Cryptojacking turns your PC into a Bitcoin mine, but you won’t see a cent

insecure cryptojacking is set to become the new malware epidemic cryptocurrency unsplash1

(in)Secure is a weekly column that dives into the rapidly escalating topic of cybersecurity.

Cryptocurrency has fought for its reputation ever since its creation. Bitcoin fans have always had to defend against accusations that it’s only purpose is for illicit activities — that it’s a currency for criminals. Bill Gates even argued it has caused death in his recent Reddit AMA.

Now, cryptocurrency has yet another problem to deal with: cryptojacking. It’s the act of hacking a computer for use in cryptocurrency mining, usually without the owner knowing about it. It’s the newest evolution of malware — and it looks set to spread like wildfire.

A brave, new world

In February, Salon announced a new crowdfunding campaign that caught headlines across the internet. You can donate your computing power through cloud mining to help support the publication. It doesn’t require the installation of software, or even setting up an account.

Just like that, an alternative to paid subscriptions and ad-based revenue has appeared. Cloud mining was already catching on, and now it’s finding new, interesting use cases.

Also in February, security researcher Scott Helme published his findings on the dark side of the technology. Without getting consent from either the owner of the website or visitors, cryptocurrency scripts can be hacked into websites, which then hack visitor’s CPU power. That’s cryptojacking.

The past year has witnessed several large-scale attacks on websites like the LA Times, Tesla, and Politifact, but recently the trend has escalated in an even more startling way. Research shows that thousands of legitimate websites, including some that belong to government institutions, have been cryptojacked.

How? Helme puts it this way: “If you want to load a cryptominer on 1,000+ websites, you don’t attack 1,000+ websites, you attack the one website that they all load content from.” In one case, an assistive technology called Text Help was compromised. Any website that used it then cryptojacked visitors, without either the website owners or visitors having a clue.

Another recent report claims 50,000 websites already have crypto-mining malware ready to steal your computer’s power without your knowledge. Seven thousand websites have been discovered to contain this strain of cryptojacking on the WordPress platform alone.

Both Salon and the hackers behind recent attacks use the same tool — a JavaScript miner called CoinHive. It can be embedded on a webpage and functions in the visitor’s browser window. Hackers have taken the script and implemented it to immediately force visitors to donate their CPU power toward mining Monero coins, or XMR. (What’s that, you ask? Read our guide to the best Bitcoin alternatives).

The internet could become one big, illicit crypto-mining operation.

That wasn’t CoinHive’s intent. Instead, its developers “dream about it as an alternative to micro payments, artificial wait time in online games, intrusive ads, and dubious marketing tactics.” It’s a rather clever idea, really. The average PC is much more powerful than needed to browse the web, so why not use a bit of that performance to pay for content? The creators of CoinHive told Motherboard recently that “their reputation couldn’t be worse,” lamenting that they didn’t see the potential of cryptojacking at the time.

To be clear, cryptojacking isn’t an easy way for hackers to get rich. If a site has 10–20 active miners all day, CoinHive claims “you can expect a monthly revenue of about 0.3 XMR (~$86).” It’s relatively easy for hackers to implement, however, and the anonymous nature of cryptocurrency makes the payoff hard to trace. Consider it low reward, but very low risk. So long as cryptocurrencies keep rising in value, cryptomining — and its dark side, cryptojacking — will continue to spread.

This is only the beginning

It’s not hard to imagine cryptojacking’s future. Today, ads are everywhere you look on the internet, and off. Ads appear everywhere from YouTube to free software. Cloud cryptomining could provide an alternative, letting you “donate” some processor power for free web content or software.

We could also see a future where cryptojacking is constantly in the news — and in much greater potency. The internet could become one big illicit crypto-mining operation, and the fight against that won’t be easy. Hackers will find efficient and more subtle ways of secretly contorting innocent CPUs to make a quick buck. Right now, it’s not yet possible to mine cryptocurrency in-browser using a visitor’s GPU, which would provide much more substantial hashing power. Such a thing can’t be too far away.

insecure cryptojacking is set to become the new malware epidemic cryptocurrency unsplash3

And it doesn’t stop with in-browser mining.

