Coinhive is a popular browser-based service that offers website owners to embed a JavaScript to utilise their site visitors' CPUs power to mine the Monero cryptocurrency for monetisation. It was hacked last month.
An unknown hacker managed to hijack Coinhive's CloudFlare account that allowed him/her to modify its DNS servers and replace Coinhive's official JavaScript code embedded into thousands of websites with a malicious version.
Apparently, the hacker reused an old password to access Coinhive's CloudFlare account that was leaked in a Kickstarter data breach in 2014.
According to Cloudflare (who also hosts thousands of hackers, spammers, & scammers), "Tonight, Oct. 23th at around 22:00 GMT our account for our DNS provider (Cloudflare) has been accessed by an attacker. The DNS records for coinhive.com have been manipulated to redirect requests for the coinhive.min.js to a third party server." Coinhive said in a blog post today.
"This third-party server hosted a modified version of the JavaScript file with a hardcoded site key."
As a result, thousands of sites using coinhive script were tricked for at least six hours into loading a modified code that mined Monero cryptocurrency for the hacker rather than the actual site owners.
Coinhive gained media attention in past few weeks after world's popular torrent download website, The Pirate Bay, was caught secretly using this browser-based cryptocurrency miner on its site.
Immediately after that, more than thousands of other websites also started using Coinhive as an alternative monetisation model by utilising their visitors' CPU processing power to mine digital currencies.
Even hackers are also using Coinhive like services to make money from compromised websites by injecting a script secretly.
Mining for virtual currency is being examined as an alternative to third-party ads as a way to generate revenue and it was the Pirate Bay's pilot trial which propelled the idea into the spotlight.
Due to a coding error, users spotted the website's miner as it pulled huge amounts of CPU power from visitor systems, rather than 20 to 30 percent as originally intended.
Following visitor backlash, the Pirate Bay admitted to testing the miner as a "way to get rid of all the ads."
Other parties have begun exploring mining, too. According to a report from Adguard, 2.2 percent of the top 100,000 websites on the Alexa list are now mining through user PCs -- but few are asking for permission first.
============
The use of American companies to push Russian hackers & propaganda goes beyond social media sites like Facebook. Russians also used American internet services to keep their websites up and hide their true owners, according to internet records and two executives at internet routing companies.
The firms routing these websites' internet traffic include Cloudflare, a major Silicon Valley corporation, and a Ukrainian company's subsidiary in Florida.
The websites are part of a network run by the Internet Research Agency, a troll army based in St. Petersburg, Russia, with ties to the Kremlin. The groups, with names like "Don't Shoot Us" and "Black Matters," posed as black American activists. They posted videos showing police brutality against African Americans and attempted to organize protests across the United States. But they need internet infrastructure to keep sites online.
The use of the routing companies shows how Russian trolls & hackers tried to mask their efforts that also used Facebook, Google, Instagram, Twitter, and other popular social media platforms.
Cloudflare provides protection from hackers, placing its computer servers between clients' websites and the outside internet. This allows Cloudflare to absorb cyberattacks, such as Distributed Denial of Service attacks that flood a website and take it down.
But Cloudflare's services can also be used as a mask, because the outside world can no longer identify who operates the website -- or the location of its physical home.
That's because Cloudflare serves as a guard that receives incoming internet traffic. It offers this service to legitimate companies, but in this case, it is also assisting the Russian trolling & hacking operations.
Cloudflare admits its role as a proxy service for trolls & hackers, but it said "terminating a customer wouldn't actually remove their content from the internet." Cutting off that customer would, however, stop them from using that particular American firm as a shield.
Cloudflare said it would not consider dropping these Russia-linked websites & hackers unless compelled to by a court order.
"Cloudflare does not view its role to pass judgment of content that runs on our infrastructure and our network," the company's general counsel, Doug Kramer said. "An open internet and an opportunity for all voices is a good principle. If we try to regulate in any way with our resources and capabilities, we would do more harm than good."
Cloudflare is, however, willing to pass along public complaints to the websites' operators, Kramer said.
============
Betty's has always blocked/firewalled all ISPs used by Cloudflare & it's services. We also do not allow links to sites hosted by Cloudflare because their servers are listed internationally as malicious & dangerous.
Topic: In the News (with pictures & videos) (Read 78293 times)
