Coinhive Monero Mining script briefly appears on two Showtime sites

[WMGroomAK]

In news that might be slightly related to the recent Pirate Bay mining script, Showtime was briefly running the Coinhive on two of their websites.   It's not known whether this was a malicious hack of the site or if Showtime was looking at replacing Ad Revenue with Crypto Mining however the script has since been removed from the site.

https://www.bleepingcomputer.com/news/security/showtime-websites-used-to-mine-monero-unclear-if-hack-or-an-experiment/

 

Quote

Two Showtime domains are currently loading and running Coinhive, a JavaScript library that mines Monero using the CPU resources of users visiting Showtime's websites.

The two domains are showtime.com and showtimeanytime.com, the latter being the official URL for the company's online video streaming service.

The main Showtime domain name, sho.com, does not include the Coinhive Monero mining script.

...

It could also be that Showtime is loading the script on purpose, as part of an experiment. This is the most likely explanation, as the setThrottle value is 0.97, meaning the mining script will remain dormant for 97% of the time. A hacker, knowing his intrusion will likely be detected, would usually set a small throttle value and mine as much Monero before getting discovered.

Coinhive has been advertised as a technology that could replace ads by allowing site owners to mine for the Monero cryptocurrency. The technology is very controversial as it uses the site visitor's resources to mine Monero, driving CPU usage through the roof.

...

Coinhive, as a technology, is only ten days old, being officially launched on September 14.

Despite this, Coinhive has been recently adopted by a large number of malware operations, such as malvertisers, adware developers, rogue Chrome extensions, and website hackers, who secretly load the code in a page's background and make money off unsuspecting users.

At least two ad blockers have added support for blocking Coinhive's JS library — AdBlock Plus and AdGuard — and developers have also put together Chrome extensions that terminate anything that looks like Coinhive's mining script — AntiMiner, No Coin, and minerBlock.

So websites may be trying to move away from Ad Revenue into just using your CPU resources to raise revenue.  I think the main thing on this is that it is being done in the background instead of letting the user know that their CPU resources are being allocated for other tasks.  If they honestly are moving away from Ad based revenue and request permission for a certain amount of your CPU while you are on the site, that may be more workable than trying to do this in the background.  Especially considering that while you are visiting one of these sites you may also be running a CPU intense task in the background.

 

EDIT: So in an article on The Register where they were able to contact the Web Analytics business associated with the Showtime sites as well as some information from Coin Hive which makes it sound as if Showtime may have been breached and had this script injected temporarily.  Although Showtime still has not provided comment so it's not truly known yet where the code was injected from...

https://www.theregister.co.uk/2017/09/25/showtime_hit_with_coinmining_script/

Quote

The JavaScript, which appeared on the sites at the start of the weekend and vanished by Monday, sits between HTML comment tags that appear to be an insert from web analytics biz New Relic. Again, it is unlikely that an analytics company would deliberately stash coin-mining scripts onto its customers' pages, so the code must have come from another source – or was injected by miscreants who had compromised Showtime's systems.
...
We contacted both Showtime and New Relic today asking for more details. Showtime refused to comment. New Relic told us it had nothing to do with the mystery code.
 
"We take the security of our browser agent extremely seriously and have multiple controls in place to detect malicious or unauthorized modification of its script at various points along its development and deployment pipeline," New Relic's Andrew Schmitt told us.
 
"Upon reviewing our products and code, the HTML comments shown in the screenshot that are referencing newrelic were not injected by New Relic's agents. It appears they were added to the website by its developers."
 
We also asked Code Hive for details on the user account the injected code was mining for. "We can't give out any specific information about the account owner as per our privacy terms," the outfit informed us. "We don't know much about these keys or the user they belong to anyway."
 
The outfit did confirm to us, however, that the email address used to set up the account was a personal one, and was not an official CBS email address, further suggesting malicious activity.

 

Edited September 26, 2017 by WMGroomAK
Register Article

[vanished]

Knowing how most ad-filled sites are, I think Linus was right, a switch to this mining script might actually be easier on the system in the end  

[WMGroomAK]

9 minutes ago, Ryan_Vickers said:

Knowing how most ad-filled sites are, I think Linus was right, a switch to this mining script might actually be easier on the system in the end  

I agree that it would probably be better/easier, however I would want the sites to at least inform the visitor that their CPU is being used for mining and maybe have a slider to set the % CPU to be dedicated while on the site with a minimum value that is maybe at 5 to 10%.  

