11 ms·
Ad campaign runs cryptocurrency miners while unwitting users watch videos
- craftyguy 9y agowhat are the favorite alternatives to youtube?
- Larrikin 9y agoYouTube with AdNauseum installed
- specializeded 9y agoBest bet, aren’t any real alternatives to YouTube yet outside some smaller niches.
- emh68 9y agoYouTube Red?
- mort96 9y agoHahaha you must be from one of the 2 countries with YouTube red. (I know it's probably not literally 2 countries, but it's available in very few countries.)
- LeoPanthera 9y agoUnited States, Mexico, Australia, New Zealand, South Korea. (If anyone actually wants to know.)
- emh68 9y agoWow, that's it? Googling around a bit, it seems that Google's attempt to include everything under the sun into your YouTube Red subscription is to blame... They could just give you ad-free youtube. But instead, they want YTR to include their YTR-only premium content, and also they want to throw in Google Music... all of that requires decyphering copyright laws and potentially registering as a royalties collector (IANAL). Typical Google behavior, an inflexible all-or-nothing approach.
- rhizome 9y agoDoes YTR allow me to turn off annotations permanently?
- noir_lord 9y agoI loathe those as well.
- fossuser 9y agoI think you can actually do this without having a YouTube Red account - it's under youtube settings and then under playback (there's a checkbox for annotations). I'm using the Red free trial (it's 3 months) and it's actually pretty nice to have more control over the experience and not have to deal with ads. I found the ublock origin wasn't perfectly effective on YouTube anyway. If only FB offered a $10 a month no ad subscription it'd be a lot nicer to use too.
- rhizome 9y agoYes, there's a UI control for it, but Google regularly resets it. It's basically as effective as setting your Facebook timeline to "Recent first."
- craftyguy 9y agoHa. No. I'd rather not encourage Google/Youtube.
- deleted 9y ago[deleted]
- mtgx 9y agoThe decentralized d.tube
- oldcynic 9y agohooktube.com for the added bonus of avoiding the Google tracking on YT
- deleted 9y ago[deleted]
- quasse 9y agoI had no idea that Google Adwords allowed advertisers to run arbitrary Javascript in user's browsers because that just seems so monumentally stupid. Is that their general policy or was this some kind of script injection input cleansing fuckup on their part?
- deleted 9y ago[deleted]
- klodolph 9y agoFor ads it makes a certain amount of sense... you can put animations in the ads that are driven by JS, or make the ads interactive. Calling this "script injection" is perhaps misleading, because the JS wouldn't be running in the security context of the page it's in.
- jMyles 9y ago> Calling this "script injection" is perhaps misleading, because the JS wouldn't be running in the security context of the page it's in. I'm probably missing something obvious here, but: how doesn't it run in the security context of the page?
- chii 9y agopresumably ads are served inside an iframe that's different from the website it's displayed on.
- tripzilch 9y ago> For ads it makes a certain amount of sense... you can put animations in the ads that are driven by JS, or make the ads interactive. Does nobody remember that Google Ads actually got popular first because they didn't allow for this kind of crap?
- lithos 9y agoIn time all companies listen to their customers.
- debt 9y agoThe hilarious thing about this is that so what why not? Can't I opt to let another co-opt my cpu while I watch videos so that I don't have to watch ads? I'd much prefer people using my cpu to mine bitcoin than to render some shitty ad. This is actually a fascinating development in this space.
- ben_jones 9y agoDo we trust the competency of ad providers to normalize for low powered devices? If I read an article on some small news outlet or indie blog using my phone, will my hand get burned off?
- devereaux 9y agoI trust their financial interest. A cellphone will not mine enough to be profitable, so they will serve a regular ad instead.
- adrianN 9y agoA normal CPU probably won't mine enough to be profitable either, but since the users pays for electricity, not the advertiser, I don't see the incentive.
- devereaux 9y agoDust (UXTO with small amounts) would make them incur greater transaction fees when trying to access their account. BTW, it is interesting my comments offering an explanation are being downvoted. I guess cryptocurrency discussions are driven by passion, not by logic.
- stordoff 9y agoWouldn't they just mine to a pool (private pool if enough clients)? I'm not sure why an inefficient client would lead to additional fees.
- 9y ago
- MattGrommes 9y agoOh, I wonder why oh why do people use ad blockers?
