Slashdot Mirror
Chrome Extension with 100,000 Users Caught Pushing Cryptocurrency Miner (bleepingcomputer.com)
Catalin Cimpanu, reporting for BleepingComputer: A Chrome extension with over 105,000 users has been deploying an in-browser cryptocurrency miner to unsuspecting users for the past few weeks. The extension does not ask for user permission before hijacking their CPUs to mine Monero all the time the Chrome browser is open. Named "Archive Poster," the extension is advertised as a mod for Tumblr that allows users an easier way to "reblog, queue, draft, and like posts right from another blog's archive." According to users reviews, around the start of December the extension has incorporated the infamous Coinhive in-browser miner in its source code.
That is really underhanded. It is like posting affiliate links to unrelated Amazon stuff.
Firefox users who upgraded to Firefox 57 will know all too well that Firefox's new WebExtensions extension model is pretty much a clone of Chrome's approach. This upgrade broke pretty much all of our existing extensions. It's one of the most disruptive software updates I've experienced in a long time.
One of the justifications for this massively disruptive change was that Firefox's old extension approach wasn't as "secure" as Chrome's approach.
Yet this incident shows that Chrome's approach, and likely Firefox's new WebExtensions approach, probably aren't any better than Firefox's old approach.
The Firefox developers trashed our user experience in the name of "security", but now it's like we're finding out that we probably aren't any more secure after all.
What a debacle!
Nerdlings Sorrow! Break a knee both wrists and an ankle ... betcha that slows-down the frisky dev. Bitch prolly thinks he has rights !
That are mined without consent. Distributed computer programs like BOINC already forbid use without permission, so it's time mining programs do so as well.
If the extension is surreptitiously stealing your cpu cycles and electricity to perform an activity that the authors did not explicitly ask permission, I would say that meets the definition of theft. File a criminal complaint and let the authorities chase them around.
Security is one justification, but the real problem is that the old extension model allowed extensions to hook into every part of the GUI. This meant that any change to the GUI at all could potentially break an extension. They tried patching this by keeping track of what version an extension was developed against, but in the end they felt that the system was fundamentally broken and was holding the whole project back. Personally, I share your frustration as the new model can't even accommodate seamlessly shifting the tabs over to the side, or adding a button to pop open the password manager. I'm hoping they continue to add capability.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
100k users is nothing, 1million is nothing. Popularity of an extension means nothing if something like this can happen. The auto-update method for extensions is ripe for abuse.
IIRC, not that long ago places like GitHub were taken over in such the same manner. Trusted applications were suddenly wrapped with malware.
I don't have a solid answer, but it's something worth looking into.
So rise up, all ye lost ones, as one, we'll claw the clouds.
And now it's a delivery vehicle for malware.
And I do not mean "running a miner without user consent", I also mean "running a miner WITH user consent".
Mining in the browser is so horrendously energy inefficient, that it should be illegal to waist resources, and therefor pollute, so frivolously. It is one of the excesses of capitalism that needs to be curtailed, just like many other profit making polluting schemes (minor profit for one person, major problems for the rest of us) have been made illegal.
You remember your argument that ad-blocking should be unrestricted? That you're just making requests to a webserver, it doesn't have to respond, but if it chooses to respond with the content you wanted, then good for it?
Those cryptocurrency miner scripts? They're just supplying javascript to your browser. It doesn't have to run it, but if it chooses to respond by executing the offered script? Good for it.
Can't have things both ways.
More secure isn't the same as perfect security and no one claimed it was, so your approach of taking one failure and concluding that the whole model isn't any better than the previous one fails the logic test. Unfortunately, since browsers are so capable and widely used, a browser extension is essentially just an additional application with all the threats that confers. If you install a crappy extension, you will get crappy results. The defense is to vet your browser extensions as carefully as you do your applications. P.S. all the Firefox extensions I use work fine on the new model.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Your comment is a perfect example of the denial, backtracking, and personal attacks we see so often from Firefox's supporters.
You're the only one who brought up this "perfect security" nonsense, in an attempt to deflect attention away from Firefox's shortcomings. Nobody else said anything about "perfect security". Only you did!
Let's look at the pros and cons of XUL versus WebExtensions.
XUL Scenario:
Cons: Vulnerable to some attacks.
Pros: Powerful. Many existing extensions that are well-tested and work fine.
WebExtensions Scenario:
Cons: Vulnerable to some attacks. Not compatible with the many existing XUL extensions. Limited capabilities compared to XUL. Some XUL extensions can't even be reimplemented because WebExtensions is so limited. Few compatible extensions. Severe disruption to users.
Pros: None.
The problem should be obvious. Both XUL and WebExtensions may be susceptible to some attacks, but that's XUL's only drawback. It turns out that WebExtensions are also susceptible to attacks, but WebExtensions also suffers from many other drawbacks, as proven above.
This whole WebExtensions situation has been a total disaster for many Firefox users. Our extensions were broken for no reason, and what we get in the end isn't actually any better, and in my opinion it's actually much worse.
This is a Trojan horse. Without signatures, inspection, quotas with consequences or other behavioral detection methods how could this be avoided? Maybe the extensions should be run in a separate process that has only white-listed network connectivity.
Clearly the problem is that the extension wasn't written in Rust...
So you're telling me there's finally a way to monetize Chrome extensions?
"Archive poster"
and is it useful?
I bet that if the creator did offer a paid premium version without the mining even at a very reasonable price most users would quietly shutoff and continue using the free mining version....
Rusty! Crusty! Assholes! WOOOOOOOOOOOOOO!
Don’t listen to this idiot. Parent is a AIDS-infected, butt-humping homosexual!
The shit about Yahoo and Tumblr, Yahoo made the small barely standing Tumblr fall and puke, now this too, it encourages users to leave it... Sad to see Tumblr leaving...
HOSTS file or set into router. A Chrome Extension site, I've seen this site buried as a redirect hidden by it's ip address 163.172.60.109
0.0.0.0 whchsvlxch.site
0.0.0.0 c7e935.netlify.com
0.0.0.0 netlify.com
* SOURCE https://www.bleepingcomputer.com/news/security/chrome-extension-with-100-000-users-caught-pushing-cryptocurrency-miner/
"classic Windows hosts trick to block the Coinhive or Crypto-Loot domains" https://www.bleepingcomputer.com/news/security/a-new-player-joins-coinhive-on-the-browser-cryptojacking-scene/ BLEEPING COMPUTER
APK
P.S.=> Accept NO substitute for APK Hosts File Engine 10++ 32/64-bit SR-1 https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ for speed, security, reliability natively for less resources & complexity vs. "so-called security 'solutions'" (security issues riddled (DNS/Antivirus/routers) slowing you (hosts speed you up) OR sold-out to not work by default (adblock)) via hosts kernelmode speed (vs. slow usermode)
Actually it's less secure because it does forced automatic updates of extensions.
If it ain't broke, don't fix it. If I get updates, _I_ want to see what they are and _I_ want to apply them myself to ensure that they don't fuck up anything else and cause gaping security holes. I can handle the security on my PC much better than Mozilla or Microsoft can, thanks.