Google Cloud Adds New Cryptomining Threat Detection Capability (therecord.media) 6
Google has launched today a new security feature for Google Cloud tenants that is meant to detect and block cryptomining operations that may be taking place behind the owners' backs. From a report: Named Virtual Machine Threat Detection (VMTD), Google said this new feature is an agentless system that continually scans the memory of virtual machines deployed in Google Cloud environments for tell-tale signs of increased CPU or GPU usage -- specific to cryptomining operations. To avoid false-positive detections, the feature has been left disabled by default; however, any customer can enable it for their GCP VMs. They can do this by going to the Settings page of their Security Command Center and looking under the Manage Settings section. Google said the feature will only work with non-sensitive memory, and VMTD will not process memory from nodes marked as "Confidential." VMTD has begun rolling out today for public preview, so tenants are recommended to enable it for smaller portions of their nodes and keep a close eye on its impact on performance.
Don't let them kid you... (Score:5, Interesting)
They originally invented this feature for themselves, to catch people signing up for Google Cloud trial accounts and setting up CPU crypto miners with the free service credits. GPU mining has probably never really been a big problem for them, because they also restrict GPU usage for trial accounts.
It's probably saved them a lot of money, and it will probably save them even more once they can use this tool to find hackers hiding crypto mining workloads within legitimate instances stood up for another purpose.
Re: (Score:2)
This would benefit everyone.
On a shared multi-user machine, RAM bandwidth is a valuable resource.
When RAM is 10x slower than CPU cache, and one instance wants to hog it all, everybody loses.
They're not trying to fool you. (Score:2)
Re: (Score:2)
Behold! My newest cryptocurrency algorithm invention! Proof of Web Page Served. Try to detect this as abnormal traffic, Google! Ahahahaha.
Next step: Any content they do not like (Score:2)
Also, the scan results will be used for ad-targeting.