Slashdot Mirror

← Back to Stories (view on slashdot.org)

First Ever Malvertising Campaign Uses JavaScript To Mine Cryptocurrencies In Your Browser (bleepingcomputer.com)

Posted by BeauHD on from the first-of-its-kind dept.

An anonymous reader writes from a report via Bleeping Computer: Malware authors are using JavaScript code delivered via malvertising campaigns to mine different cryptocurrencies inside people's browsers (mostly Monero), without their knowledge. The way crooks pulled this off was by using an online advertising company that allows them to deploy ads with custom JavaScript code. The JavaScript code is a modified version of MineCrunch (also known as Web Miner), a script released in 2014 that can mine cryptocurrencies using JavaScript code executed inside the browser. Cryptocurrency mining operations are notoriously resource-intensive and tend to slow down a user's computer. To avoid raising suspicion, crooks delivered malicious ads mainly on video streaming and browser-based gaming sites (currently mostly Ukrainian and Russian sites). Both types of sites use lots of resources, and users wouldn't get suspicious when their computer slowed down while accessing the site. Furthermore, users tend to linger more on browser games and video streaming services, allowing the mining script to do its job and generate profits for the crooks.

70 comments

  1. Crooks? by Anonymous Coward · · Score: 0

    They just use resources which would have been wasted.

    1. Re: Crooks? by Anonymous Coward · · Score: 0

      Except that the processor could be put in a low power mode, reducing electricity usage and heat. So, yes, it does harm the people who encounter such malware. While it's less harmful than other malware, it is still harmful in some manner.

    2. Re:Crooks? by Opportunist · · Score: 1

      But that were cycles I wanted to waste on cat videos!

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    3. Re: Crooks? by Boutzev · · Score: 5, Insightful

      If an ad runs on your computer without authorization - it uses your computer's resources too. Is that somehow different just because ads waste less resources than mining ? What about a mining script that uses less ressources than the standard video ad - would they still be crooks ?

      While I don't agree with anyone running code on a user's station without authorization, there isn't much difference between this and a common ad. Both should be illegal if you ask me. But if those guys are crooks - then what would Google Adwords be ?

    4. Re: Crooks? by gnick · · Score: 0

      Is that somehow different just because ads waste less resources than mining ?

      Yes. Not just because ads use less resources, but yes it's somehow different.

      What about a mining script that uses less ressources than the standard video ad - would they still be crooks ?

      Yes. I object to the misrepresentation as much as I do the wasted resources. That doesn't excuse wasting my resources for an unrequested video.

      Both should be illegal if you ask me. But if those guys are crooks - then what would Google Adwords be ?

      This I like. I think we need better guidelines on acceptable behavior. As resources have become less precious, the advertisers have gotten pretty brazen.

      --
      He's getting rather old, but he's a good mouse.
    5. Re: Crooks? by Anonymous Coward · · Score: 0

      I'm the AC who wrote the post you're addressing. I think there is a key difference in that ads mining cryptocurrencies in the background are inherently deceptive. An ad that consumes lots of resources is annoying and unwelcome, but it's not deceiving me as to its purpose. When these ads start tracking me across multiple sites and building profiles about me without my consent, they cross that line back into deceptive behavior. Any hidden trackers on sites are also deceptive. And I view those as malware as well.

      A poorly designed ad that consumes lots of resources, such as loading and automatically playing videos, is very annoying and unwelcome, but it's not deceptive as to its purpose. The purpose of that ad is simply to sell me a product, although if it's that annoying, it's doing a terrible job of selling that product. I'd much prefer we go back to simple banner ads like the jpegs and animated gifs of the 90s. Sure, those consume resources as well, but it's quite low compared to other ad types, and I understand that those ads are necessary for sites to pay the bills without charging for subscriptions. I'd appreciate that the advertiser is trying to be reasonable and unobtrusive, so I'd also be a lot more likely to click the ads and buy their products. I think most users would gladly accept the compromise of allowing ads that don't track them or waste their resources.

    6. Re: Crooks? by K.+S.+Kyosuke · · Score: 1

      What about a mining script that uses less ressources than the standard video ad - would they still be crooks ?

