Theres something new to add to your fun mental list of invisible internet dangers. Joining classic favorites like adware and spyware comes a new, tricky threat called cryptojacking, which secretly uses your laptop or mobile device to mine cryptocurrency when you visit an infected site.
Malicious miners arent new in themselves, but cryptojacking has exploded in popularity over the past few weeks, because it offers a clever twist. Bad guys dont need to sneak software onto your computer to get it going, which can be a resource-intensive attack. Instead, the latest technique uses Javascript to start working instantly when you load a compromised web page. There's no immediate way to tell that the page has a hidden mining component, and you may not even notice any impact on performance, but someone has hijacked your devicesand electric billfor digital profit.
The idea for cryptojacking coalesced in mid-September, when a company called Coinhive debuted a script that could start mining the cryptocurrency Monero when a webpage loaded. The Pirate Bay torrenting site quickly incorporated it to raise funds, and within weeks Coinhive copycats started cropping up. Hackers have even found ways to inject the scripts into websites like Politifact.com and Showtime, unbeknownst to the proprietors, mining money for themselves off of another sites traffic.
'Theres no opt-in option or opt-out. Weve observed it putting a real strain on system resources.'
Adam Kujawa, Malwarebytes Labs
So far these types of attacks have been discovered in compromised sites' source code by usersincluding security researcher Troy Murschwho notice their processor load spiking dramatically after navigating to cryptojacked pages. To protect yourself from cryptojacking, you can add sites you're worried about, or ones that you know practice in-browser mining, to your browser's ad blocking tool. There's also a Chrome extension called No Coin, created by developer Rafael Keramidas, that blocks Coinhive mining and is adding protection against other miners, too.
"Weve seen malicious websites use embedded scripting to deliver malware, force ads, and force browsing to specific websites," says Karl Sigler, threat intelligence research manager at SpiderLabs, which does malware research for the scanner Trustwave. "Weve also seen malware that focuses on either stealing cryptocurrency wallets or mining in the background. Combine the two together and you have a match made in hell."
What complicates the cryptojacking wave, experts argue, is that with the right protections in place it could actually be a constructive tool. Coinhive has always maintained that it intends its product as a new revenue stream for websites. Some sites already use a similar approach to raise funds for charitable causes like disaster relief. And observers particularly see in-browser miners as a potential supplement or alternative to digital ads, which notoriously have security issues of their own.
Early adopters like the Pirate Bay have made a pitch to their users that the technology is worth tolerating. "Do you want ads or do you want to give away a few of your CPU cycles every time you visit the site?" Pirate Bay asked its users in mid-September. Most commenters on the feedback request supported in-browser mining if it reduced ads, but one noted that if multiple sites adopt the technique, having multiple tabs open while browsing the web could eat up processing resources.
The concerns run deeper among audiences unaware that their devices are being used without their knowledge or consent. In fact, malware scanners have already begun blocking these mining programs, citing their intrusiveness and opacity. Coinhive, and the rash of alternatives that have cropped up, need to take good-faith steps, like incorporating hard-coded authentication protections and adding caps on how much user processing power they draw, before malware scanners will stop blocking them.
Everything is kind of crazy right now because this just came out, says Adam Kujawa, the director of Malwarebytes Labs, which does research for the scanning service Malwarebytes and started blocking Coinhive and other cryptojacking scripts this week. But I actually think the whole concept of a script-based miner is a good idea. It could be a viable replacement for something like advertising revenue. But were blocking it now just because theres no opt-in option or opt-out. Weve observed it putting a real strain on system resources. The scripts could degrade hardware.
To that end, Coinhive introduced a new version of its product this week, called AuthedMine, which would require user permission to turn their browser into a Monero-generator. "AuthedMine enforces an explicit opt-in from the end user to run the miner," Coinhive said in a statement on Monday. "We have gone through great lengths to ensure that our implementation of the opt-in cannot be circumvented and we pledge that it will stay this way. The AuthedMine miner will never start without the user's consent."
This course-correction is a positive step, but numerous cryptojacking scriptsincluding Coinhive's originalare already out there for hackers to use, and can't be recalled now. Experts also see other potential problems with the technique, even if the mining process is totally transparent. "An opt-in option...doesnt eliminate the problems of potential instability introduced by this," Trustwave's Sigler says. "When dozens of machines get locked up at a company, or when important work is lost due to a mining glitch, this can have a serious effect on a organizations network."
