Jump to content
Search In
  • More options...
Find results that contain...
Find results in...
captain_to_fire

Websites use your CPU to mine cryptocurrency even when you close your browser

Recommended Posts

Posted · Original PosterOP

Source: Ars Technica

 

Quote

hidden_mining.gif

 

Researchers have discovered a new technique that lets hackers and unscrupulous websites perform in-browser, drive-by cryptomining even after a user has closed the window for the offending site.

 

Over the past month or two, drive-by cryptomining has emerged as a way to generate the cryptocurrency known as Monero. Hackers harness the electricity and CPU resources of millions of unsuspecting people as they visit hacked or deceitful websites. One researcher recently documented 2,500 sites actively running cryptomining code in visitors’ browsers, a figure that, over time, could generate significant revenue. Until now, however, the covert mining has come with a major disadvantage for the attacker or website operator: the mining stops as soon as the visitor leaves the page or closes the page window.

 

Now, researchers from anti-malware provider Malwarebytes have identified a technique that allows the leaching to continue even after a user has closed the browser window. It works by opening a pop-under window that fits behind the Microsoft Windows taskbar and hides behind the clock. The window remains open indefinitely until a user takes special actions to close it. During that time, it continues to run code that generates Monero on behalf of the person controlling the Website. The animated GIF image at the top of this post shows the Windows task bar on the left. On the right is the offending browser window as the user removes it from its hiding place, resizes it, and finally closes it. In a blog post published Wednesday morning, Malwarebytes Lead Malware Intelligence Analyst Jérôme Segura wrote:

 

This type of pop-under is designed to bypass adblockers and is a lot harder to identify because of how cleverly it hides itself. Closing the browser using the “X” is no longer sufficient. The more technical users will want to run Task Manager to ensure there is no remnant running browser processes and terminate them. Alternatively, the taskbar will still show the browser’s icon with slight highlighting, indicating that it is still running.

So ransomware is old, cryptocurrency malware is the new kid. I don't think ransomware is going away anytime soon but given that many anti-virus programs have some sort of behavior blocking capabilities that can recognize known behavior of zero-day ransomware like accessing disk sectors or tampering the master boot record, block it's execution and even roll back malicious actions like unwanted encryption and with that, malware authors probably saw a decrease in people paying for ransom. Malware authors probably think why not just use their victim's PC to mine cryptocurrency without their permission.

 

What's worrisome to these new cryptocurrency malware is that it can evade ad-blockers. There are even Chrome extensions that are being used to mine cryptocurrency and even pirated content website Pirate Bay is using stealthy miners to monetize traffic. AV vendor Bitdefender commented that these coin miners aren't full pledged malware but most anti-virus programs including detect and block cryptocurrency miners if they are being executed without user permission and users are given the chance to whitelist them. Since an ad blocker is not going to prevent stealthy miners, the best way to prevent them is to stay away from piracy websites and to use an up to date security solution. 

 

I once considered mining Ethereum after reading @Ryan_Vickers's post but I don't think what I'll earn from Ethereum is worth it since I don't have free electricity and I need an AMD graphics card.


There is more that meets the eye
I see the soul that is inside

 

Making Windows Defender as good or even better than paid options

Link to post
Share on other sites

Nothing makes me want to revisit a site like having a hidden pop up mining in the background. :x


[Out-of-date] Want to learn how to make your own custom Windows 10 image?

 

Desktop: AMD R9 3900X | ASUS ROG Strix X570-F | Radeon RX 5700 XT | EVGA GTX 1080 SC | 32GB Trident Z Neo 3600MHz | 1TB 970 EVO | 256GB 840 EVO | 960GB Corsair Force LE | EVGA G2 850W | Phanteks P400S

Laptop: Intel M-5Y10c | Intel HD Graphics | 8GB RAM | 250GB Micron SSD | Asus UX305FA

Server 01: Intel Xeon D 1541 | ASRock Rack D1541D4I-2L2T | 32GB Hynix ECC DDR4 | 4x8TB Western Digital HDDs | 32TB Raw 16TB Usable

Server 02: Intel i7 7700K | Gigabye Z170N Gaming5 | 16GB Trident Z 3200MHz

Link to post
Share on other sites
Posted · Original PosterOP
Just now, DeadEyePsycho said:

Nothing makes me want to revisit a site like having a hidden pop up mining in the background. :x

Not only will it crank up CPU usage without user consent and make money from it, it can even evade ad blockers. 


There is more that meets the eye
I see the soul that is inside

 

Making Windows Defender as good or even better than paid options

Link to post
Share on other sites
Just now, hey_yo_ said:

Not only will it crank up CPU usage without user consent and make money from it, it can even evade ad blockers. 

How do you look behind the clock?


