Now Even YouTube Serves Ads With CPU-draining Cryptocurrency Miners (arstechnica.com)
YouTube was recently caught displaying ads that covertly leach off visitors' CPUs and electricity to generate digital currency on behalf of anonymous attackers, it was widely reported. From a report: Word of the abusive ads started no later than Tuesday, as people took to social media sites to complain their antivirus programs were detecting cryptocurrency mining code when they visited YouTube. The warnings came even when people changed the browser they were using, and the warnings seemed to be limited to times when users were on YouTube. On Friday, researchers with antivirus provider Trend Micro said the ads helped drive a more than three-fold spike in Web miner detections. They said the attackers behind the ads were abusing Google's DoubleClick ad platform to display them to YouTube visitors in select countries, including Japan, France, Taiwan, Italy, and Spain. The ads contain JavaScript that mines the digital coin known as Monero.
Because itâ(TM)s getting out of hand and they will fix everything.
This is why I run an adblocker and a script blocker.
And why I refuse to visit sites that insist I turn it off.
Speaking of which, anyone know any WebExtensions that do anti-anti-adblock? The old one was XUL.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
I don't know why this is the first time I'm realizing this, but "ads" that cryptomine seem like a great idea. Given the amount of web browsing that is just that, with an otherwise unoccupied CPU, I'd much rather the sites I visit be earning some money directly from my use than displaying crappy ads all over and splitting that income with the middlemen.
Can the workloads really be broken down into such small chunks that running during a 15-30 second ad gets any useful work done? It seems coordinating breaking up and putting back together such small work parts would be more computational power than its worth.
Quick! Everyone stop using Youtube so we can swing the apocalypse back into the hands of the creators.
What puzzles me most is that you tube isn't very popular, and unlikely to be wroth the effort in terms of getting the miner code to run on many computers...
The work is small. Just with a really low probability of success. This is why "mining" is usually done on GPUs, more tries more winnings.
One that comes to the top of my mind is Mineblock.
It specifically blocks cryptominers of all kinds, even ones that the usual script blockers and other antimalware stuff miss.
It's not the only one, and I'm sure that eventually the others will catch up to these types of extensions, but it's still relatively early days for this kind of infestation.
Keep up to date on whatever you use, and those leeches won't find you an easy meal.
It's the age of browser tabs. People open a tab with youtube and it stays open, often for hours.
This is why I absolutely refuse to to surf without adblockers in place.
The whole online ads thing has been a shit-show since the word "go".
And they piss and moan about it, while taking ever greater liberties with computing resources THEY DO NOT OWN.
You can't even trust GOOGLE for chrissakes! And they're a browser vendor? How VERY convenient!
You wanna block me from viewing your content because I don't let you infect, destabilize, and take over my system?
Fine, I don't need to see your shit content that bad. I'll go do something ELSE.
Online advertising is a Herpes infection.
Chas - The one, the only.
THANK GOD!!!
Comment removed based on user account deletion
Does it really matter? They're still collecting:
1 - A theoretical dollar for the video view
2 - The ad revenue, and they get to top it off with 3:
3 - Tiny fractions of a monero-cent
Adding #3 is free for them. Why not include it?
Comment removed based on user account deletion
Consider an algorithm such as Yescrypt (http://password-hashing.net/wiki/doku.php/yescrypt) which is a valid CPU cryptomining algorithm. My CPU (Broadwell i7 6800K) finds a share every 5 seconds with 11 threads running. I extrapolate a quad core CPU would find a share every 15-20 seconds. Those shares add up if the receiving wallet and mining pool are the same. This means wallet "iourthoesruithjvansoivrzupaweo" could have a swarm 10K workers mining for 30 seconds each on the same pool, and find 10K shares every 30 seconds.
Let's see what this adds up to in terms of cash.
My CPU (taken as reference) makes about 1.5 dollars a day. A Quad-core CPU (average desktop PC CPU) would make about 0.5 dollars a day through cryptomining. Multiply that by 10K miners (dynamic swarm), it adds up to 5K dollars a day. It's a hefty sum, assuming the website really has 10K active visitors at all times.