And with more malware scanners on the alert, hackers will start to evolve the technology to make it subtler and more difficult to find. As with other types of malware, attackers can bounce victims around to malicious websites using redirect tactics, or incorporate Javascript obfuscation techniques to keep scanners from finding their script-based miners.
Still, the positive potential of in-browser miners seems worth the complications to some. "Im hoping that within a year well see even more evolution of this technology to the point where it cannot be abused by website owners who want to trick people into running these miners," Malwarebytes' Kujawa says. "But if it's only associated with malicious activities, then it might take awhile for the technology to evolve to a place thats more secure, and for anyone to trust using it."
Like so many web tools, cryptojacking has plenty of promise as an innovationand plenty of people happy to exploit it.
More here:
Cryptojacking Lets Strangers Mine Cryptocurrency With Your ...
- Bitcoin Center NYC To Support Wednesday's CryptoCurrency Convention By Hosting After-Party [Last Updated On: April 11th, 2014] [Originally Added On: April 11th, 2014]
- As Bitcoin Soars in Value, Alternative Cryptocurrencies ... [Last Updated On: April 11th, 2014] [Originally Added On: April 11th, 2014]
- CryptoCurrency.org [Last Updated On: April 11th, 2014] [Originally Added On: April 11th, 2014]
- Cryptocurrency - Wikipedia, the free encyclopedia [Last Updated On: April 11th, 2014] [Originally Added On: April 11th, 2014]
- Qoinpro Cryptocurrency Faucet - Video [Last Updated On: April 11th, 2014] [Originally Added On: April 11th, 2014]
- Global Issues Cryptocurrency Project - Video [Last Updated On: April 11th, 2014] [Originally Added On: April 11th, 2014]
- cryptocurrency - Video [Last Updated On: April 11th, 2014] [Originally Added On: April 11th, 2014]
- PotCoin @ Cryptocurrency convention NYC, Good Audio - Video [Last Updated On: April 12th, 2014] [Originally Added On: April 12th, 2014]
- Bryce Weiner @ CryptoCurrency Convention 2014 - Video [Last Updated On: April 12th, 2014] [Originally Added On: April 12th, 2014]
- Unobtanium Cryptocurrency Explained - Video [Last Updated On: April 12th, 2014] [Originally Added On: April 12th, 2014]
- How To Create Your Own Cryptocurrency Co.Labs code ... [Last Updated On: April 14th, 2014] [Originally Added On: April 14th, 2014]
- CryptoCoinsNews - Cryptocurrency and Bitcoin News with ... [Last Updated On: April 14th, 2014] [Originally Added On: April 14th, 2014]
- Joe Rogan and Reddit Co-founder Alexis Ohanian talk Dogecoin, Cryptocurrency - Video [Last Updated On: April 14th, 2014] [Originally Added On: April 14th, 2014]
- How To Assess A CryptoCurrency: AltCoin Assessment Protocol. What's the next big AltCoin? - Video [Last Updated On: April 14th, 2014] [Originally Added On: April 14th, 2014]
- Reggie Middleton's UltraCoin @ NYC CryptoCurrency Convention - Video [Last Updated On: April 14th, 2014] [Originally Added On: April 14th, 2014]
- The future is Nxt (cryptocurrency platform) - Video [Last Updated On: April 19th, 2014] [Originally Added On: April 19th, 2014]
- CryptoCurrency Convention 4/9/14 - Dan Larimer Bitshares - Video [Last Updated On: April 20th, 2014] [Originally Added On: April 20th, 2014]
- CryptoCurrency Convention 4/9/14 - Xavier Hawk Permacredits - Video [Last Updated On: April 20th, 2014] [Originally Added On: April 20th, 2014]
- Does a cryptocurrency have the potential to revolutionize Ukraine? - Video [Last Updated On: April 20th, 2014] [Originally Added On: April 20th, 2014]
- Marscoin @ CryptoCurrency Convention NYC 4/9/14 - Lennart Lopin - Video [Last Updated On: April 22nd, 2014] [Originally Added On: April 22nd, 2014]
- Vertcoin @ CryptoCurrency Convention NYC 4/9/14 - Joe Fisher - Video [Last Updated On: April 22nd, 2014] [Originally Added On: April 22nd, 2014]