My Rig

CPU - Ryzen 5 1600@3.8ghz          GPU - XFX XXX RX580 8g          Cooler - Arctic Freezer 33 eSports edition green          Motherboard - Gigabyte AB350 Gaming 3          Ram -  G.Skill 2x8 Ripjaws 5 2666                   Case - Pahntecs P400s TGE Modded with Green accents          PSU - Seasonic M1211 evo 620w          SSD - Samsung 960 evo 500 GB          HDD - Seagate Barracuda 7200rpm 2tb       

 Fans - 2 be quiet SilentWings 3         OS - Windows 10 Home 64-Bit         Cables - Cable Mod Green Cable Extension

 Peripherals

Mouse - Logitech G502          Keyboard - k95 Platinum Brown          Headset - Philips SHP9500s + Vmoda Boom Pro          Monitor - LG 29UM69GB

Webcam - USB webcam for Wii Fitness game xD

Link to post
Share on other sites
2 minutes ago, hey_yo_ said:

Not only will it crank up CPU usage without user consent and make money from it, it can even evade ad blockers. 

for now


Solve your own audio issues  |  First Steps with RPi 3  |  Humidity & Condensation  |  Sleep & Hibernation  |  Overclocking RAM  |  Making Backups  |  Displays  |  4K / 8K / 16K / etc.  |  Do I need 80+ Platinum?

If you can read this you're using the wrong theme.  You can change it at the bottom.

Link to post
Share on other sites
2 minutes ago, Vandorlot said:

How do you look behind the clock?

Magic


"May your frame rates be high and your temperatures low"

I misread titles/posts way too often--correct me if I don't.

 

Link to post
Share on other sites
3 minutes ago, Vandorlot said:

How do you look behind the clock?

Unlock your taskbar and drag it to one of the other sides.


[Out-of-date] Want to learn how to make your own custom Windows 10 image?

 

Desktop: AMD R9 3900X | ASUS ROG Strix X570-F | Radeon RX 5700 XT | EVGA GTX 1080 SC | 32GB Trident Z Neo 3600MHz | 1TB 970 EVO | 256GB 840 EVO | 960GB Corsair Force LE | EVGA G2 850W | Phanteks P400S

Laptop: Intel M-5Y10c | Intel HD Graphics | 8GB RAM | 250GB Micron SSD | Asus UX305FA

Server 01: Intel Xeon D 1541 | ASRock Rack D1541D4I-2L2T | 32GB Hynix ECC DDR4 | 4x8TB Western Digital HDDs | 32TB Raw 16TB Usable

Server 02: Intel i7 7700K | Gigabye Z170N Gaming5 | 16GB Trident Z 3200MHz

Link to post
Share on other sites

I have a transparent task bar, Will I still not see it?  Also I have block pop ups selected in FF, does that not work?


QuicK and DirtY. Read the CoC it's like a guide on how not to be moron.  Also I don't have an issue with the VS series.

Sometimes I miss contractions like n't on the end of words like wouldn't, couldn't and shouldn't.    Please don't be a dick,  make allowances when reading my posts.

Link to post
Share on other sites

If you can't see an open window on your taskbar, you're not very good with computers.


Hand, n. A singular instrument worn at the end of the human arm and commonly thrust into somebody’s pocket.

Link to post
Share on other sites
1 minute ago, mr moose said:

I have a transparent task bar, Will I still not see it?  Also I have block pop ups selected in FF, does that not work?

You can sort of see it.

 

Not all pop ups get blocked, can confirm from less than reputable sites I've visited (not really they just had bad ads).


[Out-of-date] Want to learn how to make your own custom Windows 10 image?

 

Desktop: AMD R9 3900X | ASUS ROG Strix X570-F | Radeon RX 5700 XT | EVGA GTX 1080 SC | 32GB Trident Z Neo 3600MHz | 1TB 970 EVO | 256GB 840 EVO | 960GB Corsair Force LE | EVGA G2 850W | Phanteks P400S

Laptop: Intel M-5Y10c | Intel HD Graphics | 8GB RAM | 250GB Micron SSD | Asus UX305FA

Server 01: Intel Xeon D 1541 | ASRock Rack D1541D4I-2L2T | 32GB Hynix ECC DDR4 | 4x8TB Western Digital HDDs | 32TB Raw 16TB Usable

Server 02: Intel i7 7700K | Gigabye Z170N Gaming5 | 16GB Trident Z 3200MHz

Link to post
Share on other sites

This is a bit awkward, but i actually use the website they showed off as an example and this has never happened to me. Literally just closed that tab before coming here. Wonder how common it actually is.

Link to post
Share on other sites
Posted · Original PosterOP
Just now, Name Taken said:

Use extensions to block other extensions.

Again, ad blockers like uBlock Origin don’t prevent miners from running without consent 


There is more that meets the eye
I see the soul that is inside

 

Making Windows Defender as good or even better than paid options

Link to post
Share on other sites
Just now, hey_yo_ said:

Again, ad blockers like uBlock Origin don’t prevent miners from running without consent 

There are dedicated miner block extensions.

