Slashdot Mirror
First Ever Malvertising Campaign Uses JavaScript To Mine Cryptocurrencies In Your Browser (bleepingcomputer.com)
An anonymous reader writes from a report via Bleeping Computer: Malware authors are using JavaScript code delivered via malvertising campaigns to mine different cryptocurrencies inside people's browsers (mostly Monero), without their knowledge. The way crooks pulled this off was by using an online advertising company that allows them to deploy ads with custom JavaScript code. The JavaScript code is a modified version of MineCrunch (also known as Web Miner), a script released in 2014 that can mine cryptocurrencies using JavaScript code executed inside the browser. Cryptocurrency mining operations are notoriously resource-intensive and tend to slow down a user's computer. To avoid raising suspicion, crooks delivered malicious ads mainly on video streaming and browser-based gaming sites (currently mostly Ukrainian and Russian sites). Both types of sites use lots of resources, and users wouldn't get suspicious when their computer slowed down while accessing the site. Furthermore, users tend to linger more on browser games and video streaming services, allowing the mining script to do its job and generate profits for the crooks.
So this doesn't affect me.
Genius.
Despite being one of the causes of adblocker proliferation it's a nice change from the usual destructive malware in ads.
Must admit I've never really understood why advertising companies allow advertisers to run potentially unsafe code via their network. Surely it reflects badly on them and I'm too ignorant to understand the need for custom code with an advert.
It has its uses. But it has absolutely no business being used in ads, just like other Javascript over which the site owner has no control. I wish blocking 3rd party Javascript by default was an option, but that pretty much breaks all of the Internet.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
My laptop is so pathetic I'm wasting their time.
Why can't websites replace adverts with this, working for them?
That seems like a perfect way to get micro-transactions in a website without any micro-transaction having to occur, and it scales with time spent on the website.
Micropayments have never caught on because they're a pain to deal with. People might be willing to spend some of their CPU time though. They don't object too much to doing the millions of operations required for a few seconds of video (the objection is more the annoyance of the video itself)
I suspect CPU time is not valuable enough to make this sort of thing viable but maybe I'm wrong.
But that were cycles I wanted to waste on cat videos!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If an ad runs on your computer without authorization - it uses your computer's resources too. Is that somehow different just because ads waste less resources than mining ? What about a mining script that uses less ressources than the standard video ad - would they still be crooks ?
While I don't agree with anyone running code on a user's station without authorization, there isn't much difference between this and a common ad. Both should be illegal if you ask me. But if those guys are crooks - then what would Google Adwords be ?
Why not write the mining and phone-home routines directly into the games that people are playing? It would probably improve efficiency considerably, and somewhere in the EULA it can be noted that the game is working on a distributed computing project in the background as the 'fee' for using their otherwise free game.
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
What advertising network? They should be known, publicly shamed, and every website operator should know not to do business with them.
Honestly, I wish there was a way for me to report an ad that's violating browser rules. I hate when I go to a real newspaper site that uses ads, and I get served an ad that takes over the whole window, hiding stuff behind, but there's no way for me, on my phone / tablet, to know who served the ad or report the ad placement. Makes me want to block all ads everywhere on my personal devices and networks, but THAT comes with issues because many sites and even many mobile apps refuse to function if they can't talk to the ad networks and/or Google/Adobe/etc..
. Define sqrt(x) as something really evil like (x / rand()), and bury it deep. Watch your coworkers go nuts.
I read "...mine different cryptocurrencies inside people's browsers (mostly Monero),..." and was like what's this new browser Monero that so many people are using that it's worth focusing malware on?
Maybe it could have been written better as: "...mine different cryptocurrencies (mostly Monero) inside people's browsers,..."
-Styopa
The other thing to keep an eye on these days are WebSockets, I would be surprised if this JS BS incorporates that now or the near future. There don't appear to be memory limitations to WebSockets either.
What about a mining script that uses less ressources than the standard video ad - would they still be crooks ?
I vaguely recall that The Cuckoo's Egg mentions a case of someone convicted of stealing electricity in Canada since they couldn't prosecute computer intrusion at that time. So the amount of electricity is perhaps secondary. Also, CFAA in the US? I don't know how (if) that applies.
Ezekiel 23:20