6 ms·

Opera blog post: https://blogs.opera.com/desktop/2017/12/opera-50-beta-rc-cryptocurrency-mining-protection/ https://blogs.opera.com/desktop/2017/12/opera-50-bet

by B-Con 9y ago

Opera blog post: https://blogs.opera.com/desktop/2017/12/opera-50-beta-rc-cryptocurrency-mining-protection/ https://blogs.opera.com/desktop/2017/12/opera-50-beta-rc-cry... > After we recently updated the rules for our built-in ad blocker mechanism, we eliminated cryptocurrency mining scripts that overuse your device’s computing ability. Simply enable Opera’s ad blocker to prevent cryptocurrency mining sites from doing their dirty work on your computer. Looks like a blacklist extension to their ad blocker.

kodablah 9y ago
This isn't going to work I suspect. Ad blockers work because ad companies are too lazy to make appliances/software to embed their ad packages as first party entities. This is exacerbated by the need for third party cookie access. Utilizing client CPU for mining doesn't need that. They can simply embed the JS script (which presumably would have the WASM binary embedded) and go. At least that's how I would do it if I were nefarious. And I'd add significant randomness to prevent pattern matching, but ad blockers are stupid primitive css selector or URL matchers anyways.
- ape4 9y ago
  Mining requires lots of Math.something() functions. Maybe they can set a max for that.
  - tobyhinloopen 9y ago
    You can use other implementations that not require Math.
    - ape4 9y ago
      Just curious... like what?
- Momquist 9y ago
  I feel whitelisting JS is becoming the sanest approach, despite all its shortcomings.
  - shostack 9y ago
    Is there anything comparable to NoScript that works in Firefox Quantum?
    - Momquist 9y ago
      uMatrix, although it doesn't have the various anti-XSS protections of NoScript. But its UI is great, much better than NS IMHO, and it's not limited to script blocking. https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix
      - gorhill 9y ago
        The dev build support specifically blocking web workers, typically used by cryptominers. So at this point I think it will be a good idea to block web workers by default everywhere, and enable only if a trusted site needs them.
    - KwanEsq 9y ago
      NoScript[1] works pretty well. [1] https://addons.mozilla.org/firefox/addon/noscript/ https://addons.mozilla.org/firefox/addon/noscript/
      - shostack 9y ago
        Huh...for some reason I thought it was not compatible. Ugh, now the only thing holding me back from upgrading is some of my other addons. I hate having to wait forever to upgrade because I use some less popular addons with long update cycles.
        CannisterFlux 9y ago
        I ditched a load of addons for Firefox 57. Just embrace the change, find replacements, or move on and stop using them. It's hard, but I found I adapted quite quickly. For NoScript, even though it is now available, I switched to ublock in medium-mode since NS was delayed until a couple of weeks after 57 hit. Both ublock and NS now use the same Content-Security-Policy filtering approach (NoScript switched to CSP for the webextension release, ublock did it this way before) and so both now suffer from this bug that means noscript tags are not rendered/parsed at all https://github.com/gorhill/uBlock/issues/308 https://github.com/gorhill/uBlock/issues/308 - so I felt I may as well just use ublock. Full-on global-disallow NoScript with that bug makes many sites completely unusable since their graceful-degraded noscript blocks are not shown, and UI changes in the webextension release made it too fiddly to use IMO.
- fpoling 9y ago
  Well, typically a page does not run heavy calculations for minutes without any input/output. The ad blocker can use that.
  - kodablah 9y ago
    I won't run a closed source ad blocker. Whatever my hypothetical nefarious self sees is the limit which triggers heavy-calc check, I'll just split my insns across requestAnimationFrame/setTimeout just beneath it. The cat-and-mouse game of ad blockers really should be no problem for the adversary (the ad companies) if they just put some thought and engineering into it.
clouddrover 9y ago
> Looks like a blacklist extension to their ad blocker In the blog post comments section they say they're using this block list: https://github.com/hoshsadiq/adblock-nocoin-list https://github.com/hoshsadiq/adblock-nocoin-list The list is compatible with other blockers like uBlock Origin and Adblock Plus so you can add it to your blocker if you want to. By default uBlock Origin already includes a Resource Abuse block list which has many of the same entries as this list. I'm not sure how much the two lists overlap, but if uBlock Origin's Resource Abuse list already has all of the entries from this list then obviously there's no gain in adding it.
- shostack 9y ago
  Is cryptojacking really this common these days? Is there an easy way outside of using these lists to detect if a site is attempting this?
  - SalimoS 9y ago
    http://whoismining.com http://whoismining.com