      I vaguely recall that The Cuckoo's Egg mentions a case of someone convicted of stealing electricity in Canada since they couldn't prosecute computer intrusion at that time. So the amount of electricity is perhaps secondary. Also, CFAA in the US? I don't know how (if) that applies.

      --
      Ezekiel 23:20
  2. I block all advertising on the web by Anonymous Coward · · Score: 2, Informative

    So this doesn't affect me.

  3. Got to say by Anonymous Coward · · Score: 5, Informative

    Genius.

    Despite being one of the causes of adblocker proliferation it's a nice change from the usual destructive malware in ads.

    Must admit I've never really understood why advertising companies allow advertisers to run potentially unsafe code via their network. Surely it reflects badly on them and I'm too ignorant to understand the need for custom code with an advert.

    1. Re:Got to say by Anonymous Coward · · Score: 0

      My thoughts exactly. Just shown an image ad with a link. Stop clogging my browser with your shitty JS.

    2. Re:Got to say by AmiMoJo · · Score: 3, Insightful

      But how much currency can it mine?

      How long are ads displayed for? Probably not long in most cases. Many browsers, especially Chrome, throttle Javascript or even stop it running entirely to save energy when the user isn't interacting with the page. And Javascript isn't exactly known for its high performance when it comes to maths.

      A lot of processing will be wasted. Anything that ends before the minimum work unit that can be saved is complete is lost.

      If they are mining a popular currency the chances are Javascript running on a CPU will to too slow to earn anything significant. If they are mining a less popular currency it is now tainted by malware and unlikely to ever be worth much.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    3. Re:Got to say by Nutria · · Score: 5, Insightful

      And Javascript isn't exactly known for its high performance when it comes to maths.

      That was my first thought. People spend so much on top-tier GPUs for mining, and these guys go for JS.

      I bet the malware guys are using this as a proof-of-concept for something else.

      --
      "I don't know, therefore Aliens" Wafflebox1
    4. Re:Got to say by Anonymous Coward · · Score: 1

      Because the advertising companies don't need to care. It's the sites that show the ads that get the blame - and rightfully so.

      It used to be that a magazine that wanted advertising had an editor responsible for looking through the ads and rejecting any that didn't follow their standards. Nowadays they just use an ad network, and the ad network doesn't care.

    5. Re:Got to say by Anonymous Coward · · Score: 0

      But how much currency can it mine?

      ...

      If it's competing with Firepig^H^H^Hfox for the CPU, not much.

    6. Re:Got to say by Cederic · · Score: 2

      But how much currency can it mine?

      Does it matter? Fuck all multiplied a couple of million times can become a chunky number. As long as it's more than the cost of the advertising (which may be near zero if it's charged by click-through) then they profit.

      How long are ads displayed for? Probably not long in most cases. Many browsers, especially Chrome, throttle Javascript or even stop it running entirely to save energy when the user isn't interacting with the page. And Javascript isn't exactly known for its high performance when it comes to maths.

      That'll be why they targeted pages that users interact with for tens of minutes (up to hours).

    7. Re:Got to say by TheRaven64 · · Score: 3, Interesting

      I've noticed that a lot of web sites now cause my browser to ask me if I trust them to run WebGL code for no obvious reason (I don't, because I've worked on GPU drivers, and there's no way I'd trust them with potentially malicious code, even if it has had some token WebGL verification). JavaScript is fairly slow, but WebGL and WebCL let JavaScript run shader code on your GPU.

      Most cryptocurrency mining is probabilistic: you only win on average by having the most compute, each step involves trying a possible solution and hopefully getting lucky. If you try enough solutions in parallel, you'll probably find the correct one before anyone else. Even if each person only gives you 30 seconds of GPU time, that's still a lot if you can infect a few million people.

      I seem to recall a browser-based game a few years ago that used this exact business model: as you play the game, it mined bitcoin in the background on your GPU, which paid for the game.

      --
      I am TheRaven on Soylent News
    8. Re:Got to say by AmiMoJo · · Score: 2

      WebGL is mostly used for tracking. The sites render some text and graphics and slight variations in your system make the result semi-unique, and combined with other factors can be used to identify your browser as your move from site to site.

