Visible to the public A First Look at Browser-Based Cryptojacking

TitleA First Look at Browser-Based Cryptojacking
Publication TypeConference Paper
Year of Publication2018
AuthorsEskandari, S., Leoutsarakos, A., Mursch, T., Clark, J.
Conference Name2018 IEEE European Symposium on Security and Privacy Workshops (EuroS PW)
Date PublishedApril 2018
ISBN Number978-1-5386-5445-3
Keywordsadvertisement revenue, bitcoin, blockchain, Botnet, browser mining, browser-based mining, Browsers, Central Processing Unit, Coinhive, cryptocurrency, cryptocurrency Monero, cryptography, cryptojacking, data mining, data privacy, electronic money, Ethics, financial data processing, Google, Human Behavior, Internet, Java, JavaScript code, marketing data processing, Metrics, mining, Monero, online front-ends, pubcrawl, resilience, Resiliency, source code (software), Web sites, website

In this paper, we examine the recent trend to- wards in-browser mining of cryptocurrencies; in particular, the mining of Monero through Coinhive and similar code- bases. In this model, a user visiting a website will download a JavaScript code that executes client-side in her browser, mines a cryptocurrency - typically without her consent or knowledge - and pays out the seigniorage to the website. Websites may consciously employ this as an alternative or to supplement advertisement revenue, may offer premium content in exchange for mining, or may be unwittingly serving the code as a result of a breach (in which case the seigniorage is collected by the attacker). The cryptocurrency Monero is preferred seemingly for its unfriendliness to large-scale ASIC mining that would drive browser-based efforts out of the market, as well as for its purported privacy features. In this paper, we survey this landscape, conduct some measurements to establish its prevalence and profitability, outline an ethical framework for considering whether it should be classified as an attack or business opportunity, and make suggestions for the detection, mitigation and/or prevention of browser-based mining for non- consenting users.

Citation Keyeskandari_first_2018