Crypto-jacking - Computerphile
Вставка
- Опубліковано 25 чер 2018
- Crypto-jacking or Drive-By Mining is the process of embedding cryptocurrency mining code in a website. Dr Mike Pound tries it out.
Cookie Stealing: • Cookie Stealing - Comp...
Bitcoin Mining Explained in 4 Minutes: • Bitcoin Mining in 4 Mi...
/ computerphile
/ computer_phile
This video was filmed and edited by Sean Riley.
Computer Science at the University of Nottingham: bit.ly/nottscomputer
Computerphile is a sister project to Brady Haran's Numberphile. More at www.bradyharan.com
Mike has a thinkpad and covers his webcam? What a beautiful hunk of a man
With an EFF sticker, no less
@Philip Alexander maybe you need to use it someday
I just don't have a webcam, if I did have one I'd go for one with a physical off switch or buy a switching hub (which I've thought about getting one anyway but haven't found one that has decent reviews and no lights).
I have a ThinkPad and I opened it up and hard disconnected the webcam 🤣🤣🤣
he also mines Monero like a gigachad
When I was home for the holidays, I went to my public library and discovered Monero miners running on all of the public computers. Had to explain what that was the the “IT” person there.
He was probably the one that put it there :------------------------------)
I believe that the honest version of this is genius. I happily donate CPU time for services.
Don't forget to calculate energy usage, you're paying to run all those calculations!
In that case i’ll just get a nice Celeron processor for them to use ;)
No, get an adblocker.
Not sure if you can just use Brave Browser. It's got an opt-in.
On a global scale this doesn't sound all that ecological :/
The more knowledgeable someone is about the internet, the more likely it is they've got a sticker over their webcam.
I started putting a cover on my camera after seeing Bill Gates with his camera covered.
Do not forget that you phone likely has a camera to ;)
It's not a good option if you actually need your webcam once in a while. Why don't webcams come equipped with eyelid-like mechanical shutters?
Or no webcam at all ^^
Next time someone accuses me of being in the tinfoil hat club for having an awareness of the possibility of getting my camera hacked, I now have two places to refer them lol
7:10 They may have used Coinhive's script because it was likely that browsers and antimalware would allow it to run
Surprised it's taken this long to be fair. When I first heard about bitcoin years ago the first thought that came to my head was "somebody could easily make a phone app that does some mining in the background".
Hey, Mike, I was wondering why I generally see you with (generically) Windows or Linux machines but Steve (Bagley) seems to have a preference for Apple? How about a vid showing what tech you guys own and why - including phones, tablets and gaming systems? I used to love Apple but the more I learn about that company the more I've begun to despise them. How do computer-savvy guys justify buying Apple? Is it the ergonomics, the kudos, security concerns? It definitely can't be bang for your buck!
Big fan of yours and the channel btw, keep hitting us up with new content :)
macOS is unix based and more programmer friendly. A bit more secure than windows too.
If you're a programmer and you're *given* a laptop at work, you'll be offered a Windows or a macOS computer, almost always. I have Linux on all my computers at home, but as far as computers which I'm allocated, I always choose macOS. It has Bash, SSH, git, gcc, and all the other tools you'd expect in a Unix-like environment. This makes development on macOS quite a bit simpler, since there's not as much setup required.
they won't do it since they are not streamers
Absolutely loving the crypto theme lately mate!
Oh look who has turned up... 👍
I love videos of Dr. Mike Pound
We have come a long way since TSR's. Thanks for the upload.
2:13 LOL the comments XD
Julian: What language is this? It is nonsense.
Mike P.: I'm not biased, but you're great
Everyone: I like Prof. Brailsford Better.
lipsum
*holds two fingers out in the shape of a gun*
"You 'bout to get cryptojacked, foo'!"
[Jamie A]+ Next time ya should've gone to a more popular bar!
Great to see you Dr Mikey. My OCD problem keeps telling me that middle draw should be shut properly.
A Minecraft Mod that mines cryptocurrency as you mine blocks in game.
What would the point of that be?
Microsoft and Minecraft content makers (modders, map makers, servers) could make money without needing to implement microtransactions.
But why tie this to mining blocks?
Cuz why would you tie it to crafting? It's _mining_ cryptocurrency after all, not _crafting_ cryptocurrency.
All jokes aside, it would probably work as just running in the background as the game is being played.
Ye slap some cpu hogging mining on a cpu hogging game, what could possibly go wrong
The problem with this that I've experienced was that some of these sites crank the CPU draw to 100%. I opened a link from discord to some meme compass something or other, and Chrome was hanging, and every other task was halting momentarily every few seconds while that one tab was open. It was eating 100% of all 6 cores in my machine..
I love your enthusiasm! And the explanations are great as well, thanks!