      As such, I disable WebGL entirely. I also use CanvasFingerprintBlock for the same reason.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    9. Re:Got to say by Anonymous Coward · · Score: 1

      Things might improve when publishers decide on providing static advertising linked to content instead of networks that send the ad with the highest bid for the set of eyes they think are looking at it.
      And they won't because it would require hiring people to vet the ads and be responsible for making sure they fit the publisher's branding.

      Advertisers never cared about the content, because their most lucrative revenue stream was buying ad space from the publishers in bulk and reselling to their clients.
      Toss in

    10. Re:Got to say by geekmux · · Score: 3, Insightful

      And Javascript isn't exactly known for its high performance when it comes to maths.

      That was my first thought. People spend so much on top-tier GPUs for mining, and these guys go for JS.

      I bet the malware guys are using this as a proof-of-concept for something else.

      How many people have a JS enabled-browser installed vs. how many people have top-tier GPUs installed?

      The performance all comes down to volume. And with Bitcoin valued at over $3000, I doubt that something else needs be a motivator.

    11. Re:Got to say by geekmux · · Score: 1

      ...it's a nice change from the usual destructive malware in ads.

      Guess that all depends on where the Bitcoin profits go.

      Funding physical destruction wouldn't be a hard stretch in a warmongering environment.

    12. Re:Got to say by sirber · · Score: 1

      And Javascript isn't exactly known for its high performance when it comes to maths.

      the project uses asm.js for optimal speed.

      --
      Be or ben't
    13. Re:Got to say by nehumanuscrede · · Score: 2

      What they lack in quality, they make up for in quantity.

      "Furthermore, users tend to linger more on browser games and video streaming services, allowing the mining script to do its job and generate profits for the crooks."

      Stick this code on any porn site or any high-traffic video site and consider how many folks stop by.

    14. Re:Got to say by Nutria · · Score: 2

      The performance all comes down to volume.

      And ratios: how many JS miners do you need to equal a current (affordable) GPU card, combined with -- as AniMoJo first mentioned -- the fact that when you stop browsing, any partial work disappears. That's really a killer.

      --
      "I don't know, therefore Aliens" Wafflebox1
    15. Re:Got to say by CastrTroy · · Score: 1

      Better be careful, or someone will figure out how to mine BitCoins using WebGL in the background while you're playing a browser based game.

      --

      Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
    16. Re:Got to say by geekmux · · Score: 2

      The performance all comes down to volume.

      And ratios: how many JS miners do you need to equal a current (affordable) GPU card, combined with -- as AniMoJo first mentioned -- the fact that when you stop browsing, any partial work disappears. That's really a killer.

      And yet can you imagine the performance if legitimate companies that offer streaming services (Netflix,YouTube, etc.) embedded JS mining as a "feature" on their sites?

      The world never stops browsing, which is why volume matters.

    17. Re:Got to say by angel'o'sphere · · Score: 3, Interesting

      Could have answered to you plus + answer ;D
      But here it fits better.

      First of all: JavaScript is since a decade no longer as slow as people think. Nearly all browsers optimize it and jit compile it to assembly.

      Secondly: http://gpu.rocks/

      --
      Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
    18. Re:Got to say by AmiMoJo · · Score: 1

      Thanks, that's an interesting link.

      I'm really glad I block WebGL.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    19. Re:Got to say by angel'o'sphere · · Score: 2

      Asm.js is a library that implements a simple virtual cpu and the opcodes to execute on that CPU.
      The idea is that the jit compiler can compile simple real asm instructions from that. The other idea is that language designers can compile to asm.js instructions.
      That is in no way faster than writing the code you want in standard JavaScript.

      You confused by the word "asm" in asm.js :D

      Anyway, in the long run the developers of asm.js hope that JavaScript engines will be "asm.js aware" and realize that they can treat it special and compile to a more optimized native asm, than they would compile "ordinary JavaScript"

      --
      Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
    20. Re:Got to say by cdreimer · · Score: 1

      Because the advertising companies don't need to care.