1K active sessions would yield 500 bucks a day, 100 active sessions would net 50 bucks a day. Even 10 active sessions would be 5 dollars a day, every day. Not bad, I'd say.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
This is why I absolutely refuse to to surf without adblockers in place.
The whole online ads thing has been a shit-show since the word "go".
And they piss and moan about it, while taking ever greater liberties with computing resources THEY DO NOT OWN.
You can't even trust GOOGLE for chrissakes! And they're a browser vendor? How VERY convenient!
You wanna block me from viewing your content because I don't let you infect, destabilize, and take over my system?
Fine, I don't need to see your shit content that bad. I'll go do something ELSE.
Online advertising is a Herpes infection.
If the internet is a prostitute, sites that make you pay are like elite courtesans; sites which let you view for free are street hookers.
Yeah, no one wants to pay the price for an elite courtesan; but you're more likely to get an infection from a street hooker.
Attackers? What?
you can definitely break the workload into small chunks that only take a few seconds.
multiply all those small hashrates by tens of thousands of pageviews, and you start pulling in quite a respectable ROI. The hard part is finding a Monero pool that doesn't ban you for making tens of thousands of tiny connections.
i could live a little longer in this prison
I have NEVER encountered a site that requires you disable adblock. I have been to maybe two sites that asked politely to turn it off, and did nothing to keep you out if you didn't.
At least Chrome limits background tabs to 1% of CPU and will, in future, pause javascript entirely in those pages.
Does the Javascript have to stop running when the ad completes? If it could stay up for the entire time you watch a video, that could make a mint.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
You know what? If you let me know with a disclosure you're going to do it. And by doing it you give a clean, completely ad-free page. I say let's go for it.
Yes it will use a little more power (which I pay for), but if that's the price to pay to not have to be distracted 5 times reading a page (closing popups, videos playing, etc), then it's a price I gladly pay.
It's spelled "leech," not "leach." Sorry, but I have been seeing this error a lot recently.
I repeatedly surprised (and appalled) when I visit a favorite site on a machine other than my own (the horror!!)
The network at my government IT job started blocking some YouTube ads this week. If I want to listen to a video in the background, and a blocked ad came up, I had to keep hitting F5 until a legit ad or no ad appeared. PewDiePie joked earlier this week that people should watch his channel since he has no ads as YouTube no longer loves him. It's true! No ad blocking on PewDiePie's channel.
I know dedicated mining operations are way more efficient, but botnets can get pretty large.
Are there any estimates on just what proportion of crypto-currencies are mined through illegitimate means?
I stole this Sig
If you're not willing to support my site, feel free to boycott it. However, stop stealing from me. You're not required to go to my site, but you're not welcome to violate my copyright with a derivative work in order to steal revenue from me.
Why are ads even allowed to run javascript? It's one thing for double-click itself to be implemented in javascript, but why on earth do doubleclick/youtube allow the ads to include javascript? Shouldn't they just be an image or gif or video?
Anti-adblock detects failure to load ads and removes the article's text from the DOM until the user disables protection. Running a blocker for a specific behavior gives you a bit of plausible deniability and room to complain to the site's support department about misdetecting an ad blocker.
I put up with adverts in newspapers and magazines because I understand they subsidise their production costs, but they don't track me and do shit behind my back.
Same for TV
Same for radio
Yet more and more websites display 'please disable your adblocker'.
NO. It's precisely because of shit like this that I run one and I have no intention of disabling it.
You want to display adverts on your site to bring in revenue, fine I get that. But do it the old way, with simple graphics that don't run unvetted shit on your viewers machines.
You want to block me from viewing your content 'cos I'm running an adblocker ? that's cool too, there's plenty of other sites out there.
... browser vendor ...
Google doesn't sell a browser.
It little behooves the best of us to comment on the rest of us.
Putting JavaScript in ads causes too many problems, from drive-by malware to this (and many other things too). And it leads to annoying ads, like those pop-ups that never leave your field of view.
Yes, yes, I know it's because advertisers want to draw attention to their product. However, I suspect that many people would object less to ads if they weren't so annoying: compare to advertisements in (print) newspapers, who seem to have got along just fine without ads in -- what? -- several centuries so far?
If we banned JavaScript in ads, malware authors would have a lot more difficult task pushing their crap.
(Have to admit: only half-serious here, but still ...)
