Cryptojacking turns your PC into a Bitcoin mine, but you won’t see a cent

insecure cryptojacking is set to become the new malware epidemic cryptocurrency unsplash1

(in)Secure is a weekly column that dives into the rapidly escalating topic of cybersecurity.

Cryptocurrency has fought for its reputation ever since its creation. Bitcoin fans have always had to defend against accusations that it’s only purpose is for illicit activities — that it’s a currency for criminals. Bill Gates even argued it has caused death in his recent Reddit AMA.

Now, cryptocurrency has yet another problem to deal with: cryptojacking. It’s the act of hacking a computer for use in cryptocurrency mining, usually without the owner knowing about it. It’s the newest evolution of malware — and it looks set to spread like wildfire.

A brave, new world

In February, Salon announced a new crowdfunding campaign that caught headlines across the internet. You can donate your computing power through cloud mining to help support the publication. It doesn’t require the installation of software, or even setting up an account.

Just like that, an alternative to paid subscriptions and ad-based revenue has appeared. Cloud mining was already catching on, and now it’s finding new, interesting use cases.

Also in February, security researcher Scott Helme published his findings on the dark side of the technology. Without getting consent from either the owner of the website or visitors, cryptocurrency scripts can be hacked into websites, which then hack visitor’s CPU power. That’s cryptojacking.

The past year has witnessed several large-scale attacks on websites like the LA Times, Tesla, and Politifact, but recently the trend has escalated in an even more startling way. Research shows that thousands of legitimate websites, including some that belong to government institutions, have been cryptojacked.

How? Helme puts it this way: “If you want to load a cryptominer on 1,000+ websites, you don’t attack 1,000+ websites, you attack the one website that they all load content from.” In one case, an assistive technology called Text Help was compromised. Any website that used it then cryptojacked visitors, without either the website owners or visitors having a clue.

Another recent report claims 50,000 websites already have crypto-mining malware ready to steal your computer’s power without your knowledge. Seven thousand websites have been discovered to contain this strain of cryptojacking on the WordPress platform alone.

Both Salon and the hackers behind recent attacks use the same tool — a JavaScript miner called CoinHive. It can be embedded on a webpage and functions in the visitor’s browser window. Hackers have taken the script and implemented it to immediately force visitors to donate their CPU power toward mining Monero coins, or XMR. (What’s that, you ask? Read our guide to the best Bitcoin alternatives).

The internet could become one big, illicit crypto-mining operation.

That wasn’t CoinHive’s intent. Instead, its developers “dream about it as an alternative to micro payments, artificial wait time in online games, intrusive ads, and dubious marketing tactics.” It’s a rather clever idea, really. The average PC is much more powerful than needed to browse the web, so why not use a bit of that performance to pay for content? The creators of CoinHive told Motherboard recently that “their reputation couldn’t be worse,” lamenting that they didn’t see the potential of cryptojacking at the time.

To be clear, cryptojacking isn’t an easy way for hackers to get rich. If a site has 10–20 active miners all day, CoinHive claims “you can expect a monthly revenue of about 0.3 XMR (~$86).” It’s relatively easy for hackers to implement, however, and the anonymous nature of cryptocurrency makes the payoff hard to trace. Consider it low reward, but very low risk. So long as cryptocurrencies keep rising in value, cryptomining — and its dark side, cryptojacking — will continue to spread.

This is only the beginning

It’s not hard to imagine cryptojacking’s future. Today, ads are everywhere you look on the internet, and off. Ads appear everywhere from YouTube to free software. Cloud cryptomining could provide an alternative, letting you “donate” some processor power for free web content or software.

We could also see a future where cryptojacking is constantly in the news — and in much greater potency. The internet could become one big illicit crypto-mining operation, and the fight against that won’t be easy. Hackers will find efficient and more subtle ways of secretly contorting innocent CPUs to make a quick buck. Right now, it’s not yet possible to mine cryptocurrency in-browser using a visitor’s GPU, which would provide much more substantial hashing power. Such a thing can’t be too far away.

insecure cryptojacking is set to become the new malware epidemic cryptocurrency unsplash3

And it doesn’t stop with in-browser mining.

