Ad network uses advanced malware technique to conceal CPU-draining mining ads

[2FA]

 

 

Quote

Domain-name algorithms are a software-derived means for creating a nearly unlimited number of unique domain names on a regular basis. DGAs, as they're usually called, came to light in 2008 following the release of the highly viral Conficker worm. To prevent whitehats from seizing the domain names Conficker used to receive command and control instructions, the malware generated hundreds of new, unique domains each day that infected computers would check for updates. In the event that old domains were sinkholed, Conficker needed to reach only one of the new addresses for it to remain under its creator's control. The burden of registering more than 90,000 new domain names every year has proved so great to whitehats that Conficker continues to operate even now.

Essentially DGAs are used to create unlimited domain that consist of a random mix of numbers and characters.

 

Quote

Researchers at China-based Netlab 360 reported over the weekend that an advertising network is using DGAs to conceal the in-browser currency-mining code it runs on websites. Normally, the ad network will redirect visitor browsers to serve.popad.net, which hosts ads that load coinhive.min.js. That's the JavaScript code that bogs down visitor computers by making them participate in a giant mining pool hosted by coinhive.com, which keeps 30 percent of the proceeds and gives the remainder to the advertiser or website that provided the referral. In most cases, all of this happens behind the scenes with no visible sign of what's happening, with the exception of over-revving fans and decreasing computer performance.

This is how the cryptomining javascript normally behaves when not being blocked.

 

Quote

Computers that run an ad blocker that prevents visiting browsers from accessing the popad.net page, however, will instead be redirected to a seemingly random domain such as "zylokfmgrtzv.com," "zymaevtin.bid," or "zzevmjynoljz.bid." The decoy page then loads JavaScript that has been heavily obfuscated to conceal the mining.

 

"As early as mid 2017, this ad network provider has been using domain DGA technology to generate seemingly random domains to bypass adblock to ensure that the ads it serves can reach the end users," Netlab 360 researcher Zhang Zaifeng wrote in a blog post published Saturday, referring to a Chrome browser blocking extension called AdBlock. "Starting [in December], the bar got raised again, and we began to see these DGA.popad domains participating in cryptojacking without end-users' acknowledgement."

 

The researcher went on to say that the number of people being redirected to the algorithmically generated domains appeared to be significant. One domain, arfttojxv.com, was 1,999 in the Alexa website ranking, while vimenhhpqnb.com was 2,011 and ftymjfywuyv.com was 2,071. The websites Netlab 360 found running the DGA-enabled ads were mostly purveyors of porn and other content that's often used as bait in scams.

Overall this is a pretty alarming new tactic that hijackers have started to use and shows that they aren't about to back down despite the increasing amount of blocking against them.

 

 

Source: https://arstechnica.com/information-technology/2018/02/ad-network-uses-advanced-malware-technique-to-conceal-cpu-draining-mining-ads/

 

[Zodiark1593]

So NoScript ftw?

[rawrdaysgoby]

Ehhh laptop/desktops will have all their fans spinning hardcore you will figure it out if you are atleast a small techy

[Canada EH]

my brain hurts just reading that jazz

[captain_to_fire]

 

Reminds me when I encountered a cryptominer concealed in a legit website like USA Today

 

[NoRomanBatmansAllowed]

7 minutes ago, Zodiark1593 said:

So NoScript ftw?

The problem is that every website that isn't made in 2005 seems to crap out because they use JS for everything now.

[Donut417]

So what your telling me is this. I got ads blocked via my Synology Router, I got Ad Block Plus installed, as well as uBlock Origins. So now im going to need to install noscript? Thank Jesus I got 16 Gigs of RAM. Also Anti Virus companies are picking up on this, one of these mining things tried to run on my moms computer, but AVAST stopped it cold. 

[Energycore]

Just now, Donut417 said:

So what your telling me is this. I got ads blocked via my Synology Router, I got Ad Block Plus installed, as well as uBlock Origins. So now im going to need to install noscript? Thank Jesus I got 16 Gigs of RAM. 

I'm succesfully surviving with noscript on 8GB

[Donut417]

Just now, Energycore said:

I'm succesfully surviving with noscript on 8GB

Currently using 44% of 16 Gigs and thats just from browsing the internet. 

[Crunchy Dragon]

1 minute ago, Energycore said:

I'm succesfully surviving with noscript on 8GB

While I have to close my browser just to play PUBG/Fortnite with 8Gb....

