About a month ago, PirateBay, the largest torrent site on the Internet, ran a test using the recently released a Monero mining JavaScript called CoinHive “Virus”. Monero is a cryptocurrency similar to the infamous Bitcoins which has recently become more popular due to the introduction of the CoinHive “Virus”. When added to a site or an application, CoinHive “Virus” automatically commands the PC of site’s visitor or the user of the application to mine for Monero which leads to an increased CPU usage. Therefore, during the time the site is opened or the app is being used, the user is likely to experience a performance slow-down on their computer due to the high CPU usage. The idea of adding the CoinHive “Virus” script to PirateBay is that the miner would substitute the ads displayed on the site and would serve as an alternative source of income for PirateBay’s owners. 

The test lasted a couple of days after which the CoinHive “Virus” script was removed from the site’s code. However, as of yesterday, it appears that the Monero mining feature has been once again added to the site but instead of having the ads removed, currently, there are both adverts and a miner script on PirateBay. I you think that your computer may be infected with adware or malware that infects such script to run on your computer you can check out our CoinHive “Virus” removal guide here. 

CoinHive “Virus” isn’t illegal

Even though it might seem quite unpleasant to have your computer forced to mine an online currency for someone else’s profit, it should be mentioned here that the sheer implementation of the CoinHive “Virus” script isn’t considered illegal. As long as the presence of the script on the site or app has been properly disclosed and there is an option to stop it whenever you want, the use of this mining script would be perfectly legitimate. However, unfortunately, most developers who try to implement this Monero miner tend to use it in an illegitimate way which is the reason why most customers see CoinHive “Virus” as an illegal script that is malware-related (which it really isn’t).

There’s no way to disable the script

One of the main issues with the CoinHive “Virus” script being re-added to PirateBay is the fact that there is no opt-out setting through which the user can disable the Monero mining process. Due to the lack of such an option, it is considered possible by some researchers that the miner has been loaded in PirateBay by hackers or malicious ads and not by the site’s owners.

As a matter of fact, the script has recently received a simple UI widget utility through which users would be able to choose when and whether or not to have the mining enabled. The widget is supposed to be offered to customers who visit sites or use apps that have the CoinHive “Virus” script. However, most developers who utilize this Monero miner choose not to do that. This also applies to PirateBay as there’s no widget to be seen anywhere once you go to the site and attempt to use it.

More Monero miners on the horizon

The popularity of CoinHive “Virus” and Monero mining has only been going up for the past month after the script was released. Many developers try to implement it within their products’ code in order to boost their profits. The problem is that, as we already mentioned, in the majority of cases the way the JavaScript gets utilized is illegitimate and with no concern for the regular user whatsoever.

A couple of days ago, one other similar Monero mining script was released under the name of Crypto-Loot further increasing the popularity of those miners. It is expected that more and more sites and web services would try to implement this new way for gaining profit as it seems to be rather effective and easy to implement.

Even though the fact that your PC is being used for cryptocurrency mining isn’t dangerous for the machine, it is definitely rather unpleasant to have your system severely slowed-down for the profit of somebody else. Therefore, here it is important to mention that you can easily block unwanted Monero miners via a number of methods. For instance, you can use an ad-blocker tool as most such utilities have been modified to block CoinHive “Virus”. Also, there are specialized applications such as minerBlock and No Coin that can also disable those JavaScripts. Additionally, a reliable antivirus program can also help you prevent unwanted mining from occurring or at the very least notify you when a website or an application is trying to use your machine’s resources for generating Monero coins.

The post PirateBay once again mining Monero through CoinHive “Virus” appeared first on Malware Complaints.

We have already written a couple of articles concerning a recently developed scheme for mining the Monero Cryptocurrency known as cryptojacking. The concept of this scheme is as follows: a JavaScript code is added to a website, a web service or an app such as a browser extension, which code commands the PC that visits the site or uses the app/web service to use its CPU for Monero mining. Up until no more than a day ago, the only method to implement this scheme was a JavaScript called CoinHive. However, a new service that offers similar functionality has been introduced and its name is Crypto-Loot. Due to its recent release, it hasn’t been as widely implemented and used as CoinHive, yet we believe that Crypt-Loot will likely grow in popularity rather rapidly. One thing to note is that while CoinHive developers keep 30% of the profits made using their script, Crypto-Loot only collects 12% making it seem like an ever more desirable option.

Is cryptojacking illegal

Both CoinHive “Virus” and Crypto-Loot are initially legal methods for gaining revenue in the form of Monero. However, similarly to more conventional methods for making profits online like web advertising, Monero mining through those JavaScript codes comes at a price and that price is paid by the users. When you see ads online they are often annoying and obstructive. With cryptojacking, the issue is that your PC gets forced to use its resources for somebody else’s profit. Surely no one wants to have their machine works slower due to increased CPU usage for the benefit of someone else. However, as we already said, the sheer use of use of CoinHive or Crypto-Loot isn’t illegal. What might be considered as illegal or illegitimate is the way those scripts get used.

How are these JavaScripts getting used?

You see, in order for the use of either one of these two methods to be legitimate, the user needs to be explicitly notified about the Monero mining JavaScript and must also be provided with an option to disable the script so that the mining would stop. Unfortunately, most sites and apps that have been reported to implement this scheme haven’t met those requirements. This leads to a lot of users who have their machines slowed-down without actually knowing why that is happening.

Some prominent examples of use of cryptojacking from the past couple of weeks are when sites like PirateBay and Showtime had the CoinHive JavaScript within their code. Also, a Web Store extension known as SafeBrowse was also reported to use the same script. There are other examples as well and most of them are with CoinHive since it has been around for a longer period of time.

On the other hand, the number of legitimate uses of such scripts is rather small. One such example is a YouTube app for interface management called Iridium, where the user is allowed to switch off the Monero mining. Also, another instance of CoinHive being properly used is in PublicHD, a torrent tracker where the user gains site credits in if they keep the Monero mining enabled.

Ways you can prevent cryptojacking

If you want to prevent sites and apps from exploiting your computer’s processors through cryptojacking, there are coupe of methods that you can try.

• Firstly, you can use an ad-blocker app (for example AdGuard, AdBlock Plus) to prevent website cryptojacking since some such tools offer this form of protection.
• Secondly, there are also specialized Chrome extensions for blocking CoinHive scripts. Those extensions are No Coin, minerBlock and AntiMiner. No Coin has recently added protection against Crypto-Loot as well.
• Thirdly, an antivirus program can also help with blocking unwanted cryptojacking. Just make sure to download a reliable and trustworthy protection software.

So far, it seems that apart from unwanted CPU usage and potential productivity slow-down, there aren’t any other issues that come from cryptojacking. However, due to the overall unpleasant nature of this practice, most users see this scheme as illegitimate.

The post Crypto-Loot – a new cryptojacking service appeared first on Malware Complaints.