Imagine the way adware works today. You’re installing a piece of software, and you quickly click through a few checkboxes to complete the installation. Without being fully aware of it, you’ve installed a piece of software that generates revenue for a company by inserting ads into your browser. Because it’s invisible, cryptojacking malware tougher to deal with. You might not even notice it quietly humming along in the background as it slows your computer and fills someone’s crypto-wallet.

This is certain to happen in a future where cryptocurrency cements its position as an online currency. It’ll give developers and website owners a new way to make legitimate cash from their work — and profit-driven hackers another potent tool in their toolbox.

Product Review

The iPad Pro is the best tablet ever. But don't sell your laptop just yet

Apple has unveiled a big redesign for the iPad Pro, slimming down the bezels, adding Face ID, and the ability to attach and charge the Apple Pencil. All of this comes at a high cost however, as the iPad Pro starts at $799.

These are the 5 best free antivirus apps to protect your MacBook

Malware protection is more important than ever, even if you eschew Windows in favor of Apple's desktop platform. Thankfully, protecting your machine is as easy as choosing from the best free antivirus apps for Mac suites.

Protect yourself from the latest malware with the best free antivirus software

Malware, spyware, and adware is never fun to find on your PC. Check out our picks for the best free antivirus software, so you can rid your system of any dangerous software that might be lurking around.

415,000 routers worldwide reportedly infected with cryptojacking malware

Even though there is a fix ready to prevent the threat of a cryptojacking malware discovered in Brazil earlier this year, the rapid growth of infection caused by the malware shows that not many users have installed the patch.

3DMark’s Port Royal lets you benchmark ray tracing on Nvidia’s RTX cards

UL is adding another benchmarking utility to its popular 3DMark suite to help gamers measure their graphics card's ray tracing performance. You'll soon be able to measure how Nvidia's RTX 2070, 2080, and 2080 Ti stack up.

Snatch Apple’s 2017 15-inch MacBook Pro for up to $1,200 off at B&H

The latest deal at B&H is offering up 2017 15-inch Apple MacBook Pros, in space gray and silver, with Intel Core i7 quad-core CPUs, 16GB of RAM, and AMD Radeon Pro 560 GPUs with up to 2TB of SSD storage.

I tried an LTE laptop for a month, and I wasn’t really convinced

LTE laptops offer up plenty of benefits and are becoming more common. After spending one month with one in my daily life in New York City, I really wondered if it is something that consumers really need in their lives.

Microsoft’s Chromium Edge browser may be adding your Chrome extensions

Fans sticking to Google Chrome because due to its vast extension library might be able to switch over to Microsoft's latest iteration of Edge, as a project manager confirms that the company has its eyes on Chrome extensions.

Apple Mac users should take a bite out of these awesome games

Contrary to popular belief, there exists a bevy of popular A-list games compatible for Mac computers. Take a look at our picks for the best Mac games available for Apple fans.
Emerging Tech

An A.I. cracks the internet’s squiggly letter bot test in 0.5 seconds

How do you prove that you’re a human when communicating on the internet? The answer used to be by solving a CAPTCHA puzzle. But maybe not for too much longer. Here is the reason why.

Qualcomm’s dual-screen PC concept looks like two connected Surface Go tablets

In Qualcomm's video teaser, we got a glimpse of the company's vision for how a dual-screen ARM PC should work. The internet reacted to Qualcomm's video, calling the device in question merely a mashup of two Surface Go tablets.

Check out the best Green Monday deals for those last-minute gifts

Black Friday and Cyber Monday have come and gone, but that doesn't mean you've missed your chance of finding a great deal. We're talking about Green Monday, of course, and it falls on December 10.

Hololens 2 could give the Always Connected PC a new, ‘aggressive’ form

Microsoft is said to be leaning on Qualcomm to power its Hololens 2 headset. Instead of Intel CPUs, the next Hololens could use a Snapdragon 850 processor, allowing it to benefit from the always-connected features.

Chrome’s dark mode may cast its shadow over Macs by early 2019

By early 2019 Google may release a version of Chrome for Mac users that offers a Dark Mode feature to match MacOS Mojave's recent darkening.