      Unless advertisers start pulling their dollars. When advertisers noticed that their ads were being shown with extremist videos on YouTube, they pulled their dollars and content creators saw their YouTube earnings drop between 50% to 90%. That situation is still on going as YouTube tries to keep the advertisers happy.

    21. Re:Got to say by Nutria · · Score: 1

      I'll repeat again: when you stop browsing, any partial work disappears.

      The world never stops browsing, but people do.

      --
      "I don't know, therefore Aliens" Wafflebox1
    22. Re:Got to say by peragrin · · Score: 1

      Did you read the summary? They picked websites like web based games and video which people will interact with the page for 20-30-60 minutes at a time and are already a heavy CPU draw. To hide it.

      --
      i thought once I was found, but it was only a dream.
    23. Re:Got to say by Anonymous Coward · · Score: 0

      Their target pages are online game sites where Chrome would not throttle because the user is actively interacting or there is audio going on.

    24. Re:Got to say by geekmux · · Score: 3, Insightful

      I'll repeat again: when you stop browsing, any partial work disappears.

      The world never stops browsing, but people do.

      This is exactly why I mentioned streaming services. You can probably get some considerable crunching done when the word "binge" is often used to describe browser session times. Wouldn't be surprised one bit if the next YouTube/Netflix app upgrade comes with a few extra lines of JS.

      On top of that, I'll give it about another HFT micro-second before someone realizes the value of breaking up JS cryptomining assignments into 60-second chunks to try and counteract that "partial" work problem, and take advantage of this distributed mining model. Or perhaps they'll wrap this around something that is always running in the background; you've only got about 1,000 opportunities to do this with Win10 telemetry services...

    25. Re:Got to say by s_p_oneil · · Score: 1

      Anyone have a JavaScript OpenCL/CUDA/Vulkan plugin handy to use for this? ;-)

      TBH, I imagine they would want to use the asm.js subset for this. I'm not sure what the status is for browsers compiling it, but basic math operations would definitely be covered in the asm.js subset. Sure it wouldn't be GPU-powered, but these days most visitors would be using cell phones, tablets, or cheap netbooks/laptops with cheap integrated graphics.

      IMO, the worst thing about this wouldn't be when it happened on a laptop or desktop. It would be when it drained the battery on my cell phone (especially if it could keep chugging along when I put my phone to sleep while a web page was up).

    26. Re:Got to say by tlhIngan · · Score: 1

      And ratios: how many JS miners do you need to equal a current (affordable) GPU card, combined with -- as AniMoJo first mentioned -- the fact that when you stop browsing, any partial work disappears. That's really a killer.

      Well, when the CPU comes "for free" (they're using your CPU to make them money - the only cost is the ad campaign, and those are generally cheap because those are running on the second tier advertisers - the ad networks that do ads for "non mainstream" websites like torrents, porn, etc.

      And if you do it right, you can save your state when the user navigates away from the page - there are javascript hooks that can be called when you navigate away that can upload the current state to a server. It's how those "are you sure you want to leave this page?" alerts are issued.

    27. Re:Got to say by Anonymous Coward · · Score: 0

      Dear Slashdot fellows,

      Information about Christopher Dale Reimer and autistic people:

      Autistic people have obsessions about things normal people don't care. For example, one of our autistic patient went haywire when he realized that there was a penny missing in his pocket change.

      To calm him down, one of our educator pretended to have found it on the floor and gave a penny to him.

      The autistic patient condition went even worse because he realized it wasn't the same penny!

      Chris has an obsession with budgeting every penny. He doesn't understand that most people do not budget to the penny and have a flexible amount they allow for miscellaneous items.

      I am Nancy Guerrero and I am Director of Special Education for the Santa Clara County Office of Education. We use Chris' (a.k.a. creimer,cdreimer) picture in our document because he is the hardest case we have ever had to handle:
      http://www.sccoe.org/depts/stu...

      Our artists were inspired by the low carb diet that Christopher follows scrupulously for the small lunch box and by the picture linked below for the rest. I am sure that you will notice the similarities such as the bump on the side of his chest and more:
      https://www.cdreimer.com/slash...

      Please be easy on Christopher although, I am aware that some of our staff handling Chris post joke comments here and obvoiusly, the Santa Clara County Office of Education disapprove that behavior vehemently:
      https://school.discoveryeducat...

