First Ever Malvertising Campaign Uses JavaScript To Mine Cryptocurrencies In Your Browser (bleepingcomputer.com)

An anonymous reader writes from a report via Bleeping Computer: Malware authors are using JavaScript code delivered via malvertising campaigns to mine different cryptocurrencies inside people's browsers (mostly Monero), without their knowledge. The way crooks pulled this off was by using an online advertising company that allows them to deploy ads with custom JavaScript code. The JavaScript code is a modified version of MineCrunch (also known as Web Miner), a script released in 2014 that can mine cryptocurrencies using JavaScript code executed inside the browser. Cryptocurrency mining operations are notoriously resource-intensive and tend to slow down a user's computer. To avoid raising suspicion, crooks delivered malicious ads mainly on video streaming and browser-based gaming sites (currently mostly Ukrainian and Russian sites). Both types of sites use lots of resources, and users wouldn't get suspicious when their computer slowed down while accessing the site. Furthermore, users tend to linger more on browser games and video streaming services, allowing the mining script to do its job and generate profits for the crooks.

Comments

Got to say

[Anonymous Coward]

Genius.

Despite being one of the causes of adblocker proliferation it's a nice change from the usual destructive malware in ads.

Must admit I've never really understood why advertising companies allow advertisers to run potentially unsafe code via their network. Surely it reflects badly on them and I'm too ignorant to understand the need for custom code with an advert.

Re:Got to say

[AmiMoJo]

But how much currency can it mine?

How long are ads displayed for? Probably not long in most cases. Many browsers, especially Chrome, throttle Javascript or even stop it running entirely to save energy when the user isn't interacting with the page. And Javascript isn't exactly known for its high performance when it comes to maths.

A lot of processing will be wasted. Anything that ends before the minimum work unit that can be saved is complete is lost.

If they are mining a popular currency the chances are Javascript running on a CPU will to too slow to earn anything significant. If they are mining a less popular currency it is now tainted by malware and unlikely to ever be worth much.

Re:Got to say

[Nutria]

And Javascript isn't exactly known for its high performance when it comes to maths.

That was my first thought. People spend so much on top-tier GPUs for mining, and these guys go for JS.

I bet the malware guys are using this as a proof-of-concept for something else.

Re:Got to say

[TheRaven64]

I've noticed that a lot of web sites now cause my browser to ask me if I trust them to run WebGL code for no obvious reason (I don't, because I've worked on GPU drivers, and there's no way I'd trust them with potentially malicious code, even if it has had some token WebGL verification). JavaScript is fairly slow, but WebGL and WebCL let JavaScript run shader code on your GPU.

Most cryptocurrency mining is probabilistic: you only win on average by having the most compute, each step involves trying a possible solution and hopefully getting lucky. If you try enough solutions in parallel, you'll probably find the correct one before anyone else. Even if each person only gives you 30 seconds of GPU time, that's still a lot if you can infect a few million people.

I seem to recall a browser-based game a few years ago that used this exact business model: as you play the game, it mined bitcoin in the background on your GPU, which paid for the game.

Re:Got to say

[geekmux]

And Javascript isn't exactly known for its high performance when it comes to maths.

That was my first thought. People spend so much on top-tier GPUs for mining, and these guys go for JS.

I bet the malware guys are using this as a proof-of-concept for something else.

How many people have a JS enabled-browser installed vs. how many people have top-tier GPUs installed?

The performance all comes down to volume. And with Bitcoin valued at over $3000, I doubt that something else needs be a motivator.

Re:Got to say

[angel'o'sphere]

Could have answered to you plus + answer ;D
But here it fits better.

First of all: JavaScript is since a decade no longer as slow as people think. Nearly all browsers optimize it and jit compile it to assembly.

Secondly: http://gpu.rocks/

Re:Got to say

[geekmux]

I'll repeat again: when you stop browsing, any partial work disappears.

The world never stops browsing, but people do.

This is exactly why I mentioned streaming services. You can probably get some considerable crunching done when the word "binge" is often used to describe browser session times. Wouldn't be surprised one bit if the next YouTube/Netflix app upgrade comes with a few extra lines of JS.

On top of that, I'll give it about another HFT micro-second before someone realizes the value of breaking up JS cryptomining assignments into 60-second chunks to try and counteract that "partial" work problem, and take advantage of this distributed mining model. Or perhaps they'll wrap this around something that is always running in the background; you've only got about 1,000 opportunities to do this with Win10 telemetry services...

Let's replace adverts with this.

[Anonymous Coward]

Why can't websites replace adverts with this, working for them?

That seems like a perfect way to get micro-transactions in a website without any micro-transaction having to occur, and it scales with time spent on the website.

Could we find a legitimate use for this idea?

[91degrees]

Micropayments have never caught on because they're a pain to deal with. People might be willing to spend some of their CPU time though. They don't object too much to doing the millions of operations required for a few seconds of video (the objection is more the annoyance of the video itself)

I suspect CPU time is not valuable enough to make this sort of thing viable but maybe I'm wrong.

Re:Could we find a legitimate use for this idea?

[hord]

There are tons of distributed projects where people donate CPU time. It has value for communities of people that like to work on common computational goals. Examples are SETI, distributed.net, and folding@home. Here is Wikipedia's list:

https://en.wikipedia.org/wiki/...

I ran a Pentium 200MHz overclocked to 250MHz for several years straight (along with many other machines) trying to crack RC5-64 years ago. Lots of fun.

Re:Could we find a legitimate use for this idea?

[91degrees]

Yup, and those are great. I approve of the aspirational ideals.

But I'm thinking of the more commercial aspects. For example, while I have no complaints about CGI movies, I'm not going to donate my CPU time to help make one. A company might be willing to pay me a fraction of a cent for rendering a few pixels though. I don't want that fraction of a cent. I do, however, want to be able to read websites without annoying popup ads. The website owner, with thousands of impressions per page per day would like that fraction of a cent for each page.

So the computer animation company pays the website some money to run a few seconds rendering time on my PC. I get the web-page for a negligible increase in power costs, and the computer animation company gets some pixels. Multiply that by a few hundred thousand users. They all get the information they want, the computer animation company gets several frames rendered, and the website owner gets money.

Re: Crooks?

[Boutzev]

If an ad runs on your computer without authorization - it uses your computer's resources too. Is that somehow different just because ads waste less resources than mining ? What about a mining script that uses less ressources than the standard video ad - would they still be crooks ?

While I don't agree with anyone running code on a user's station without authorization, there isn't much difference between this and a common ad. Both should be illegal if you ask me. But if those guys are crooks - then what would Google Adwords be ?

Shame on the ad network

[cdwiegand]

What advertising network? They should be known, publicly shamed, and every website operator should know not to do business with them.

Honestly, I wish there was a way for me to report an ad that's violating browser rules. I hate when I go to a real newspaper site that uses ads, and I get served an ad that takes over the whole window, hiding stuff behind, but there's no way for me, on my phone / tablet, to know who served the ad or report the ad placement. Makes me want to block all ads everywhere on my personal devices and networks, but THAT comes with issues because many sites and even many mobile apps refuse to function if they can't talk to the ad networks and/or Google/Adobe/etc..