Imagine the way adware works today. You’re installing a piece of software, and you quickly click through a few checkboxes to complete the installation. Without being fully aware of it, you’ve installed a piece of software that generates revenue for a company by inserting ads into your browser. Because it’s invisible, cryptojacking malware tougher to deal with. You might not even notice it quietly humming along in the background as it slows your computer and fills someone’s crypto-wallet.

This is certain to happen in a future where cryptocurrency cements its position as an online currency. It’ll give developers and website owners a new way to make legitimate cash from their work — and profit-driven hackers another potent tool in their toolbox.


How Razer forged the Blade 15, the slim gaming laptop nobody else could build

With the recent launch of the Blade 15, Razer ushered in a new design language that's cleaner and more angular. We recently visited Razer's San Francisco, California design studio to learn more about Razer's approach to design.

It's not all free money. What to know before you try to mine Bitcoin

Mining Bitcoin today is harder than it used to be, but if you have enough time, money and cheap electricity, you can still turn a profit. Here's how to get started mining Bitcoin at home and in the cloud.

Newegg was cracked, customer data has leaked, and security is clearly scrambled

Online electronics retailer Newegg has found themselves at the heart of an online security breach as the company's payment system was breached, giving hackers of the notorious group, Magecart, potential access to confidential customer data…
Emerging Tech

Giant wind farm in Morocco will help mine cryptocurrency, conserve energy

One of the windiest parts of Morocco is set to get a $2 billion wind farm power plant, which could help power eco-friendly cryptocurrency mining in a more environmentally friendly way.

A vigilante botnet is taking out crypto-jacking malware

A new botnet is on the rise but it isn't being used to take down websites or hack servers, it's going after crypto-jacking malware. When it discovers the malware on a website, it takes it over before destroying them both.

Detangle your desk with these mighty wireless mice

If you're looking for the best wireless mouse on the market, we've got the list for you!. Here are six models that will give everyone what they need, whether they're hardcore gamers or looking to ward off carpal tunnel.

Bing, Windows search evolve into new, cross-platform Microsoft Search

Microsoft is upgrading its various search tools to provide more contextual help for those seeking it. Bing, Office, and Windows search will all be upgraded over the coming months to provide much more nuanced results.

U.N. security blunder left secret Trello boards, Google Docs exposed

United Nations documents were left vulnerable to unauthorized users by staffers who left Trello boards and Google Docs unprotected and accessible to anyone who had their unique URLs.

Back for the boardroom, Microsoft outlines the future of the Surface Hub

With the Surface Hub 2 still on the horizon, Microsoft announced two additional versions of its digital whiteboard, the Surface Hub 2S and 2X, to attendees of their 2018 Ignite developer conference.

Here's how to install the free MacOS Mojave update now

Apple's newest operating system has finally arrived, and we'll show you how to download MacOS Mojave for free. After you install Mojave, you'll be able to take advantage of new apps ported from iOS, a dark theme, and more.

Chrome 69 logs you in without consent, but Google says it’s for your own good

Google is under fire for how Chrome 69 behaves. When you log into a Google service, you're automatically logged into the browser, raising serious privacy concerns. Google was forced to address its tactics and update its policy.

Microsoft Teams blurs your video background, prevents national embarrassment

Users of Microsoft Teams platform can now blur out their background during video calls as the company calls out the world's favorite BBC dad to show it can be done. Available now for all Microsoft Team customers.

Spotify vs. Pandora: Which music streaming service is better for you?

Which music streaming platform is best for you? We pit Spotify versus Pandora, two mighty streaming services with on-demand music and massive catalogs, comparing every facet of the two services to help you decide which is best.

What to expect from Microsoft’s October 2 Surface event

The October 2 Surface event is just around the corner. Let's take a look at everything Microsoft could unveil at the event, including major announcement for new Surface products, unique accessories, and long-sought Windows 10 features.