Wait, so the browser asks a server "hey, do you have a favicon?" and it replies "no, but here's some shady javascript code", the browser says "OK!". Who thought that was a good idea?
A cryptocurrency miner hidden in a favicon.ico - welcome to 2018
via @chrsklypic.twitter.com/UiLo16dUDU
-
-
-
Not exactly more like the user requests any resource. The server has htaccess rewriting to pass all requests through PHP which then responds with the script tags followed by the actual response in one go.
-
Right, but it seems like the browser should be paranoid enough not to execute a browser-side script when it was just trying to get a favicon.
-
looks like the browser isn't necessarily running it; exploit is a shotgun spray on every request, and only some of them succeed (favicon probably not one of those).
-
Agree with this. The only reason we picked out the favicon is because it happened to be the one that our firewall caught.
-
There is one way you could actually do it though. Use a service Worker. If you have a service worker set up to manage all requests on your page, then all requests for anything the browser wants will go through that service worker, in case you want to control the cache.
Fin de la conversation
Nouvelle conversation -
-
-
Looks like JS is being prepended to all page requests for any page, including 404 pages and this favicon request, and that's what starts the miner, JS in page. Favicon is just coincidence..I hope...
-
Ah OK, thanks for clarification—should have noticed that
-
I mean... is it possible to read response of favicon request in JS and dynamically load miner code from there... maybe.. but in this case it seems to be simpler. And the other simple fact: WordPress, probably WP/plugin vulnerable.. the same thing over and over..
-
End of decoded JS pictured, looks like standard Coinhive? Coinhive site id "OQoqVYH65ER2Eg2xcmoVtv4qrcHP2Z7G" matches
@bad_packets description of large campaign from https://twitter.com/bad_packets/status/958094158995931136 …pic.twitter.com/fMcjSPSEr4
-
Yes, that
#Coinhive site key is used in an ongoing#cryptojacking campaign targeting WordPress sites.https://twitter.com/bad_packets/status/963842121697382401 … -
And let me guess, CoinHive won't do anything about it, will they?
-
Sure they will. Collect their percentage of the earnings, as always.
-
which is huge: a 30% cut. For what is basically a pool+proxy. Normal XMR mining pools take what, 0.5 to maximum 2% ?
- 1 réponse de plus
Nouvelle conversation -
-
-
Merci. Twitter en tiendra compte pour améliorer votre fil. SupprimerSupprimer
-
-
-
Recommend http://bit.ly/BlockCoinMiners - a list of coin mining servers to be blocked system wide on linux based systems via hosts file. Basically adblock for your entire system.
Merci. Twitter en tiendra compte pour améliorer votre fil. SupprimerSupprimer
-
-
-
Serious? Wow…
Merci. Twitter en tiendra compte pour améliorer votre fil. SupprimerSupprimer
-
-
-
Would
@brave save a user in this case? -
I have my doubts on the success of brave, but we shall see! you can't decentralize and then accurately measure a user's attention. Then again, I'm really not qualified to comment on Brave yet.
-
I'am giving it a try, will see how it goes. If you become a brave publisher I'll definitety support you
-
Let me look into it, I might just become one if I think it'll work out haha
Fin de la conversation
Nouvelle conversation -
Le chargement semble prendre du temps.
Twitter est peut-être en surcapacité ou rencontre momentanément un incident. Réessayez ou rendez-vous sur la page Twitter Status pour plus d'informations.