While the cost of energy is the number one criticism against cryptocurrency miners today, another problem has emerged on cloud computing platforms in recent months, as some groups of miners are abusing free tiers of cloud service platforms to mine cryptocurrencies.
Previously cited in the attack and hijacking of unpatched servers, several continuous integration (CI) services are now complaining about these gangs, who register free accounts on their platform before moving on to new free accounts up to the trial period limit.
Although cryptocurrencies exist only in the digital world, a gigantic physical operation called "mining" takes place behind the scenes.
The gangs operate by registering accounts on certain platforms, signing up for a free tier, and running a cryptocurrency mining application on the provider's free-tier infrastructure. Once the trial periods or free credits have reached their limit, the groups register a new account and start the process again, keeping the provider's servers at their upper usage limit and slowing down normal operations.
The list of services that have been abused in this way includes services such as GitHub, GitLab, Microsoft Azure, Travis CI, Layer CI, Circle CI, Render, CloudBees CodeShip, Sourcehut, and Okteto . Over the past few months, developers have shared their own stories of similar abuse they've seen on other platforms, and some of these companies have come forward to share similar experiences.
Most of this misuse occurs in companies that provide continuous integration (CI) services. Continuous integration is the practice of automating the integration of code changes from multiple contributors into a single software project. This is a leading DevOps practice, enabling developers to frequently merge code changes into a central repository where builds and tests are then run.
Automated tools are used to verify the accuracy of new code before integration. A source code version control system is fundamental to the CI process. The version control system is also complemented by other checks, such as automated code quality testing, syntax checking tools, and so on.
In practice, cloud-hosted CI is achieved by creating a new virtual machine that performs the build, package, and test process, then transmits the result to a project manager.
Cryptocurrency mining gangs realized that they could abuse this process to add their own code and have this CI virtual machine perform cryptocurrency mining operations to generate small profits for the attacker before the attack. The limited lifespan of the VM expires and the VM is shut down by the cloud provider.
This is how cryptocurrency mining gangs abused the GitHub Actions feature, which offers a virtual infrastructure feature to GitHub users, to mine the site and mine crypto with GitHub's own servers.
GitHub and GitLab are not the only CI providers that have faced this abuse. Microsoft Azure, LayerCI, Sourcehut, CodeShip, and many other platforms have struggled with this activity, according to the report.
A company like GitLab, due to its larger size, can still afford to keep its offering of free CIs for its users by finding other ways to prevent misuse by crypto miners. But other small IC providers can't. Last Tuesday, in their decisions to protect their paying customers who saw service degradation, Sourcehut and TravisCI said they plan to stop offering their free IQ levels due to ongoing abuse.
But while revoking free-tier offers for service providers might be one way to limit the abuse they see, it's not the best solution for solo developers who use these offers for their open-source projects. An alternative solution, as Berrelleza proposes, would be to deploy automated systems that detect and respond to this abuse . However, building such systems requires resources that some companies can't allocate, and there's no guarantee that these systems will work as expected.