Rise in websites using your CPU to mine cryptocurrency
More websites are including cryptocurrency miners that use your device's CPU to generate digital coins. After a miner was found on The Pirate Bay last month, more torrent sites have added scripts. Hackers are also adding miners to websites they hijack.
The discovery of a Monero mining script on The Pirate Bay attracted a fair amount of attention online. It was the first major site found to be hosting a cryptocurrency mining script, allowing its operators to generate money by forcing visitors' CPUs to work harder. Since then, TorrentFreak reports more torrenting sites have added similar mining infrastructure.
The initial outcry around The Pirate Bay was caused by the site's failure to tell users about the activity. Some torrent sites are now seeking a solution which also benefits the visitor. The mining script can earn the user upload credits, used by private torrent providers to control access to site resources. Without upload credits, a user's activity may be restricted.
The site operators are using crypto miners as an alternative to traditional ads. The current thinking is that since ad providers don’t ask for permission, mining scripts shouldn't need to either. Unlike ads, miners don't have to be visible though, allowing sites to use your CPU for cash generation without you necessarily noticing. Site operators and visitors are still trying to work out whether this is acceptable behaviour.
In the meantime, cybercriminals are already flocking to the technique. A new Trend Micro report found the malicious use of mining scripts is on the rise. Hackers are adding the miners to sites they've previously compromised, allowing them to make some money each time a user visits. The company told the BBC there's a "huge attraction" to being able to silently use other peoples' devices to effectively mint new money.
Crypto-mining malware has been around for a while but its use is growing with the rising value of cryptocurrencies. The problem's likely to keep getting worse as more hackers attack sites with the intention of installing the malware. A successful compromise of a popular website could generate significant revenue if the script goes unnoticed for a while. The attack is also relatively simple to accomplish, making it attractive to all kinds of attacker.
Last week, two IT department leads in the Crimean government were fired after mining Bitcoin on a network of official computers. Hackers have also broken into Amazon's cloud with the intention of using its powerful infrastructure to mine Bitcoins. They created a "parasitic bot" that tried to infect other servers with the mining script, offering a new variation on corporate espionage infiltration.
