Cryptojacking is well on its way to becoming a new menace to internet hygiene.
In some cases internet publishers are making money by using the spare processor cycles of visiting surfers to mine cryptocurrency, but in other incidents, hackers have planted JavaScript that covertly takes over the systems – a process that has become known as cryptojacking.
Dodgy code capable of running the trick surfaced on TV channel Showtime.com late last month before it appeared on the official website of Portugal and Real Madrid football star Cristiano Ronaldo last week.
The script that was on his website has since been removed, said security researcher Troy Mursch.
Both incidents were associated with code called Coinhive, which was mining a digital currency called Monero. The Pirate Bay deliberately planted mining code on its site before owning up to the “test” some time later. In other cases, the mining was either the byproduct of malicious adverts or run via legitimate but compromised websites, as in both the Showtime and Cristiano Ronaldo cases.
CBS’s Showtime caught mining crypto-coins in viewers’ web browsers
READ MORE
Only diligent nagging by security researcher Mursch (@bad_packets) over several days to the developers behind the Ronaldo site secured the admission that the script wasn’t put there by them and the suggestion to talk to CR7’s management company.
安全漏洞在减少而黑客也在改变战术,要与黑客斗,也要紧跟趋势的变化,培训员工全面的安全防范基础知识和技能正是抵御之道。
Ronaldo’s people have yet to respond directly to The Register’s repeated requests for comment. “Since the code on @Cristiano’s was unthrottled, it was probably miscreants,” Mursch told El Reg.
The amount to be made for criminals is normally quite small, perhaps into the thousands of dollars. High traffic sites would be able to generate a lot more through legitimate advertising.
For miscreants, cryptojacking offers a number of advantages even though it’s less lucrative than serving up malicious ads that sling either malware or tech support scams.
Although some experts argue that crypto mining is a form of theft, it has the advantage of being much less likely to generate complaints. The technology exists in a grey area made more obscure because of the difficulty of knowing whether or not code is there with the permission of website owners or not. The presence of the code on sites does not affect their core functionality.
Coinhive touts itself as a way for website owners to quickly set up mining by using their JavaScript API. The technology is already being widely abused, as explained in a blog post by Malwarebytes here.
A list of sites running Coinhive can be found here. Another scripting nasty, dubbed CryptoLootMiner, has surfaced in other incidents. ®
Sponsored:
The Joy and Pain of Buying IT – Have Your Say

商业间谍与黑客参与搜索专利大战 APT攻击让提升员工信息安全意识
在任何情况下,银行员工或公检法都不会向人们索要密码,如果您碰到,则是骗局无疑。

猜您喜欢

网易签约全国网安协会联盟,共同致力于信息安全
网络安全宣传动漫——在外工作时保护资产防窃
网络安全法培训短片
iPhone 8P发售18天7起爆裂:有人防爆炸把手机放锅里
IMSS NDBON
信息安全基础试卷