Review

HiveBlockchainReview

Hive Review: Steem Fork & Blockchain for Web 3.0

News

When it comes to pay per view entertainment in sport, nothing quite compares to live fighting. This is true of Boxing and Mixed Martial arts (MMA). The Ultimate Fighting Championship (UFC) is the home of MMA and fans from all across the world log into their website to watch the latest fights.



However, according to a report from the <a href="https://www.theregister.co.uk/2017/11/07/ufc_coin_hive/" target="_blank" rel="nofollow noopener">register</a>, the UFC pay per view website (ufc.tv) was found to have the coin hive JavaScript mining plugin. What is not immediately clear at this stage is whether this was done intentionally by the UFC or if this was as a result of a malicious actor.



If it was inserted by UFC themselves then users of UFC then this would be particularly unpalatable. This is because the UFC already charges users for the right to access the fights from their PC via a subscription.



<h2>Well Known Miner</h2>



We have previously covered numerous reports of the coinhive miner that has been found on a range of websites from the <a href="https://{MIGRATED_DOMAIN}/news/websites-using-malvertising-mine-monero/">pirate bay</a> to <a href="https://{MIGRATED_DOMAIN}/news/cbs-websites-found-monero-mining-code/">CBS Showtime</a>. The Javascript plugin uses the PC's browser to mine for the <a href="https://{MIGRATED_DOMAIN}/search/?page=1&search=monero/">Monero</a> cryptocurrency. It is not a malicious script and will only make use of processing power and possibly slow down the PC.



In the case of the UFC website, a user was able to pick up on it when their Avast anti-malware scanner alerted them to it. Upon noticing that the script was trying to use their browser to mine coins, the user took to Reddit and made his feelings known.



<blockquote class="wp-block-quote">
I noticed this because my anti virus kept pinging off every time I went on Fight Pass. It’s not harmful AFAIK, but doing this on a service we’re paying for is fucked up imo. I researched Coin Hive (mentioned by my anti virus) and found the javascript on their website, and sure enough it’s running on Fight Pass.
</blockquote>



<h2>Who is to Blame?</h2>



It seems most likely though, that it was not the UFC that had inserted this script onto their site. Much like the case of the CBS showtime script, it would not make sense for such a large company with extensive revenues to imped user experience with a mining script. This is because the amount of money that they could be expected to make from the mining could be out shadowed by the lost revenue of clients ending their subscriptions.



Hence, one can only conclude that the miner was inserted by a hacker. We have noted the <a href="https://{MIGRATED_DOMAIN}/news/coinhive-miner-proliferating-exponentially/">exponential rise of Coinhive</a> being used on websites. There has been no communication from the UFC on the mining script even though it has been removed.



Either of the scenarios of how the script got there would be troubling. If it was a hacker then it means that the UFC website has a vulnerability that could open it up to more damaging exploits. If it was the UFC then it would be highly unethical and could open the company up to lawsuits.



A good lesson from this is that you should always have your antivirus updated when browsing online and streaming content. The Coinhive miner will try to make you an unwitting miner even when you are watching your sport of choice.



Featured Image via Fotolia

strapi-2017-11-UFCMoneroMiner.jpg

UFC Website Gets Knocked Out with Coin Hive Miner

Launched on the 14 of September, Coinhive is a relatively new website JavaScript plugin that garnered some interest from the cryptocurrency community. However, over the past month, it has grown at a near exponential rate and is mining vasts amounts of <a href="https://{MIGRATED_DOMAIN}/education/what-is-monero/">Monero</a> for those who are using it legitimately or otherwise.



It has been discovered on sites such as the Piratebay, CBS ShowTime and a number of other streaming websites. Some of these are been done by the actual webmasters themselves while others are exploiting vulnerabilities in well-known websites in order to make money with them in an elicit fashion.



This is not the first time that miners have used <a href="https://{MIGRATED_DOMAIN}/news/russian-hackers-targeting-pc-mining/">malware to mine crytpocurrency</a> from unsuspecting users. It was recently discovered by Kaspersky security labs that hackers had spread windows exploits that mined Monero on a user’s PC in the background.