Defeat ads via DNS before involving your browser: https://pi-hole.net/ I've been using it for a few months now. Knowing my TVs are no longer sending logs to Samsung is very gratifying. I discovered a forgotten Jenkins install that was hitting Github every 5 minutes.. oops :(
I've only had to white-list two URLs for my kid so far.
creimer spam alert!
Don't click on his homepage link! creimer is trying to get you to subscribe automatically to his youtube channel and make money off you!
CREIMER' SUBMISSIONS UPDATE: /. so make sure to go to:
Note also that creimer is trying to regain karma by getting his submissions published as articles on
https://slashdot.org/~cdreimer
https://slashdot.org/~criss69
https://slashdot.org/~Anonymou...
https://slashdot.org/~FatCashe...
https://slashdot.org/~ILoveFat...
https://slashdot.org/~IHateFat...
https://slashdot.org/~IAteFatC...
https://slashdot.org/~ITapeFat...
https://slashdot.org/~IApeFatC...
https://slashdot.org/~IPrayFat...
https://slashdot.org/~FatCashe...
and mod down his submissions as well. The great thing is that you don't even need mod points to mod down a submission, just click on the "minus" icon!
Yes, believe it or not, creimer owns all the above sock puppet accounts. It is a mystery why Slashdot management tolerates it!
creimer wrote:
I don't bother with mod points. I'm doing something much more sinister. It took ten story submissions ? I'll have to double check the number ? to move cdreimer's karma from neutral to excellent without ever being exposed to the capricious mods. Mmmmmwwwwahahahahahahaha!
https://slashdot.org/comments....
Danger, Will Robinson, Danger! Creimy is posting more than 2 posts a day. Hurry! mod down otherwise /. will go to hell again!
Note: you can mod down even if already at -1 to lower karma and to prevent lost /. users to accidentally mod up.
creimer wrote:
All you need to do is find a website with a permissive TOS, say, Slashdot, create a Python script to scrape your own comments, sprinkle Amazon affiliate links in various posts, and then re-post past links whenever possible. Won't be long before you start making "coffee money" each month.
https://slashdot.org/comments....
C.D. Reimer is a renowned Slashdot collaborator, as he puts it himself; "Because of the quality of my posts and my article submissions, I'm a highly rated commentator and moderator."
But does anybody ever wondered what "C.D." stands for? Well, it stands for Creimy Dumpty of course!
Creimy Dumpty sat on the wall,
Creimy Dumpty had a great fall.
All the king's horses
And all the king's men
Couldn't put Creimy Dumpty
Together again.
Creimy's siblings video and theme song, very realistic, especially the pants, just like Creimy's:
https://www.youtube.com/watch?...
With "Vice President Pence Vowing US Astronauts Will Return To the Moon", we are sure they will need miracle workers up there, here is what it would look like. Note that Creimy takes care of bringing a lot of food to the moon as depicted below:
https://www.youtube.com/watch?...
Creimy's real pictures:
Before the sex change:
https://ibb.co/cc7Ddw
After the sex change:
https://ibb.co/gVad65
Creimy's "enterprise-level" chair, he talks about it all the time on slashdot:
That's OK. I'll just filter the advertisements myself on my end.
#3 is free is kind of short sighted.
Cuz thousands of people and me are gonna turn Adblock back on for YouTube.
Is that a good enough reason?
I got a good reason to just rip YouTube videos now, totally bypassing ads, clicks, and views.
Is that a good enough reason?
Most of what I watch in YouTube was on Twitch first anyways.
Comment removed based on user account deletion
Are you sure about that?
Seems odd so many apps(like Avast! which bugs you to install chrome every update) would bundle a Chrome installer for free.
https is such a falsehood. Sure the connection between you and one site may be secure, and you may actually trust it. But what about all those third party trackers and ad servers that load into the same page? Yes I am oversimplifying and https is about the connection and not the server's security - but as soon as a third party content is loaded shouldn't the underlying https connection become tainted in a way that it has something like one of those big red Xs on it for https+non-https mixed content? Maybe a middle finger emoji to the end user.
I wish for a day whereby disabling loading of third party content is enabled by default - and websites still work.