 

Honestly, ads these days are just so annoying. I guess not even "these days", just in general. I was raised to use an adblocker(shoutout to my parents for teaching me that), but occasionally one will slip through(especially those annoying pop-ups).

 

But now this?? Honestly, this is just plain wrong.

[2FA]

1 minute ago, Donut417 said:

Currently using 44% of 16 Gigs and thats just from browsing the internet. 

Your PC will use RAM more freely if you have more installed.

[Energycore]

Just now, Donut417 said:

Currently using 44% of 16 Gigs and thats just from browsing the internet. 

I guess it could be worse.

12 tabs open, if you need more than 12 then you should reconsider your personal order

[Zodiark1593]

3 minutes ago, Energycore said:

I'm succesfully surviving with noscript on 8GB

Noscript increases RAM requirements for browsing?

[Energycore]

Just now, Crunchy Dragon said:

While I have to close my browser just to play PUBG/Fortnite with 8Gb....

 

Honestly, ads these days are just so annoying. I guess not even "these days", just in general. I was raised to use an adblocker(shoutout to my parents for teaching me that), but occasionally one will slip through(especially those annoying pop-ups).

 

But now this?? Honestly, this is just plain wrong.

That's cuz you're not on Firefox Quantum

 

I've been on adblock since forever really. When I learnt of NoScript I also incorporated to my browsing experience fully.

 

It's just, so nice to see a webpage without anything cumbersome. The last time I got a popup ad was years ago.

[Donut417]

Just now, DeadEyePsycho said:

Your PC will use RAM more freely if you have more installed.

Yeah, but I think its the two chrome windows with multiple tabs open. Last pass, Ad Blocker, uBlock origin. Google Hangouts. And such. Chrome uses more RAM than any piece of software I have installed on this machine. 

[Donut417]

1 minute ago, Zodiark1593 said:

Noscript increases RAM requirements for browsing?

No the more addons you add to the browser, the more Memory it will use. Chrome eats RAM likes it candy to begin with. 

[Energycore]

Just now, Zodiark1593 said:

Noscript increases RAM requirements for browsing?

Apparently? I don't see why it should. Maybe the user I quoted meant that they were using a lot of RAM because of the number of browser extensions, rather than noscript increasing RAM usage.

 

If anything, it should be decreased if you block the unnecessary domains (for instance I block scripts from google-analytics)

[Crunchy Dragon]

1 minute ago, Energycore said:

That's cuz you're not on Firefox Quantum

 

I've been on adblock since forever really. When I learnt of NoScript I also incorporated to my browsing experience fully.

 

It's just, so nice to see a webpage without anything cumbersome. The last time I got a popup ad was years ago.

I am on Firefox Quantum, I'll be incorporating NoScript probably tomorrow(getting tired haha).

 

Haven't had a pop-up in a while, but before then they would occasionally slip past.

[2FA]

1 minute ago, Energycore said:

That's cuz you're not on Firefox Quantum

 

I've been on adblock since forever really. When I learnt of NoScript I also incorporated to my browsing experience fully.

 

It's just, so nice to see a webpage without anything cumbersome. The last time I got a popup ad was years ago.

The holy trinity: uBlock, NoScript, Ghostery.

[Energycore]

Just now, DeadEyePsycho said:

The holy trinity: uBlock, NoScript, Ghostery.

Oh that reminds me I don't have Ghostery enabled.

 

Just now, Crunchy Dragon said:

I am on Firefox Quantum, I'll be incorporating NoScript probably tomorrow(getting tired haha).

 

Haven't had a pop-up in a while, but before then they would occasionally slip past.

Hopefully it helps with performance.

 

Blocking heavy scripts that aren't needed should decrease the RAM usage of Firefox.

[Donut417]

Well No Script doesnt exist for Chrome....... Oh well.....

[Energycore]

Just now, Donut417 said:

Well No Script doesnt exist for Chrome....... Oh well.....

Firefox is better anyway #presentingopinionsasfact

[Donut417]

Just now, Energycore said:

Firefox is better anyway #presentingopinionsasfact

Not going to happen. Im an Android User. So Chrome works better for me as it all syncs up. 

[2FA]

1 minute ago, Donut417 said:

Well No Script doesnt exist for Chrome....... Oh well.....

https://noscript.net/getit

[Energycore]

Just now, DeadEyePsycho said:

https://noscript.net/getit

Quote

Supported browsers: Firefox (Desktop and Mobile on Android), SeaMonkey, Tor Browser (where it is built-in).

No chrome in there