      But it isn't Chris' fault if he is the way he is. We do the best we can do with him and he is partially integrated into society. We try to cure his abnormal need for attention but he is kind of stubborn and won't listen to anybody.

      Thank You dear users,
      -Nancy Guerrero

  4. Don't run javascript. by Anonymous Coward · · Score: 0, Informative

    Yet another excellent reason not to allow javascript. Javascript is cancer of the internt.

    1. Re:Don't run javascript. by JaredOfEuropa · · Score: 2

      It has its uses. But it has absolutely no business being used in ads, just like other Javascript over which the site owner has no control. I wish blocking 3rd party Javascript by default was an option, but that pretty much breaks all of the Internet.

      --
      If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
  5. Saw it the other day on Hacker News by Anonymous Coward · · Score: 0

    Right... I saw this on Hacker News the other day: A Crypto Miner for Your Website. Of course, my mind is clean, didn't think about all the abuse it could cause.

  6. Brave browser wants to do this. by Anonymous Coward · · Score: 0

    They want you to mine Basic Attention Tokens in your browser as an alternative to ads.

  7. Getting my own back by Anonymous Coward · · Score: 1

    My laptop is so pathetic I'm wasting their time.

  8. Just wait until webGPU becomes popular. by Anonymous Coward · · Score: 0

    Apple's WebGPU means they can use GPUs to mine in the browser, not just CPUs. I expect a massive botnet of GPU miners to emerge in the future.

  9. Let's replace adverts with this. by Anonymous Coward · · Score: 3, Interesting

    Why can't websites replace adverts with this, working for them?

    That seems like a perfect way to get micro-transactions in a website without any micro-transaction having to occur, and it scales with time spent on the website.

    1. Re:Let's replace adverts with this. by thereitis · · Score: 2

      For one thing, it will kill the user's mobile/laptop battery.

  10. Could we find a legitimate use for this idea? by 91degrees · · Score: 4, Interesting

    Micropayments have never caught on because they're a pain to deal with. People might be willing to spend some of their CPU time though. They don't object too much to doing the millions of operations required for a few seconds of video (the objection is more the annoyance of the video itself)

    I suspect CPU time is not valuable enough to make this sort of thing viable but maybe I'm wrong.

    1. Re:Could we find a legitimate use for this idea? by Opportunist · · Score: 1

      Well, if you could get people to install an app...

      Oh no, I said the word!

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    2. Re:Could we find a legitimate use for this idea? by hord · · Score: 4, Interesting

      There are tons of distributed projects where people donate CPU time. It has value for communities of people that like to work on common computational goals. Examples are SETI, distributed.net, and folding@home. Here is Wikipedia's list:

      https://en.wikipedia.org/wiki/...

      I ran a Pentium 200MHz overclocked to 250MHz for several years straight (along with many other machines) trying to crack RC5-64 years ago. Lots of fun.

    3. Re:Could we find a legitimate use for this idea? by Rockoon · · Score: 1

      I suspect CPU time is not valuable enough to make this sort of thing viable but maybe I'm wrong.

      You are wrong because you are attributing the wrong metric.

      What this strategy cares about is cycles/watt. They might have a 300 watt server set up somewhere, but beyond that the cycles are all free. A million people all mining with javascript at the cost of that 300 watts.

      --
      "His name was James Damore."
    4. Re:Could we find a legitimate use for this idea? by 91degrees · · Score: 4, Interesting

      Yup, and those are great. I approve of the aspirational ideals.

      But I'm thinking of the more commercial aspects. For example, while I have no complaints about CGI movies, I'm not going to donate my CPU time to help make one. A company might be willing to pay me a fraction of a cent for rendering a few pixels though. I don't want that fraction of a cent. I do, however, want to be able to read websites without annoying popup ads. The website owner, with thousands of impressions per page per day would like that fraction of a cent for each page.

      So the computer animation company pays the website some money to run a few seconds rendering time on my PC. I get the web-page for a negligible increase in power costs, and the computer animation company gets some pixels. Multiply that by a few hundred thousand users. They all get the information they want, the computer animation company gets several frames rendered, and the website owner gets money.

