 5 times. And it's across every place. Forty percent of those locations are enterprise businesses." Vectra's Banic said. "There are probably employees who, as you walk up to their desk, they switch what they're doing because maybe what they were doing was mining bitcoin."
In order to detect the mining, businesses need to look at their internal network, instead of just looking at outside threats.
"Most businesses are looking at what's happening from the internet to protect them from threats from the outside," Banic said. "You can actually kill the bitcoin mining process on the machine with the right kind of endpoint software."
As for Penn State graduate Cines, he said his dorm room mining made him approximately $10,000, and helped make him who he is today, working for a major tech company.
"[Mining] was my personal introduction to tech and being in the Blockchain space. So I was really excited to just see every single thing that I did afterwards definitely shaped my college career," he said.
On the Money airs on CNBC Saturday at 5:30 am ET, or check listings for air times in local markets.