- UltraCoin @ CryptoCurrency Convention NYC 4/9/14 - Reggie Middleton - Video [Last Updated On: April 22nd, 2014] [Originally Added On: April 22nd, 2014]
- iCoin @ CryptoCurrency Convention NYC 4/9/14 - Ryan Ridgeway - Video [Last Updated On: April 22nd, 2014] [Originally Added On: April 22nd, 2014]
- Florincoin @ CryptoCurrency Convention NYC 4/9/14 - Joe Fiscella - Video [Last Updated On: April 22nd, 2014] [Originally Added On: April 22nd, 2014]
- PotCoin @ CryptoCurrency Convention NYC 4/9/14 - Nick Iversen - Video [Last Updated On: April 22nd, 2014] [Originally Added On: April 22nd, 2014]
- ZenithCoin @ CryptoCurrency Convention NYC 4/9/14 - Eddie Corral - Video [Last Updated On: April 22nd, 2014] [Originally Added On: April 22nd, 2014]
- Bryce Weiner @ CryptoCurrency Convention 4/9/14 - - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- Bitcoin Exchange CryptoRush Loses Millions of BlackCoin Cryptocurrency - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- Brock Pierce, Entrepreneur "FireSide Chat" @ CryptoCurrency Convention NYC - 4/9/14 - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- [OFFICIAL SPONSOR] Nick Spanos, Bitcoin Center NYC @ CryptoCurrency Convention 4/9/14 - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- AuroraCoin @ CryptoCurrency Convention NYC 4/9/14 - David Lio - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- DigiByte @ CryptoCurrency Convention NYC 4/9/14 - Jared Tate - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- Digitalcoin @ CryptoCurrency Convention NYC 4/9/14 - Andrew Davidson - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- BitAngels Co-Founder, David Johnson @ CryptoCurrency Convention NYC 4/9/14 - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- The Future of Cryptocurrency, Investing, and Crowdfunding (Toronto #BitcoinExpo Highlights) #548 - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- How to Set Up a Ripple (CryptoCurrency) Generating System! - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- --- The Great Debate --- Bitcoin vs Altcoin @ The CryptoCurrency Convention 4/9/14 - - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- Popularcoin @ CryptoCurrency Convention 4/9/14 - Joshua Nold - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- TimeKoin @ CryptoCurrency Convention 4/9/14 - Michael Brown - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- Infinitecoin @ CryptoCurrency Convention 4/9/14 - Loring Small - Video [Last Updated On: April 24th, 2014] [Originally Added On: April 24th, 2014]
- Bitcoin vs. Political Power: The Cryptocurrency Revolution - Stefan Molyneux at TNW Conference - Video [Last Updated On: April 26th, 2014] [Originally Added On: April 26th, 2014]
- TNW - Stefan Molyneux - Money, Power and Politics The Cryptocurrency Revolution - Video [Last Updated On: April 26th, 2014] [Originally Added On: April 26th, 2014]
- Coinnext Cryptocurrency Exchange Coming Soon - Video [Last Updated On: April 29th, 2014] [Originally Added On: April 29th, 2014]
- The Mises View: "Taxing Cryptocurrency" | Jeff Deist - Video [Last Updated On: May 2nd, 2014] [Originally Added On: May 2nd, 2014]
- mTrader.org - Cryptocurrency Mining System - Video [Last Updated On: May 2nd, 2014] [Originally Added On: May 2nd, 2014]
- CS 171 Final Project: Cryptocurrency Visualizations - Video [Last Updated On: May 3rd, 2014] [Originally Added On: May 3rd, 2014]
- Cryptocurrency Explained The Tech Guy 1046 - Video [Last Updated On: May 3rd, 2014] [Originally Added On: May 3rd, 2014]
- Know How 74 Cryptocurrency - Video [Last Updated On: May 4th, 2014] [Originally Added On: May 4th, 2014]
- CryptoCurrency of the World Unite! - Video [Last Updated On: May 9th, 2014] [Originally Added On: May 9th, 2014]
- BBT Presents: Ode to Cryptocurrency - Video [Last Updated On: May 13th, 2014] [Originally Added On: May 13th, 2014]