    5. Re:Could we find a legitimate use for this idea? by 91degrees · · Score: 1

      This strategy only cares about dollars per cycle. If I want some computing done, I don't care how many watts it takes if those watts are being paid for by someone else.

    6. Re:Could we find a legitimate use for this idea? by Solandri · · Score: 1
      That doesn't really make much sense. Technically you're not donating CPU time. You're donating the price of the electricity to run the CPU to perform those calculations. Unless the project is transient (e.g. crack RC5-64, then it's over), the acquisition cost of the CPUs is tiny compared to the operational cost (electricity) to perform the actual calculations. A computer animation company is presumably going to continue to remain in the business of computer animation for decades, so it makes more sense for them to buy their own CPUs/GPUs and pay for their own electricity to run them, rather than use the money on advertising to run the calculations in Javascript much less efficiently.

      It's like that stupid idea which comes up every now and then to harvest energy from cars driving over roads. Yes it'll work, but you're not tapping some cheap form of energy. You're stealing energy from all the cars which drive on the road, and you're doing it very inefficiently because of all the mechanical losses involved in transferring energy from the car, to the road, to your energy capture device. The cumulative cost to all the cars (slight decrease in MPG) plus the cost of re-engineering the road to incorporate the energy capture device is several times higher than what it would've cost you to just build a power plant and generate the energy directly.

      That's really what the economic viability of this sort of thing hinges on: How energy-efficient is it to perform this sort of activity distributed over millions of people's computers, vs. doing the activity on your own dedicated equipment? In nearly all cases, it's more efficient to do it on dedicated equipment, and this idea is a non-starter.
      • The malware cryptocurrency mining works because the miners aren't paying for the costs. So even though it's less efficient, by externalizing the electricity cost it becomes a net benefit for the malware authors.
      • Likewise, Folding@home is less energy- and cost-efficient than if people just sent donations to the project to buy their own equipment and run their own protein folding simulations. The project is successful because people tend to lump their electricity bill into an "I gotta pay it" category, whereas a separate charitable contribution could end up axed when they think "I really don't have the extra money to be donating to this."
      • Donating CPU time to crack RC5-64 worked because it was a temporary project. Once it was completed, there was no need to do further computations. So if the team had acquired their own computers, they would've had to sell them at the end of the project at a substantial loss (depreciation). Doing it as a distributed project neatly avoided that expense by shifting that cost from the project onto the computer purchase and amortization schedules of computer owners around the world (which is near zero because people buy those computers anyway). But on a commercial scale (not taking charitable donations) this sort of activity is more cheaply performed by temporarily renting servers via a hosting service like Amazon EC2.

      Because of the relative inefficiency of Javascript, I can't really think of any activities where distributing it to browsers via ads is really cost- or energy-efficient. Maybe Amazon EC2 might find it useful if there were a sudden temporary spike in CPU demand which exceeded their servers' capability to deliver, and they needed to temporarily find some extra CPU cycles to take the additional load. But in every other case I can think of, it's cheaper to just buy your own computers or to rent time on them directly. The only way selling CPU time via browser ads is competitive is if you're actually stealing CPU time - selling the CPU time for cheaper than the extra electricity cost to the person running the browser. And at that point you've crossed the line from being a legitimate ad to being malware.

    7. Re:Could we find a legitimate use for this idea? by Anonymous Coward · · Score: 0

      Mod parent up-
      This was tried by a group of MIT's as a project they entered in a local hackathon. In this scenario you could voluntarily mine BTC on a website and the site turns off ads.

      They ended up being subpoenaed and told to hand over the source code. EFF got involved though I never heard the outcome. This could have just been a knee-jerk by the attorney general, though it's not quite tin-foil hat level to suspect the ad agencies had a hand in it.

      https://www.wired.com/2014/09/...
      http://www.businessinsider.com...

    8. Re: Could we find a legitimate use for this idea? by Anonymous Coward · · Score: 0

      They are paying to place those ads, right?

    9. Re: Could we find a legitimate use for this idea? by Anonymous Coward · · Score: 0

      Wow that's outrageous ... it's not even fraud, I would live to have my browser mine some bit coins for the site I'm on instead of seeing all the ads and pop ups and modal covers and click to read more.