I love watching Dr. Mike speak. Cracks me up!
Btw the "not bad idea" is currently being developed as Oyster Pearl, with a consent box once you visit a site that uses it and without hogging your cpu.
you should check Jsecoin as well
same idea but it works on a lottery system instead of PoW (eliminates mining farms, abusers etc)
Another great idea (encouraging creators to make engaging content you want to watch/read for longer) subverted by greedy buggers. I hope the 'legit' angle works out - i'd happily pay CPU cycles for good content.
But would you pay CPU cycles for mediocre to poor content? I can't imagine a system like this would return integrity (or basic grammar and editing) to the news. The best content (will always be) free or cheap because people who make the best content do it for the love of creating and not the love of money (or monero)
@@SineN0mine3 if the content is poor, you'll just close the tab. Same if the video/article is too verbose.
Yay, more Mike!
Especially in the olden days, where I had do live of 300mb of internet per month, this would have been a great alternative to any (most importantly video) ad. It costs electrical power, but that over buying data packs, which tend to be horrendously expensive.
not really you still need to use some of the transfer, question is how much compared to videos
Maciej Bator mining is very small bandwith
I've seen a pretty smart malware that was mining only when the user was afk, like a screensaver. Once again the fans gave it out.
I'm a simple woman. I see Mike Pound in the thumbnail, I click.
Dragon Curve Enthusiast I've never seen that HTML tag. Must've been deprecated when we went over to HTML5...
Also, comment looks like an attribute with no value. Invalid markup. :)
Ghost cube in the background!! I also have a large collection 😀
Mike is the best. The new Sean :-)
I have a theory: in this Alternate Spiderverse, Peter Parker (by Tobey Maguire) got fed up with chasing low-budget criminals in NY, quit his cr*ppy job and moved into the UK. There he developed an English accent, got a degree (and later a PhD) in cybersecurity to protect his new identity and since he already had close relations with the Web ;)
So, this would be the origin story of Dr. Mike Pound
Toby, I mean Mike, is the best spiderman!
is this a good topic for thesis?
They still work. They found ways to circumvent all that..I had them slow down my pc a lot since 2018 but also here in 2019 if I had not a plugin/addon that blocks it.
Are those captchas that do a bit of mining what sci hub uses? I've been downloading a lot of scientific papers lately and I get them fairly frequently. I definitely do not mind letting sci-hub use my CPU to mine a little, their service is phenomenal and somebody needs to make science more accessible if the journals and academies are too corrupt. If this is how they're generating revenue then I approve of it.
Any idea on how much they can get away with?? i mean compared to normal ads is this better or worse for them
Honestly I'd prefer this over ads.
There's something cheeky about Dr Mike. Can't quite put my finger on it
This is awesome, i was thinking of making games that allowed people to optionally do this. I wouldnt know where to begin with mining though, i guess start with a library.
I want you and only you in the videod! Learned so much in the last few days bingewatching the older videos ☺
Spots Thinkpad laptop and respect for him increases to 1200%. :-)
MAN! THIS WAS MIND BLOWING! AWESOME WORK!
Which thinkpad model is Dr.Pound using?
Did mike ever go to wakefield college around 98 ish?
Does Mike have an EFF sticker? Hahah love it
"You can run the user's CPU at 100% to mine cryptocurrency and never tell them about it."
Cooking Mama: Cookstar: "Write that down, write that down!!"
Can you bypass this with removing the element the script is in via F12?
7:13 lazy? ...or efficient? ;)
That is the same thing quite more often than people would think.
Ain't that the truth.
I would say less lazy, and more a form of obfuscation. Because I'm sure embedding the javascript would blow up the files to a very noticeable size. And if it just redirects to the hacker's own code on their website, it'd be very obvious whose code it is.
Efficient
Efficiency...is just clever laziness.
What was the size of his payload script?
Wouldn't a solution be for at kernal level force a popup when connecting to known bitmine IPs to confirm with the user they want to allow bitmining?
No because you could just connect to a proxy which connects to the network/pool for u
I had to discourage my friend from implementing hidden mining on his website. He listened.
yeah people listen a lot...
First heard about this on Gamers Nexus a while ago. Even without anti-mining, I think you'd notice if your CPU usage was high (I ceraintly notice when it's above 25%), especially if you have lots of fans. Also why use CPU? Surely they'd do much better using GPU. I know you can't choose in JavaScript and there's no threading but perhaps having a rendering task from which the resulting computation can be used for generating hashes might be viable?
Monero is CPU only and JavaScript has limited access to the GPU
So does it basically work as a botnet but for mining crypto-currency
yes.
Not really.
If I notice my cpu goes higher when opening a page, how can I tell it is mining something or just awful page design. Today I noticed this when going to the home page of typora, a text editor software.