- Scryptify Cryptocurrency Video - Crypto Currency Exchanges - Video [Last Updated On: May 13th, 2014] [Originally Added On: May 13th, 2014]
- Bitpagar Cryptocurrency - Video [Last Updated On: May 16th, 2014] [Originally Added On: May 16th, 2014]
- How to Mine Cryptocurrency Safely - Video [Last Updated On: May 17th, 2014] [Originally Added On: May 17th, 2014]
- Bunnycoin - Innovative New Cryptocurrency - Video [Last Updated On: May 17th, 2014] [Originally Added On: May 17th, 2014]
- Nxt cryptocurrency platform: Proof of Stake mining system - Video [Last Updated On: May 18th, 2014] [Originally Added On: May 18th, 2014]
- Violincoin - The first cryptocurrency for musician - - Video [Last Updated On: May 21st, 2014] [Originally Added On: May 21st, 2014]
- The Cryptocurrency Store (Spanish/Espagnol) - Video [Last Updated On: May 22nd, 2014] [Originally Added On: May 22nd, 2014]
- Cryptocurrency: Get Mining! - Video [Last Updated On: May 22nd, 2014] [Originally Added On: May 22nd, 2014]
- How To Trade CryptoCurrency: Sign up to a safe and reliable exchange for trading CryptoCurrency - Video [Last Updated On: May 22nd, 2014] [Originally Added On: May 22nd, 2014]
- Cryptocurrency and Nonprofits with Eric Nakagawa - Video [Last Updated On: May 23rd, 2014] [Originally Added On: May 23rd, 2014]
- The Cryptocurrency Store - Video [Last Updated On: May 23rd, 2014] [Originally Added On: May 23rd, 2014]
- Bitcoin Song - The Cryptocurrency Store - Video [Last Updated On: May 25th, 2014] [Originally Added On: May 25th, 2014]
- Videoconferencia Cryptocurrency 201243946 - Video [Last Updated On: May 27th, 2014] [Originally Added On: May 27th, 2014]
- VideoCharla Jesus Ramos Cryptocurrency - Video [Last Updated On: May 27th, 2014] [Originally Added On: May 27th, 2014]
- Sudbury Cryptocurrency Conference, May 26th: Ethereum - Video [Last Updated On: May 30th, 2014] [Originally Added On: May 30th, 2014]
- 2014 Cubieboard 1, 2 - Mining Peercoins (SHA-256 based) Cryptocurrency - Video [Last Updated On: June 2nd, 2014] [Originally Added On: June 2nd, 2014]
- 2nd Salaries in CryptoCurrency - Video [Last Updated On: June 2nd, 2014] [Originally Added On: June 2nd, 2014]
- The Best Cryptocurrency Trading Platform - Video [Last Updated On: June 3rd, 2014] [Originally Added On: June 3rd, 2014]
- Cryptocurrency business forum - Video [Last Updated On: June 4th, 2014] [Originally Added On: June 4th, 2014]
- Cryptocurrency Opportunities in Southeast Asia | John KIM - Video [Last Updated On: June 7th, 2014] [Originally Added On: June 7th, 2014]
- Facebook Approves Cryptocurrency Tipping Apps -- Bitcoin Weekend In San Francisco - Video [Last Updated On: June 8th, 2014] [Originally Added On: June 8th, 2014]
- Wolf of Wall Street & Cryptocurrency w/ Patrick "PK" McDonnell - Video [Last Updated On: June 9th, 2014] [Originally Added On: June 9th, 2014]
- BankNote CryptoCurrency Review - Video [Last Updated On: June 13th, 2014] [Originally Added On: June 13th, 2014]
- CryptoCurrency 4 Housing for Father's Day! - Video [Last Updated On: June 13th, 2014] [Originally Added On: June 13th, 2014]
- Hyper CryptoCurrency Review - Video [Last Updated On: June 14th, 2014] [Originally Added On: June 14th, 2014]
- 0NE " EPIC " (HD dubstep mix) spot - a cryptocurrency with an Engine - Video [Last Updated On: June 15th, 2014] [Originally Added On: June 15th, 2014]
- Bitcoin,Litecoin mining rig cryptocurrency 2500W system, 6x 280x ASUS Beast 2014 - Video [Last Updated On: June 17th, 2014] [Originally Added On: June 17th, 2014]
- The Rundown Live #281 Tatiana Moroz (Chemtrails,CryptoCurrency,Anti-War) - Video [Last Updated On: June 19th, 2014] [Originally Added On: June 19th, 2014]
- Neutrality Coin New Alternative Cryptocurrency - Video [Last Updated On: June 20th, 2014] [Originally Added On: June 20th, 2014]
- Cryptocurrency Update - Buy Low, Sell High! - Video [Last Updated On: June 21st, 2014] [Originally Added On: June 21st, 2014]