<h2>What is Coinhive?</h2>



<img style="margin: 0px 0px 15px 15px;" src="https://img.coinbureau.dev/strapi/2017/10/coinhiveAd.jpg" alt="Coinhive Monero Miner Website" align="right">For those who have not heard about it, <a href="https://coinhive.com/" target="_blank" rel="nofollow noopener">Coinhive</a> is a JavaScript library that someone can insert into their websites code. It is then programmed to self-execute in the browser of the user and will utilise their CPU to crunch some numbers on the Monero blockchain.



Although many may look at it as a potentially malicious script, it does have legitimate users and was developed explicitly for that purpose. Instead of these sites having to rely on advertising revenue that could hamper user experience, Coinhive allows the users to contribute to the site through processing power.



For example, the Pirate bay which is a large torrent site, <a href="https://{MIGRATED_DOMAIN}/news/websites-using-malvertising-mine-monero/">made use of the miner</a> in a test session. This was unfortunately short lived as many users complained about their browsers being used for the benefit of the webmaster. This seemed to have got the ball rolling though.



Next came the news the CBS Showtime brand's website had the curious miner <a href="https://{MIGRATED_DOMAIN}/news/cbs-websites-found-monero-mining-code/">embedded in its code</a>. This was quite suspicious as many people believed CBS would not have implemented this as it would hamper user experience. However, the SetThrottle in the code on ShowTime was set at 0.97 which implies that it only mines 3% of the time. This is not the usual MO of a cyber-criminal.



Using Coinhive on a site can indeed be quite a profitable venture. For example, a recent analysis has concluded that a site with the traffic such as Pirate Bay is likely to make about <a href="https://torrentfreak.com/how-much-money-can-pirate-bay-make-from-a-cryptocoin-miner-170924/" target="_blank" rel="nofollow noopener">12k a month</a> from the mining.



Yet, any innovation no matter the intent could eventually be used for the benefit of cyber criminals and this is exactly what happened in this case as the code spread to all corners of the hacking community.



<h2>Exponential Growth</h2>



<img style="margin: 0px 0px 15px 15px;" src="https://img.coinbureau.dev/strapi/2017/10/threatWarning.jpg" alt="Coinhive Threat Warning AVG" align="right">As hackers have realised the potential of the miner, so has it cropped up in a number of other locations. For example, it has been located in the source code of a chrome plugin. This would allow the hackers to mine from the users every time they are using their chrome browser.



Hackers have also used chameleon domains in order to trick the users. For example, they would register a domain such as facebooc.com or the like which looks like the original site. Once users enter this domain they are taking to the fake site which runs the script. Of course, this is only for a short period of time as the user will eventually bounce.



However, if the hacker was to create a number of different chameleon domains like this then they are likely to be able to mine a large amount of Monero across a range of different sites.



Of course, why should a hacker create their own domain when they can merely hack existing websites with a great deal of traffic. This has happened as reports by <a href="https://blog.sucuri.net/2017/09/hacked-websites-mine-crypocurrencies.html" target="_blank" rel="nofollow noopener">Sucuri.net</a> have discovered sites with the popular WordPress and Magento CMSs that have been hacked and the code inserted.



These scripts could also be used for a number of adware campaigns as the hackers have realised that users are becoming increasingly immune to these ads. Hence, they could make much more if they just load the ads with the JavaScript plugin and let it tick away in the background.



<h2>How to Avoid it</h2>



You would be pleased to know that a few ad blocking plugins are now beginning to realise the threat posed by JavaScript miners and have started to actively block the script from executing. For example, <a href="https://adblockplus.org/blog/kicking-out-cryptojack" target="_blank" rel="nofollow noopener">AdBlock plus</a> is able to recognise the script in the background.



There are also a number of browser plugins that have been developed solely for the purpose of blocking the miners. These include such plugins as MinerBlock and Antiminer.



<h2>The Subtle Threat</h2>



Although the cybercrime that makes the headlines are the ones that tend to scare, they are sometimes less effective as those that attempt to go under the radar. This is exactly what malware mining scripts are designed to do.



Moreover, because they go unnoticed for a relatively long period of time, people do not report them and hence remove them. This means more profit for the miner. Even though coinhive was developed as an alternative method for site fundraising, it has been exploited.



As a user, if you are able to install the right preventative measures on your browser then you are likely to counter the threat (at least for now).



Featured Image via Fotolia