- bkohlmann 9y agoWhat strikes me about this is actually tangential to the specific issue the article addresses. New technologies push the bounds of opportunity and risk. Folks trying to take advantage of the upside will exploit anything to achieve their goals. In the process, natural systems will emerge to combat them and close the exploits. This amoral process actually leads to emergent, unanticipated outcomes. You actually NEED the chaos upfront for society to eventually discover a stable equilibrium. All the negative externalities from BitCoin / blockchain are really just a naturally occurring shake out of kinks. Much like the wild experiments and exploits of the 90s eventually led to the equilibrium we have for the current Web.
- ABCLAW 9y agoSomewhere, someone said to their business partners "Why, what if we decided to chew through the useful economic life of someone else's assets without telling them?" and the people in the room said "Sure, lets go get it done".
- kej 9y agoNow I'm curious if it was a company decision or just a lone developer who realized he could toss that in and nobody would catch it.
- deleted 9y ago[deleted]
- zeta0134 9y agoI was never at risk for this kind of attack due to my ad blocker, but I can't help but wonder why the ad was allowed to run in the first place. Surely Google of all people have the resources to do analysis of javascript code that is submitted by an advertiser, and not push it out to the platform if this kind of stuff is detected. This isn't even that hard to automate: does the ad use excessive amounts of CPU while loaded? Reject it! Of course if the advertiser is allowed to load their own unverified third-party javascript from anywhere, these kinds of things can and will continue to happen. That's why I don't run third party embeds in my browser, and I don't think anyone should. (An unpopular opinion, I know.)
- thenewwazoo 9y agoif (running_in_youtube()) { mine_coin(); } else { return; }
- jMyles 9y agoSurely Google operates a sandbox sufficiently similar to the ad environment to foil such a scheme, no?
- UncleMeat 9y agoCloaking is a hard problem. People have a massive monetary incentive to improve cloaking tools, meaning that basically every technique you can think of to detect malicious behavior dynamically has a finite timeframe to where it is no longer useful. Ad networks almost certainly have a system to detect cloaking. It is almost certainly not detecting all malicious scripts.
- bootlooped 9y agoThat must be the ad code that Volkswagen came up with.
- quanticle 9y agoThis is why I run an adblocker, even for so-called "trustworthy" sites. When even top-tier networks like Doubleclick aren't doing the necessary due diligence to prevent malicious ads, what can I do as a user but block all ads, even while knowing this hurts the content creators who use those ads for revenue?
- kelnos 9y agoCame here to say the exact same thing. I'm sympathetic to the difficulties of funding a site that doesn't have a subscription option, but no way in hell am I trusting any ad network to keep malicious junk out of my browser. I may nominally trust the people who run the site, but the ad networks... never.
- jasonkostempski 9y agoIt's never been your responsibility to run that code. If it had never been allowed, ad-tech would have found another way. They built an industry on a horrible assumption and now it's their job to fix it. Everyone can still fall back to affiliate links if they want, but I doubt most will any time soon.
- Globz 9y agoThis! It their job to fix this mess, the burden of finding a better alternative doesn't lie with us. I have no once of guilt related to blocking ads, if you can't pay the upkeep of your website and you haven't found any meaningful way for user contributions then that's on you and if you still serve ads because that's the only sane solution for your monetary problem then you should expect some users to block those ads and conclude that both parties did what they thought was best given this horrible situation. Affiliate links are great and more people should really consider going back to this model.
- chii 9y agolet me play the devil's advocate and argue that ad supported content is responsible for somee of the biggest chunk of the internet, and if it hadn't been for such business model, the internet would not have been as amazing as it is today. sites like 9gag, 4chan or Reddit, or other such sites is where net culture breed. these sites are not going to have the same feel if it had been subscription supported, as large swarves of users who have no money to contribute, but have content and creativity would've been locked out.
- pmoriarty 9y agoI really hope this leads to the death of javascript in the browser, or at least in ads.
- floren 9y agoI seem to remember way back in the day that you could advertise with Slashdot (and others, I'm sure) by giving them an image (static or animated GIF) of specific dimensions, the URL that image should lead to, and obviously some cash. That was pretty great because they kept it reasonably unobtrusive and there wasn't any javascript. I'd rather see Javascript dead, though :)
- rhizome 9y agoI seem to remember way back in the day that you could advertise with Slashdot (and others, I'm sure) by giving them an image (static or animated GIF) of specific dimensions, the URL that image should lead to, and obviously some cash Right, direct advertising. IIRC, anybody who seriously suggests it is routinely shouted down as impractical.
- tdb7893 9y agoIf you hosted static ads like it sounds like they did wouldn't it then end up costing more work for less money? If you have someone else host the static ads it'll be the same amount of work but you'll get less money. The issue is that most people don't want to get less money
- shostack 9y agoThe reality is it just doesn't scale the same way, and often can have worse performance.