Link to post
Share on other sites
9 minutes ago, DeadEyePsycho said:

can confirm from less than reputable sites I've visited (not really they just had bad ads).

*Points accusing finger at @DeadEyePsycho*

 

Sure, we understand "Not really bad"

Spoiler

mEEZUf2.gif

 

The second Monero was conceived this was always going to happen.  Hard to not see it as having been the intention from the start tbh.  Hopefully Google/chrome/FireFox start black listing them, its completely unacceptable.

Link to post
Share on other sites
9 minutes ago, mr moose said:

Also I have block pop ups selected in FF, does that not work?

FF, much like every browser I've used outside of Safari, is very hit or miss on blocking pop ups. Safari is the only exception because I only go to LTT, YouTube, and Bing with it.


Come Bloody Angel

Break off your chains

And look what I've found in the dirt.

 

Pale battered body

Seems she was struggling

Something is wrong with this world.

 

Fierce Bloody Angel

The blood is on your hands

Why did you come to this world?

 

Everybody turns to dust.

 

Everybody turns to dust.

 

The blood is on your hands.

 

The blood is on your hands!

 

Pyo.

Link to post
Share on other sites
Posted · Original PosterOP
Just now, Name Taken said:

There are dedicated miner block extensions.

I didn’t know that miner blockers exist. As of now, most AV programs like Bitdefender which is the one I’m currently using will block miners that attempt to execute without my consent. 


There is more that meets the eye
I see the soul that is inside

 

Making Windows Defender as good or even better than paid options

Link to post
Share on other sites
2 minutes ago, hey_yo_ said:

Again, ad blockers like uBlock Origin don’t prevent miners from running without consent 

It actually does. Just try it, the bitcoin miner - list is enabled by default and it's set to block e.g. Monero. The list is actually quite large already.


Hand, n. A singular instrument worn at the end of the human arm and commonly thrust into somebody’s pocket.

Link to post
Share on other sites
4 minutes ago, MoonSpot said:

*Points accusing finger at @DeadEyePsycho*

 

Sure, we understand "Not really bad"

  Reveal hidden contents

mEEZUf2.gif

 

The second Monero was conceived this was always going to happen.  Hard to not see it as having been the intention from the start tbh.

Nah, just frowned upon by the government.


[Out-of-date] Want to learn how to make your own custom Windows 10 image?

 

Desktop: AMD R9 3900X | ASUS ROG Strix X570-F | Radeon RX 5700 XT | EVGA GTX 1080 SC | 32GB Trident Z Neo 3600MHz | 1TB 970 EVO | 256GB 840 EVO | 960GB Corsair Force LE | EVGA G2 850W | Phanteks P400S

Laptop: Intel M-5Y10c | Intel HD Graphics | 8GB RAM | 250GB Micron SSD | Asus UX305FA

Server 01: Intel Xeon D 1541 | ASRock Rack D1541D4I-2L2T | 32GB Hynix ECC DDR4 | 4x8TB Western Digital HDDs | 32TB Raw 16TB Usable

Server 02: Intel i7 7700K | Gigabye Z170N Gaming5 | 16GB Trident Z 3200MHz

Link to post
Share on other sites
Posted · Original PosterOP
2 minutes ago, LeapFrogMasterRace said:

This is why we need to end net neutrality 

What does ending net neutrality have anything to do with cryptocurrency malware? 


There is more that meets the eye
I see the soul that is inside

 

Making Windows Defender as good or even better than paid options

Link to post
Share on other sites
1 minute ago, hey_yo_ said:

What does ending net neutrality have anything to do with cryptocurrency malware? 

Pretty sure he was just being facetious.


Hand, n. A singular instrument worn at the end of the human arm and commonly thrust into somebody’s pocket.

Link to post
Share on other sites
14 minutes ago, hey_yo_ said:

Wut? What do you mean clock? 

"Now, researchers from anti-malware provider Malwarebytes have identified a technique that allows the leaching to continue even after a user has closed the browser window. It works by opening a pop-under window that fits behind the Microsoft Windows taskbar and hides behind the clock."
 


My Rig

CPU - Ryzen 5 1600@3.8ghz          GPU - XFX XXX RX580 8g          Cooler - Arctic Freezer 33 eSports edition green          Motherboard - Gigabyte AB350 Gaming 3          Ram -  G.Skill 2x8 Ripjaws 5 2666                   Case - Pahntecs P400s TGE Modded with Green accents          PSU - Seasonic M1211 evo 620w          SSD - Samsung 960 evo 500 GB          HDD - Seagate Barracuda 7200rpm 2tb       

 Fans - 2 be quiet SilentWings 3         OS - Windows 10 Home 64-Bit         Cables - Cable Mod Green Cable Extension

 Peripherals

Mouse - Logitech G502          Keyboard - k95 Platinum Brown          Headset - Philips SHP9500s + Vmoda Boom Pro          Monitor - LG 29UM69GB

Webcam - USB webcam for Wii Fitness game xD

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Newegg

×