[vanished]

Just now, WMGroomAK said:

I agree that it would probably be better/easier, however I would want the sites to at least inform the visitor that their CPU is being used for mining and maybe have a slider to set the % CPU to be dedicated while on the site with a minimum value that is maybe at 5 to 10%.  

To be serious now, it probably would avoid a lot of the problems of ads, such as auto-play videos and other highly disruptive nonsense, but I don't think this is actually a practical solution.  First of all, there's the obvious issue of all mobile devices (laptops, phones, etc.).  Not only would the performance of them (particularly phones) be abysmal anyway, but you'd totally kill the battery doing this.  Just not viable.  And second, even most desktops would suffer.  While any enthusiast rig should handle this fine, the vast majority of computers out there are poorly maintained cheap prebuilts with questionable PSUs and coolers.  If this does go forward, I wonder how long it will be before we see a measurable spike in electronics sales due to people replaced things that were killed by this.

[snortingfrogs]

I'm planning on using Coinhive on my forum, I would of course let the members know about it though.

[vanished]

There's another concern I just realized.  When it comes to ads, you are able to potentially make money off the user at no expense to them.  Yes there's other issues like tracking, etc but no direct monetary impact.  With this however, you will increase that user's power bill... depending how much browsing they do in a year, it could actually be a noticeable amount.

[jagdtigger]

5 minutes ago, Ryan_Vickers said:

With this however, you will increase that user's power bill... depending how much browsing they do in a year, it could actually be a noticeable amount.

Well knowing how things work on the internet adblockers will probably block miners too, or at the very least there will be a separate addon for it... (if noscript isnt enough.)

[ScratchCat]

11 minutes ago, snortingfrogs said:

I'm planning on using Coinhive on my forum, I would of course let the members know about it though.

I personally would be against this. The majority of users are still on dual cores or quad cores, if the script supports multithreadjng you could saturate any CPU. This would not only irritate the user by causing the entire system to slow down but also slow the loading of your webpage , and as a study pointed out the longer the page load time the more likely the user will go back and look for an alternative. Not to mention that average joes laptop will thermal throttle , make an unbearable sound, heat up to uncomfortable levels and drain power like there is no tomorrow.  

A % limiter would work , however if this gained wide spread adoption we will see the same blocking cult as for ads.

[vanished]

3 minutes ago, jagdtigger said:

Well knowing how things work on the internet adblockers will probably block miners too, or at the very least there will be a separate addon for it... (if noscript isnt enough.)

I think hey already do but obviously that doesn't really answer or solve the problems I've raised.

[elkenrod]

SlipperySlope.gif

[Guest]

7 minutes ago, elkenrod said:

SlipperySlope.gif

I think this picture slipped off the forum slope

[elkenrod]

27 minutes ago, tjcater said:

I think this picture slipped off the forum slope

Naw, just used text for dramatic effect.

 

Are people serious about this?  I get that people hate ads, but are they that willing to hand over their CPU and risk further intrusion?

 

I mean ad block is widely used, now we are going to be clamoring for "mining block plus"?

[The Benjamins]

3 hours ago, Ryan_Vickers said:

Knowing how most ad-filled sites are, I think Linus was right, a switch to this mining script might actually be easier on the system in the end  

if a site had a pop-up that asked if you wanted to get ADs or you mine crypto for them in the background which would you pick?

we will say the miner stops after it reaches the amount the site would of got from ADs. (for people that leave pages open)

 

I feel I would be ok with it if they were up front about it.

[BuckGup]

The brave browser is adding a cool feature we’re you can just dump or mine crypto currencies when you are idle then it pays websites a default amount for no ads. But you also have the options to increase the payout to sites that you like and support

[Zodiark1593]

3 hours ago, ScratchCat said:

I personally would be against this. The majority of users are still on dual cores or quad cores, if the script supports multithreadjng you could saturate any CPU. This would not only irritate the user by causing the entire system to slow down but also slow the loading of your webpage , and as a study pointed out the longer the page load time the more likely the user will go back and look for an alternative. Not to mention that average joes laptop will thermal throttle , make an unbearable sound, heat up to uncomfortable levels and drain power like there is no tomorrow.  

A % limiter would work , however if this gained wide spread adoption we will see the same blocking cult as for ads.

And the battery life...

 

Big no no here.