by B-Con 9y ago

kodablah 9y ago

This isn't going to work I suspect. Ad blockers work because ad companies are too lazy to make appliances/software to embed their ad packages as first party entities. This is exacerbated by the need for third party cookie access. Utilizing client CPU for mining doesn't need that. They can simply embed the JS script (which presumably would have the WASM binary embedded) and go. At least that's how I would do it if I were nefarious. And I'd add significant randomness to prevent pattern matching, but ad blockers are stupid primitive css selector or URL matchers anyways.

ape4 9y ago
Mining requires lots of Math.something() functions. Maybe they can set a max for that.
- tobyhinloopen 9y ago
  You can use other implementations that not require Math.
  - ape4 9y ago
    Just curious... like what?
Momquist 9y ago
I feel whitelisting JS is becoming the sanest approach, despite all its shortcomings.
- shostack 9y ago
  Is there anything comparable to NoScript that works in Firefox Quantum?
  - Momquist 9y ago
    uMatrix, although it doesn't have the various anti-XSS protections of NoScript. But its UI is great, much better than NS IMHO, and it's not limited to script blocking. https://github.com/gorhill/uMatrix https://github.com/gorhill/uMatrix
    - gorhill 9y ago
      The dev build support specifically blocking web workers, typically used by cryptominers. So at this point I think it will be a good idea to block web workers by default everywhere, and enable only if a trusted site needs them.
  - KwanEsq 9y ago
    NoScript[1] works pretty well. [1] https://addons.mozilla.org/firefox/addon/noscript/ https://addons.mozilla.org/firefox/addon/noscript/
    - shostack 9y ago
      Huh...for some reason I thought it was not compatible. Ugh, now the only thing holding me back from upgrading is some of my other addons. I hate having to wait forever to upgrade because I use some less popular addons with long update cycles.
      - CannisterFlux 9y ago
        I ditched a load of addons for Firefox 57. Just embrace the change, find replacements, or move on and stop using them. It's hard, but I found I adapted quite quickly. For NoScript, even though it is now available, I switched to ublock in medium-mode since NS was delayed until a couple of weeks after 57 hit. Both ublock and NS now use the same Content-Security-Policy filtering approach (NoScript switched to CSP for the webextension release, ublock did it this way before) and so both now suffer from this bug that means noscript tags are not rendered/parsed at all https://github.com/gorhill/uBlock/issues/308 https://github.com/gorhill/uBlock/issues/308 - so I felt I may as well just use ublock. Full-on global-disallow NoScript with that bug makes many sites completely unusable since their graceful-degraded noscript blocks are not shown, and UI changes in the webextension release made it too fiddly to use IMO.
fpoling 9y ago
Well, typically a page does not run heavy calculations for minutes without any input/output. The ad blocker can use that.
- kodablah 9y ago
  I won't run a closed source ad blocker. Whatever my hypothetical nefarious self sees is the limit which triggers heavy-calc check, I'll just split my insns across requestAnimationFrame/setTimeout just beneath it. The cat-and-mouse game of ad blockers really should be no problem for the adversary (the ad companies) if they just put some thought and engineering into it.

clouddrover 9y ago

> Looks like a blacklist extension to their ad blocker In the blog post comments section they say they're using this block list: https://github.com/hoshsadiq/adblock-nocoin-list https://github.com/hoshsadiq/adblock-nocoin-list The list is compatible with other blockers like uBlock Origin and Adblock Plus so you can add it to your blocker if you want to. By default uBlock Origin already includes a Resource Abuse block list which has many of the same entries as this list. I'm not sure how much the two lists overlap, but if uBlock Origin's Resource Abuse list already has all of the entries from this list then obviously there's no gain in adding it.

shostack 9y ago
Is cryptojacking really this common these days? Is there an easy way outside of using these lists to detect if a site is attempting this?
- SalimoS 9y ago
  http://whoismining.com http://whoismining.com