<html>
<p><br></p>
<p> <strong>Coinhive is a technology that is just</strong> <a href="https://coin-hive.com/blog/status-report"><strong>several weeks old</strong></a><strong>, it was formally introduced on September 14. Coinhive is rapidly turning into the cash cow of the world wide web, progressing from a revolutionary crypto-currency mining instrument to a technology heavily exploited by myriads of cyber-criminals.</strong></p>
<h3>NEW ADVERTISING ALTERNATIVE OR JUST PLAIN MALWARE?</h3>
<p>Coinhive is a JavaScript library that webmasters can use on their websites. Whenever people visit the website, the Coinhive JavaScript code runs and mines Monero for the webmaster making use of the visitor’s CPU.It is a unique and creative idea. Bravo! Coinhive creators promote it as a substitute to traditional advertisements. Coinhive states that website owners may get rid of all ads on their site, load the Coinhive and mine Monero using a tiny portion the user’s CPU during the time he/she is visiting the website. Website owners will earn money without annoying their audience with irritating advertisements.Just a couple days after it was introduced, <a href="https://thepiratebay.org/blog/242"><em>The Pirate Bay</em> tested</a> it for short time. <em>The Pirate Bay</em> abandoned it after numerous unfavorable user comments. But the concept got its momentum.Later a pair of Showtime websites (showtimeanytime.com and showtime.com) started to play with Coinhive too. It is possible that hackers breached the Showtime websites and integrated the mining code without the company’s awareness. Another theory says that Showtime is adding the script intentionally, as a test. This explanation looks more probable, as <a href="https://coin-hive.com/documentation/miner#miner-set-throttle">the setThrottle</a> value is 0.97, indicating the mining script will stay inactive for 97% of the time. A cyber intruder understanding that he may be noticed at any time, would certainly set a smaller throttle value and try to mine the maximum amount of Monero before being detected.A newly released report has determined that a website such as <em>The Pirate Bay</em> is likely to make about <a href="https://torrentfreak.com/how-much-money-can-pirate-bay-make-from-a-cryptocoin-miner-170924/">12,000 USD per month</a>. Considering the fact that <em>The Pirate Bay</em>is positioned 87 in the Alexa traffic ranking, and Showtime is only 9,500, Showtime’s earnings would be much smaller.Sadly, and in spite of the good use of a cryptocurrency miner, Coinhive is in the position of many other helpful instruments that have been misused by criminals. In the couple of days that have passed since its release, Coinhive has stretched to most corners of the hacker community.</p>
<h3><img src="http://bitcoinist.com/wp-content/uploads/2017/10/pix-malware-spreading-e1508480862421.jpg" width="640" height="419"/></h3>
<h3>COINHIVE IS SPREADING</h3>
<p>Initially, we spotted it inserted inside a well-known Chrome extension <a href="https://www.bleepingcomputer.com/news/security/chrome-extension-embeds-in-browser-monero-miner-that-drains-your-cpu/">called SafeBrowse</a>, in which the Coinhive script was placed to mine Monero in Chrome’s background every time the browser was opened and working.After that, we noticed Coinhive inserted in typo-squatted domain names. Somebody launched the twitter.com.com site and was installing the Coinhive JS library on that web page. Individuals who mistyped the Twitter domain URL found themselves on the page mining Monero for the crook. Of course, it would last only for several seconds until the person understood he was on the wrong website, but that is enough for web-entrepreneur to make a profit. Eventually and having plenty of such domains in place, their operator can make a big sum of money.Later, malware experts found several hacked websites where criminals changed the source code and quietly uploaded the Coinhive miner. Infosec <a href="https://blog.sucuri.net/2017/09/hacked-websites-mine-crypocurrencies.html">experts discovered</a>numerous hacked Magento and WordPress websites tweaked in this manner.Security specialists also noticed that one prominent and <a href="http://blog.trendmicro.com/trendlabs-security-intelligence/eitest-campaign-uses-tech-support-scams-deliver-coinhives-monero-miner/">big malvertising group</a> made use of Coinhive too. Hazardous advertisements redirected users to fake tech support sites where in addition to traditional false virus notifications, criminals put Coinhive and mined for Monero.The latest instance of Coinhive getting integrated together with malware has been revealed this week when a researcher discovered a website peddling a phony Java update which was simultaneously mining for Monero.It becomes obvious from the above cases that virus creators have found their next cash cow in Coinhive.Another place we anticipate to see Coinhive implemented is adware and especially browser hijackers. Statistics say there are millions of users who don’t care about intrusive ads and live with adware for many months. There may be no reason for adware writers not to load the Coinhive in the background and mine a few extra Monero before the victim tries to remove their adware or notice high CPU usage caused by mining.Although the Coinhive crew has clearly stated that accountability for how their library is used falls completely on the individual running the miner, malware creators do not care and never abide any rules.</p>
<p><img src="http://bitcoinist.com/wp-content/uploads/2016/06/shutterstock_306049034.jpg" width="800" height="600"/></p>
<h3>PROTECTING YOURSELF FROM THE COINHIVE JS MINER</h3>
<p>At the moment, the Coinhive phenomenon has been called crypto-jacking for the fact of hijacking browsers for crypto-currency mining.Many experts predict a massive wave of crypto-jacking disasters. Already now two ad-blockers, <a href="https://blog.adguard.com/en/adguard_vs_mining/">AdGuard</a> and <a href="https://adblockplus.org/blog/kicking-out-cryptojack">AdBlock Plus</a>, have started to block Coinhive’s JS library.Furthermore, web-developers have launched new Chrome extensions like <a href="https://chrome.google.com/webstore/detail/antiminer-block-coin-mine/abgnbkcdbiafipllamhhmikhgjolhdaf">AntiMiner</a> and <a href="https://chrome.google.com/webstore/detail/minerblock/emikbbbebcdfohonlaifafnoanocnebl">minerBlock</a> that are able to scan Chrome and terminate all mining scripts.Even though this year could be remembered for the <a href="http://bitcoinist.com/microsoft-wanacry-blame-game-ends-nsa-consumers-door/">WannaCry</a> and other <a href="http://myspybot.com/arena-ransomware/">ransomware</a> breakouts, the Equifax and CCleaner breaches, quietly, crypto-currency miners might also become the prevalent threat especially if combined with existing adware.Kaspersky lab claimed to observe about <a href="https://securelist.com/miners-on-the-rise/81706/">1.65 million PC’s</a> affected with mining malware this year. IBM also reported an increase in cryptocurrency malicious software placed on enterprise networks.Based on the Coinhive group messages, the library’s release has shown to have exceeded all expectations. Regardless if created with good motives, Coinhive’s reputation will surely be smeared in the dust in the event that malware writers keep on using it the way they do it now.</p>
<p><em><strong>What do you think of background miners like Coinhive as an alternative to traditional banner and pop-up advertising? Let us know in the comments below.</strong></em></p>
<p><br></p>
</html>