[MoonSpot]

6 hours ago, elkenrod said:

SlipperySlope.gif

Indeed.  Once the site owners realize that, "Hey...We like money.  If we run this mining script on users PCs for longer, we'll make more $".  Then its permanent resource locking virus shit all day every day.

[Tech22]

I would NEVER agree to this. It would destroy mobile performance and battery, hurt old (or just badly speced) prebuilts and custom machines and would increase my power bills by a lot. I would much rather just see ads on the side (no autoplay nonsense no pop ups), just sidebar ads that I can 'X' out and just ignore.

[NvidiaIntelAMDLoveTriangle]

This is actually brilliant.

[PlayStation 2]

I really fucking hope this doesn't catch on.

Because once it does, it's going to get really bad.

[Shreyas1]

 

12 hours ago, WMGroomAK said:

I agree that it would probably be better/easier, however I would want the sites to at least inform the visitor that their CPU is being used for mining and maybe have a slider to set the % CPU to be dedicated while on the site with a minimum value that is maybe at 5 to 10%.  

And the lower the usage, the more ads there are.

 

Also, mobile versions of websites exist

[Master Disaster]

4 hours ago, Tech22 said:

I would NEVER agree to this. It would destroy mobile performance and battery, hurt old (or just badly speced) prebuilts and custom machines and would increase my power bills by a lot. I would much rather just see ads on the side (no autoplay nonsense no pop ups), just sidebar ads that I can 'X' out and just ignore.

Adblock/Ublock & NoScript = The best way to browse the internet.

[Master Disaster]

13 hours ago, ScratchCat said:

I personally would be against this. The majority of users are still on dual cores or quad cores, if the script supports multithreadjng you could saturate any CPU. This would not only irritate the user by causing the entire system to slow down but also slow the loading of your webpage , and as a study pointed out the longer the page load time the more likely the user will go back and look for an alternative. Not to mention that average joes laptop will thermal throttle , make an unbearable sound, heat up to uncomfortable levels and drain power like there is no tomorrow.  

A % limiter would work , however if this gained wide spread adoption we will see the same blocking cult as for ads.

It's very easy to make the script wait until the website is fully loaded before activating.

 

The bigger question here is how saturated (and by extension, worthless) the Monero coin market would become if every computer in the world suddenly started mining for it. Revenue would fall so quickly that it wouldn't be worth the effort imo.

[Cookybiscuit]

Going to need Threadripper just to browse the internet soon.

[WMGroomAK]

I'll update the news article in a moment, but found an article on The Register where they were able to contact the Web Analytics business associated with the Showtime sites as well as some information from Coin Hive which makes it sound as if Showtime may have been breached and had this script injected temporarily.  Although Showtime still has not provided comment so it's not truly known yet where the code was injected from...

https://www.theregister.co.uk/2017/09/25/showtime_hit_with_coinmining_script/

Quote

The JavaScript, which appeared on the sites at the start of the weekend and vanished by Monday, sits between HTML comment tags that appear to be an insert from web analytics biz New Relic. Again, it is unlikely that an analytics company would deliberately stash coin-mining scripts onto its customers' pages, so the code must have come from another source – or was injected by miscreants who had compromised Showtime's systems.

...

We contacted both Showtime and New Relic today asking for more details. Showtime refused to comment. New Relic told us it had nothing to do with the mystery code.

 

"We take the security of our browser agent extremely seriously and have multiple controls in place to detect malicious or unauthorized modification of its script at various points along its development and deployment pipeline," New Relic's Andrew Schmitt told us.

 

"Upon reviewing our products and code, the HTML comments shown in the screenshot that are referencing newrelic were not injected by New Relic's agents. It appears they were added to the website by its developers."

 

We also asked Code Hive for details on the user account the injected code was mining for. "We can't give out any specific information about the account owner as per our privacy terms," the outfit informed us. "We don't know much about these keys or the user they belong to anyway."

 

The outfit did confirm to us, however, that the email address used to set up the account was a personal one, and was not an official CBS email address, further suggesting malicious activity.

 

[SpaceGhostC2C]

20 hours ago, elkenrod said:

Are people serious about this?  I get that people hate ads, but are they that willing to hand over their CPU and risk further intrusion?

"We know you hate ads. That's why we are changing our business model: now, all you have to do to support us is to plug this intravenous catheter to directly feed the Matrix! (you'll get paywalled if you don't). Also, the website will still have ads, so keep that adblock thing if you want".