If you don't use an ad blocker by now, or even better something like umatrix extension - please add one to your favorite browser. (umatrix is from same guy as ublock origin, and sure it has a learning curve but we are supposed to be nerds reading this, and be amazed at all the third party junk on your favorite websites).
Stick with it, OK?
You'll get it after you've been on the Internet a while.
It little behooves the best of us to comment on the rest of us.
Not visiting the site IS the choice.
The idea that an web site can consume all of your resources is a bug. There is a reason active X was a bad idea. Today our browsers have enabled similar circumstances where they can take control over the machine without bounds. In a properly designed system the browser nor a particular app should have access to any and all resources on a system. Fortunately some restrictions do exist in some cases. However user adjustments in this particular case are an issue. The user should be put in control of a sites resource usage to hinder any site from gaining system control or consuming in excess of what the end-user considers reasonable. You should own your own computer and not someone else. Also another reason I'm not a fan of javascript or WebASM.
Nope, you act like I never tried Chrome. Firefox runs better on my computer.
Don't throw benchmarks at me from someone else's computer, they're irrelevant to me.
Comment removed based on user account deletion
I understand why an ad network like Yahoo or Doubleclick might use javascripts. But why would the individual advertiser need a custom javascript? Just provide a PNG or JPG or MP4 and be done with it. The idea that the ad networks permit arbitrary code in the ad is utterly ridiculous.
But you paid for Chrome, right?
It little behooves the best of us to comment on the rest of us.
Thanks a lot mister creimer!
Album sales are up due to you!
--
Moon Unit Zappa
Typical marketing strategy that pays off, I have to admit.
Great job Moon Unit!
1 why should there be content from domains not in the adress bar? (you dont expect there to be pepsi inside a can of coca cola!)
2 site designers need to keep content on their own site! (if you dont own the content, link to it, dont steal it)
3 100+ connections to load a single site is unacceptable! (and not cool to other users on public wifi)
4 ssl/tls is worthless with crossdomain content! (and please support ipsec/dane certificates to stop the certificate marfia)
5 all audio/videos should be click to play! (possible crossdomain, but need to be clicked just like any other links)
6 crossdomain cookies, are just another name for tracking cookies! (you dont need cookies to track users on you own site!)
7 external javascript libraries, are just as bad as windows dll hell and linux dependency nightmare. (just compile them into you page)
8 for webapps you need to install/give premission, for them to use site x. (not have a stupid allow header on site x!)
9 adsence/analytics is the real big brother wathing you. (and he is not alone..)
but its not happening as long as the browser makers are in the pockets of the ad/spam supliers.
A person hosting a website demands users disable adblocking and enable scripts to view their websites because they feel that viewing it without seeing their ads is theft.
So answer me this: are you, as the owner of said website, going to take responsibility--either personally or under your company name--for the expenses incurred WHEN, not if, I get a virus from the ads on your site? At a low estimate, call it $50 to service a machine to remove a virus. Are you going to give me $50 to remove the viruses that viewing your website unprotected--and make no mistake, adblock and noscript ARE need-to-have browser protection now--has left on my computer and which antivirus will do nothing for?
No? Didn't think so.
But suppose, for argument's sake, you ARE willing to accept liability for your actions. What if I were to make a machine with a clean copy of windows 10 and view your site in Edge, or windows 7 and IE, using a bot to make sure I reload your site a few dozen times an hour?
Every day I'll compile a list of times my computer was infected and I had to reimage it and I'll submit these tickets to you weekly. It'll come out to about $50/hour, every hour of every day.
THEN would you still be willing to accept responsibility for your actions, or would you tell me to fuck off and that it was my responsibility to protect myself. And would you still tell me to fuck off and disable my adblocking when viewing your site despite having seen the consequences?
0.0.0.0 doubleclick1.xyz
0.0.0.0 doubleclick2.xyz
0.0.0.0 doubleclick3.xyz
0.0.0.0 doubleclick4.xyz
0.0.0.0 doubleclick5.xyz
* SOURCE: https://www.bleepingcomputer.com/news/security/coinhive-cryptojacker-deployed-on-youtube-via-google-ads/
APK
P.S.=> For more protection vs. more threats than just this one (& more speed too) accept NO substitute for APK Hosts File Engine 10++ SR-1 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/ ... apk