Starbucks’ Wi-Fi Found Using People’s Laptops to Mine Monero

[+] shak77|8 years ago|reply

https://news.ycombinator.com/item?id=15897811

https://news.ycombinator.com/item?id=15931231

[+] fhoffa|8 years ago|reply

There are thousands of websites mining cryptocoins. I recently posted a tweet that went viral in Brazil - it showed that one of their government sites was mining coins - and draining 360% of my notebook's CPU power:

- https://twitter.com/felipehoffa/status/928681468024500224, https://twitter.com/felipehoffa/status/928705663060074496

Since that day, CoinHive has been removed from a lot of sites:

"In the 10/15 run, there were 1,040 mobile sites with the CoinHive Javascript embedded. In the 11/15 HTTPArchive run, this has dropped to 759 - a drop of 27%!" -- Rick Viscomi

- https://discuss.httparchive.org/t/the-performance-impact-of-...

To find all of these sites you can dig into HTTPArchive with BigQuery:

  #standardSQL
  SELECT
      page,
      req.url,
      REGEXP_EXTRACT(LOWER(req.url), r'(cnhv.co|coin-hive.com|coinhive.com|gus.host|load.jsecoin.com|miner.pr0gramm.com|minemytraffic.com|ppoi.org|projectpoi.com|azvjudwr.info|jroqvbvw.info|jyhfuqoh.info|kdowqlpt.info|xbasfbno.info|crypto-loot.com|coinerra.com|coin-have.com|minero.pw|minero-proxy-01.now.sh|minero-proxy-02.now.sh|minero-proxy-03.now.sh|api.inwemo.com|jsecoin.com)') library
    FROM
      `httparchive.har.2017_10_15_chrome_requests` AS req
    JOIN
      `httparchive.runs.2017_10_15_pages` AS pages
    ON
      req.page = pages.url
    WHERE
      REGEXP_CONTAINS(req.url, '(cnhv.co|coin-hive.com|coinhive.com|gus.host|load.jsecoin.com|miner.pr0gramm.com|minemytraffic.com|ppoi.org|projectpoi.com|azvjudwr.info|jroqvbvw.info|jyhfuqoh.info|kdowqlpt.info|xbasfbno.info|crypto-loot.com|coinerra.com|coin-have.com|minero.pw|minero-proxy-01.now.sh|minero-proxy-02.now.sh|minero-proxy-03.now.sh|api.inwemo.com|jsecoin.com)') 
    GROUP BY 1,2,3

[+] fro0116|8 years ago|reply

Has anyone made a blocklist for sites with these scripts yet?

[+] wildrhythms|8 years ago|reply

More specifically, the mining was happening for 10s on an insecure captive portal: https://twitter.com/imnoah/status/936948776119537665/photo/1

[+] petecox|8 years ago|reply

> the internet service’s Terms of Service (TOS) didn’t mention the Monero mining code.

There's a business opportunity - free coffee if you agree to mine crypto on our behalf.

Did Starbucks Bs As. refund their customers?

[+] ascom|8 years ago|reply

It might take days or weeks using an average laptop to mine the equivalent of a cup of coffee.

11 comments