You can't unless you read the javascript.
Twitter had a self retwetting tweet a few years back. Now with 280 characters limit I guess that + this = chaos
I wish his blog was online
I wonder about the economical impact, if mining replaced ads in most places.
What a terrific idea! Are we going to see new types of malware detection software now?
Its a JavaScript script, these things are usually in blacklists of your mainstream browser/adblocker on desktop already, so no. Mobile, i don't know.
If you use uBlock Origin, Coinhive is already blocked (under "uBlock filters - resource abuse").
"I hope there's some vetting process for these apps." There's not, apple and google say there is, but there isn't. Nobody is checking those apps.
cosby714 and now there is
There are automatic checks and for Apple also manual checks (I work for a company that has several hundered apps in both stores and we have to deal with those from time to time). But the former won't catch everything and the latter is pretty easy to get around, you can for example set the code to not execute in the first month after the app was build so it won't run when tested. The automatic checks are much harder to pass but with some clever obfuscation (or just sideloading) even that is doable.
I love this man
The problem with all currencies is that maintaining the stability and value are dependent upon difficulty in obaing. If the value where to increase if the difficulty increasing the the production of gold or bitcoin was not present. That value would easily be diminished as supply can easily meet demand. Bitcoins are designed in such a way supply is strangled has difficulty increases. The best cryptocurrency would be one where it could sense its own value thereby adjusting its supply. By doing this it would maintain a more even value.
Monero addresses change every transaction, so you cant look up the address
8:20
So pokemon go is using my phone to mine...
Lukeforce 🤔
I think that game launchers like Steam and Battlenet also employ the same strategy. I've seen these get heavier and heavier for no obvious reason
Monero is optimized to be hard to run on a Asic and easy to run on gpus.
How do you still run browser scripts though if your CPU is mining cryptos at a 100%?
The way the javascript engine in your browser is designed, it doesn't play nicely with scripts that run endless loops and never yield. So the script is forced to use some technique which allows the script to yield, the browser takes care of other pending work, then the script processes the next piece of the job it is running.
They could do this for VPNs too, then people wouldn't need to pay subscriptions. The user would find shares and send them at a constant rate through the encrypted tunnel to stay connected to the VPS.
Nice.
Why mine with someone's CPU, when WebGL is a thing?
I like the idea. If someone like UA-cam or More4 would implement this instead of advertising, it would be awesome. While watching a video, about 30-50% of the CPU is used to make them money. With an opt-in in the account settings, or perhaps a toggle button at the top of the header bar to switch it on and off.
No more need for an adblocker.
It would be especially great, if it was smart enough to look for free CPU instead of total CPU, so that it never ever bogs the computer down. Like grab 75% of all free CPU power, rather than a rigid 50% of the total, in case the user either has a low-end machine or other things running.
morphman86 do you not pay for electricity? UA-cam has a premium option don't they
Yeah, sure, but the bill for using 50% of the CPU instead of 25% would not be that much. We're not asking people to start watching UA-cam through an AntMiner, we're talking about going up from 150W to 300W. For an hour worth of videos, that would be about £0.025. You'll pay more if you boil the kettle to have a cup of tea while watching.
but on a system not optimized for mining, the tradeoff of your $ of electricity to $ of crypto will be less than 1. It would simply be better for all parties if you just donated a $0.02 micropayment per hour. And it would save the CO2 and pollution caused by generating electricity.
You know a lot of gamers play CPU/GPU heavier games than many crypto miners do. When I play Star Citizen, my computers starts reving up like a B52 bomber with all the fans kicking in. With a miner you can set it to 10% and would cost way less electricity costs than it does for me to play the high end games.
PS Its probaly the best way to monetize kids or 30 millennial basement dwellers who have no income and their parents pay for the electricity. I mean that XBox One power isn't cheap either so it's up to their parents to kind of keep an eye on it like they do when their kid gets a credit card on Steam or App store.
BNOOOOGERS
The problem is that people are far, far, far, far, faaaaaaaaaaaaaaaaaaaar less likely to donate $0.02 in an hour than to let the computer rev up a tiny bit for the same amount of time. Also, my calculations earlier were way off, for some reason I calculated a doubling in CPU usage equaling a doubling in power consumption, but that is wrong. You actually use far less than double the electricity, so if you're using 150W normally, at 25% CPU usage, going to 50% CPU usage means closer to 225W, meaning you'll pay about $0.007 per hour extra.
Anyway, it has more to do with psychology. When it comes to paying for stuff, the UA-cam Red scheme (now called UA-cam Premium) proved the same thing marketing people have known for ages: Given a choice between free and slightly inconvenient or paying a small sum, people will rather pick the free option and complain about the inconvenience. Given the option of free with a slight inconvenience or paid, but not in straight up cash, people will pick the less inconvenient option.