    10. Re:Could we find a legitimate use for this idea? by 91degrees · · Score: 1

      Technically you're not donating CPU time. You're donating the price of the electricity to run the CPU to perform those calculations. Unless the project is transient (e.g. crack RC5-64, then it's over), the acquisition cost of the CPUs is tiny compared to the operational cost (electricity) to perform the actual calculations.

      I don't see why it matters what we're donating. As far as the customer is concerned, they send data to a third party, and they get rendered frames.

      A computer animation company is presumably going to continue to remain in the business of computer animation for decades, so it makes more sense for them to buy their own CPUs/GPUs and pay for their own electricity to run them, rather than use the money on advertising to run the calculations in Javascript much less efficiently.

      Pixar or Dreamworks, sure. A lot of these companies are a lot smaller. They don't want to have large server farms sitting idle most of the time. They lease a server farm. Plenty of companies provide this service already. My suggestion is to enter this market using distributed processing.

      They wouldn't be using Javascript. WebAssembly exists. That can be compiled and optimised pretty easily. Maybe not as well as targeted optimisation but we're only after compeitive efficiency here; not peak efficiency.

      Likewise, Folding@home is less energy- and cost-efficient than if people just sent donations to the project to buy their own equipment and run their own protein folding simulations. The project is successful because people tend to lump their electricity bill into an "I gotta pay it" category, whereas a separate charitable contribution could end up axed when they think "I really don't have the extra money to be donating to this."

      And this is the principle this works on. Except the psychology is wrong. People don't mind donating to the project. But the time cost is too great for people to feel it's worth the effort. Microtransactions are even worse, because people need to make the effort to pay a fraction of a cent. But this just uses their cycles when they're not using them. Yes, if they were willing to pay the microtransaction directly it would be cheaper, but they aren't. So charge them in something they are willing to pay. Reward them with something that costs a lot less than what they're paying.

    11. Re:Could we find a legitimate use for this idea? by Rockoon · · Score: 1

      This strategy only cares about dollars per cycle.

      Do you really think a valid retort is to restate what I said?

      You are part of the problem. You were pretending to have a reasoned argument, got caught out, and now rephrased "cycles per watt" as "cycles per dollar" (its the same thing, fucknut)

      --
      "His name was James Damore."
    12. Re:Could we find a legitimate use for this idea? by 91degrees · · Score: 1

      I don't understand your objection.

      People pay money for processing time. They don't care whether their processing happens on an ARM or a bunch of decade old Pentium 4s. They care how much it costs them. Not how much it costs ther person they're buying CPU time from.

      People would be willing to sell their processing power at a nominal loss, because they gain the convenience of not having intrusive ads, so the number of watts it costs them or the number of dollars it costs them are an irrelevance.

  11. Not sure why it took so long by Anonymous Coward · · Score: 0

    I'm surprised these scripts weren't already embedded everywhere

  12. Why the indirection? by Mal-2 · · Score: 1

    Why not write the mining and phone-home routines directly into the games that people are playing? It would probably improve efficiency considerably, and somewhere in the EULA it can be noted that the game is working on a distributed computing project in the background as the 'fee' for using their otherwise free game.

    --
    How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
  13. Shame on the ad network by cdwiegand · · Score: 3, Insightful

    What advertising network? They should be known, publicly shamed, and every website operator should know not to do business with them.

    Honestly, I wish there was a way for me to report an ad that's violating browser rules. I hate when I go to a real newspaper site that uses ads, and I get served an ad that takes over the whole window, hiding stuff behind, but there's no way for me, on my phone / tablet, to know who served the ad or report the ad placement. Makes me want to block all ads everywhere on my personal devices and networks, but THAT comes with issues because many sites and even many mobile apps refuse to function if they can't talk to the ad networks and/or Google/Adobe/etc..

    --
    . Define sqrt(x) as something really evil like (x / rand()), and bury it deep. Watch your coworkers go nuts.
  14. It doesn't stop your ads and spam by Anonymous Coward · · Score: 0

    Except it doesn't stop your ads and spam. 3 seconds after you manage to block a site another will just pop up because blacklisting is ineffective and easily circumvented. You offer kid sister level of security, nothing more. No go beat off to some conspiracy theory videos on youtube and complain about spooky dude and the jews some more.

