• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Injecting Javascript Cryptocurrency Miner into a Public Network

FrgMstr

FrgMstr

Just Plain Mean
Staff member
2FA
Joined
May 18, 1997
Messages
58,510
I remember reading a comment yesterday about how long it would be till we saw cryptocurrency miner that would run on the Internet of Things, well that looks like it is just about here. Anthony Russell has a javascript injection that got mining software working on his home network and grabs all the CPU resources it can with those on the network that are surfing the web. He calls it Miner in the Middle.



The attack is pretty simple actually. Your attacking machine needs to connect to a network with people surfing the web on it. Once connected, you run the script I provided above. The script will create an html file that has the javascript monero miner in it and it will also link your api key into it. Once the file is built, it launches the MitMf application.

The MitMf application, once running, will first arp poison the network and tell everyone to route traffic through your machine. Next it will listen for HTTP responses. When it sees one, it will inject our payload into it. Finally the victim will execute the payload automatically, without prompt, and start mining monero for you.

That’s it!

I attempted this attack on my home network and within about 30 seconds I had 3 machines and my girlfriends phone mining monero for me lol
 
From the first reading, it sounds like you would have to compromise a device on the network first. Either the router, or a machine that is up 24/7.

10:1 NK will attempt to use this.
 
So, all you really need is access to a network. For instance...a guest network would be a good option. Once on, you ARP poison the devices already on that network to pass traffic through your box... BAM! Done.
 
so all you need is a ad blocker that looks for this kind of javascript and filters it. Nice.
 
Gigus Fire said:
Good to know. But also there's this: https://venturebeat.com/2017/09/21/...r-from-being-hijacked-to-mine-cryptocurrency/
If you're already using the popular ad blockers, you should be protected from miners in ads.
Click to expand...

Yeah, that sounds familiar.

Another Cryptomining Browser Hijack Joins the Scene
Coinhive has gotten a considerable amount of coverage lately, here, here, and here, just to name a few. If you are not yet familiar, your computer's resources are basically used to mine cryptocurrency when you visit a website with the protocol installed by the owner, or it has been hacked into the page by another. It seems as though some folks think this is a great idea and are jumping on the Coinhive bandwagon. Crypto-Loot is the new player. If this concerns you, and you want to block this activity on your own box, Bleeping Computer has some solutions for you at the bottom of this page. While most antivirus packages are picking up detection of Coinhive. AdBlock Plus and AdGuard can be used stop the script as well. And if you are a Chrome user, the No Coin extension currently has the ability to block both Coinhive and Crypto-Loot. And who said the Internet was out of its WIld Wild West phase. That show was badass when I growing up.
 
Keep in mind that these will only block pages that are using the known coinhive.min.js set up to coinhive. Many sites are being maliciously targeted, and contain redirects through several domains, and even obfuscated scripts that will prevent these blockers from working. Of course, if this happens, I would expect that there will probably be other info-stealing malware present. As always, keep an eye on what the sites that you visit consistently are doing.
 
More and more sites are hogging my cpu and wasting my electricity.

I was browsing notebookcheck.net, and noticed my laptop fans spinning,
Checked processxp, and sure enough, Chrome was pegged at 10% cpu. NoCoin was not working to block the crap.

Had to use ScriptSafe to block the whole fucking site.
 
Pretty neat I've known Anthony for a long time nice to see an article on someone I know!
 
Last edited:
You must log in or register to reply here.
Back
Top