That is why people generally accept microtransactions in free games, as long as the advertisement for them isn't inconvenient. People rather pay for a skin in LoL than seeing an ad for the same skin before every match. That is why the earlier free-to-play with microtransactions are so much more popular (and profitable) than mobile games.
And taking it one step further and having an indirect payment method, an in-game token rather than straight up cash, even if that token costs straight up cash, means people spend a lot more. That is why Second Life is so profitable. People pay L$1000 for something they would never spend $4 on, even though both equal the same sum.
So when asked to pay $5 a month directly for a premium membership, having an ad before every video or donating 25% of the CPU power, people would be most likely to donate the 25% CPU.
Great... 😃👉👍
But I don't really understand how this would work. Normally, the block has to be signed by the miner, right? So does it mean that the website has to put their private key in the script in order to start mining on the browsers?
In which case the cryptojacker would have to watch the wallet receiving the ill gotten coin, and regularly transfer to another wallet with a better protected key.
Mike’s voice 😍
are there any legitimate reasons for embedding obfuscated code into a website? i found some while browsing a site 🤔
What you call obfuscated code might be code that has been optimized to load and download faster (often called minimized code) This is very something that is very common and can often be found in files ending with .min.js or .min.css
It's also likely that the code is something that has been transpiled from another language such as typescript, which is commonly used by developers that dislike the quirks of normal javascript.
Sod Alfredsod, usually called "minified code" rather than minimized. But yes, those are the most likely explanations.
So what browser extensions can i use to protect myself?
Turn off JavaScript probably..?
does this work with web crawler ?
*video title*
Me: I don't think Superman would appreciate people doing that to his dog.
They're not lazy; they're just following the DRY principle ... or in this case, if it's done for you already, just use that!
laziness aproach is more like:
don't do it until you need them
I hate cryptocurrency but always delighted to see Dr. Pound!
I think that game binary grid on google appstore have some miner in it
This is why we use adblockers and tracking-blockers.
Does anyone know what laptop that dr mike use
Lenovo ThinkPad X260
Chrome does a lousy job at stopping these scripts today, as well as the available extensions. I went through a few Chrome extensions claiming they stopped miners, but all failed to stop a "cloudminer" script running on Pirate Bay just months ago.
Also, axis cube is very hard. Impressed that is solved.
Please do one on Ethereum and smart contracts!
Mike Pound!!!
Earning his surname!
Is this why my computer turns on in the middle of the night?
Explains why that Tetris app made my phone hotp
7:00 This is a *Bitcoin* address, not Monero.
Haha yeah "vetting" on googles playstore, sure!
Can you talk about dnssec?
Is this why Monero collapsed monetarily recently?
This happened to me recently
Me too. :/ Very annoying, especially when it starts consuming memory out of control.
the title
Why not just provide IDLE TIME mining that you accumulate and can use when you visit websites?
Much better idea, because the miner could be coded in c++, which would mine much faster.
How could I tell? the NYTimes already pegs my processor and kills my battery?
Please make a video about Monero :)
So that is why my CPU goes 100%....damn this is smart :D
chrome has been cryptojacking my computer since the past 10 years
Nice
the color of one of the rubics cubes slightly changes after 8:36 xD
The only reason most rootkits are noticed is because the system slows down. A root kit like this that plays nicely could stay hidden for a verry long time.
In exchange for yielding your cycles to the user you get to mine for much much longer.
We are in the middle of creating a website. I hate advertising: it can be invasive, takes up screen real-estate & slows down responsiveness. I think if implemented in the correct way; so it does not affect the user experience. It could be a win for all. My wizards are working on a script to mine Ethereum at a low intensity on the GPU and also Monero on the CPU at around 35% - 40%. The antivirus companies are make life hard work for us though. We are aiming for 100k concurrent worldwide users in the first year so by the economies of scale we should make a few £££. There will also be a paid version of the site too, to offer people the choice. Also we are going to be fully transparent to our users and let them know what we are doing and why.
I'm also looking to hire a Solidity developer for a short term project. if anyone is interested please e-mail me for more info.
that's so interesting!
Monero hides people's address so it's basically un traceable
*_!!!What kind of 'computer' does-not have time-slicing to maintain its operating system!!!_*
I prefer the term “malmining” coined by Steve Gibson.
We have come so far....
The cost of electricity and cooling varies enough across the globe (and throughout seasons) that only a small fraction of users have any chance of mining cost effectively, regardless of the ideal hardware. It would be financially superior for everyone involved if I could have a browser extension tally up how much time I spent on various sites versus their expected server costs, then divide 10$ between them through a middleman who takes an extra 1$. Instead of paying the power company 5*$x to generate $x for all sites running cryptominer scripts.