  15. The importance of editing by argStyopa · · Score: 1

    I read "...mine different cryptocurrencies inside people's browsers (mostly Monero),..." and was like what's this new browser Monero that so many people are using that it's worth focusing malware on?

    Maybe it could have been written better as: "...mine different cryptocurrencies (mostly Monero) inside people's browsers,..."

    --
    -Styopa
  16. 8++ Security & Web pros disagree w/ you by Anonymous Coward · · Score: 0

    Malwarebytes hpHosts' hosts/RECOMMENDS me!

    Aryeh Goretsky/ESET/NOD32: hosts = good security http://it.slashdot.org/comments.pl?sid=7442373&cid=49747129/

    Oliver Day (SYMANTEC/SECURITYFOCUS) http://www.securityfocus.com/columnists/491/ "Host file accessing the Internet - particularly browsing the Web - is actually faster... Spybot Search & Destroy offer lists of known malicious servers to add a layer of defense against trojans & other forms of malware"

    OReilly hosts security -> http://oreilly.com/pub/a/windows/2004/03/30/hosts.html/ & hosts speed -> http://www.oreillynet.com/pub/a/network/excerpt/winxphacks_chap1/index1.html?page=3/

    Steve Gibson endorses hosts https://www.grc.com/sn/sn-045.htm/

    Brocke Wilders of WILDERS' SECURITY does inferior clone of MY work http://www.wilderssecurity.com/threads/hosts-block.378901/

    APK

    P.S.=> China = imitation = flattery http://www.theregister.co.uk/2017/04/26/boffins_supercharge_the_hosts_file_to_save_users_plagued_by_dns_outages/

  17. Quoted registered /.ers disagree... apk by Anonymous Coward · · Score: 0

    I'm going to continue using the Host File Engine. Your software is well written, functional. The Host File Engine performs exactly as promised by mmell

    his hosts program is actually pretty good by xenotransplant

    his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg

    (APK's) work, I've flat out said it's good by BronsCon

    I've tried his hosts file generating software. It works by bmo

    APK your posts on this & the hosts file posts, and more, have never been in error &/or bad advice by BlueStrat

    Your premise that hostfiles are a good way to deal with advertising & malvertising is quite valid by JazzLad

    I like your host file system by Karmashock

    (NEED MORE? Ask!)

    * It's recommended/hosted by Malwarebytes' hpHosts!

    APK

    P.S.=> See subject: Security & web pros do also https://developers.slashdot.org/comments.pl?sid=11116543&cid=55203625/ ... apk

  18. WebSockets are the next threat by CrashNBrn · · Score: 1

    The other thing to keep an eye on these days are WebSockets, I would be surprised if this JS BS incorporates that now or the near future. There don't appear to be memory limitations to WebSockets either.

  19. Block scripts sources via hosts by Anonymous Coward · · Score: 0

    Better vs. NoScript (block script sources before tag parses) APK Hosts File Engine 9.0++ SR-7 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/

    Ads/script/malware rob speed/security/privacy/bandwidth.

    Hosts add speed (via hardcodes/adblocks), security (vs. bad sites/malware/poisoned dns), reliability (vs. dns down), & anonymity (vs. dns requestlogs/trackers).

    Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus + less security bugs/complexity & faster vs. addons/routers/remote dns!

    Avoids DNSChangers in routers/IP settings & dns redirect (99.999% of ISP DNS != patched vs. it) + DNS requestlog tracking & lighten DNS load & resolve faster from local system RAM!

    * Via what u NATIVELY have in a FASTER kernelmode IP stack!

    APK

    P.S. - Safe https://www.virustotal.com/en/file/e01211ca36aa02e923f20adee0a3c4f5d5187dc65bdf1c997b3da3c2b0745425/analysis/1433430542/

  20. Wowhead... by Anonymous Coward · · Score: 0

    Http://wowhead.com has been doing this for over a year on their non mobile site. People are just realizing sites can do this now.