- always_good 9y agoWell, the first problem is that only a relative few sites are big enough to do direct advertising. The harder question is how to keep web content decentralized by decentralizing means to revenue, a battle we are aggressively losing.
- HenryBemis 9y agoAnd talking about filthy ads, the one served by Arstechnica [1] tells me "Warning - Your computer is infected.. blah blah blah.. Download Free Antivirus..blah blah..". And it's not even a 3rd party one. [1]: https://cdn.arstechnica.net/wp-content/uploads/2018/01/ad.jpg https://cdn.arstechnica.net/wp-content/uploads/2018/01/ad.jp...
- sciurus 9y agoThat is a screenshot of the ad the attackers were serving on Youtube. It's a part of the article, as the surrounding text makes clear. Screenshot of the image in the article's context: https://imgur.com/a/rm9tR https://imgur.com/a/rm9tR
- haldean 9y agoThat's an image of the malicious ad from YouTube that the article is about...
- HenryBemis 9y agoYou are both very correct. I browsed through the article really fast and skipped many lines. The light-grey in my comment is well deserved!
- deleted 9y ago[deleted]
- digitalsin 9y agoThis is one big reason I love Brave as a web browser. You don't deal with this crap.
- angryasian 9y agoWell brave does intend on displaying ads at some point. Without knowing their exact implementation as to what ads will be displayed it might be possible eventually.
- digitalsin 9y agoTrue, but they're off by default
- LeoPanthera 9y agoAre they still replacing ads with their own ads?
- zython 9y agoThere is no reason why ads aren't just plain text, video or animated vector graphics. There is literally no reason to allow them more (read; execute javascript). If anyone comes up with a valid reason I will invest all my life savings into garlicoin.
- olleromam91 9y agoDid you hover your mouse over the ad? Did you click? How many times have you viewed it? That's all useful information to the advertiser.
- mkl 9y agoThat's stuff the ad network should provide. 4th party advertisers shouldn't be able to run code.
- CaptSpify 9y agoUseful to the advertiser != a valid reason A camera in my office watching me all day would be useful to the advertiser. That doesn't make it a valid reason to put one there
- nugi 9y agoThe advertisers wants do not supercede my right to privacy.
- f1notformula1 9y agoI don't understand enough about the ad business to answer this myself. If there's a legitimate reason to allow 3p scripts to run code - it would seem like creating a domain specific language that Google safely translates into JS would be so much better. Allowing 3Ps to run arbitrary JS just seems so shockingly wrong. No amount of manual auditing can catch malicious code. It's way too complex for a human to parse. Is there a legitimate business need that anyone's aware of to have code run in Ads? If so, why not use a DSL?
- nopriorarrests 9y agoI don't know anything about JS-based cryptomining, but I wonder if you can't stop such ads without breaking 90% of legit ads. I mean, it's all probably boils down to number-crunching? So DSL you are envisioning should block really basic language parts, like cycles and math operations. If I'm wrong and mining actually could be easily blocked on language level using some DSL, I'm all ears.
- singingboyo 9y agoEvidently blocking math is probably not okay. However, mining is useless without a way to send it back out to the network. I doubt ads need networking capabilities - so just prevent that bit. That should do it, as far as I can tell.
- nopriorarrests 9y agoI know a bit about modern ad-tech. Ads absolutely need networking capabilities, for tracking stuff like "viewability", or "anti-fraud, brand safety and independent measurement" by some third-party provider. In fact, you can't get serious marketing budget from reputable brand without having your, err... their ad wrapped inside some JS which does networking calls. Brands want to audit each impression you, as ad-tech firm, will serve on their behalf.
- e1ven 9y ago
- seangrant 9y agoWait, what?? I can inject my own Javascript into Google ads? How is this done?
- hbosch 9y agoCouple million bucks in ad spend, and I bet you can get in almost anything you want.
- Macha 9y agohttps://www.iab.net/vpaid https://www.iab.net/vpaid Similar things exist for older ad types, they're just less standardised.
- Macha 9y agoSince I just grabbed the first link from DDG, and failed to check if it was working, here's a corrected link: https://www.iab.com/guidelines/digital-video-player-ad-interface-definition-vpaid-2-0/ https://www.iab.com/guidelines/digital-video-player-ad-inter...
- coolio2657 9y ago>Both scripts are programmed to consume 80 percent of a visitor's CPU, leaving just barely enough resources for it to function. How on Earth do ads not undergo the most basic "does it eat up 80 PERCENT OF A USER'S CPU" tests before they're allowed on one's network? There is no amazing hacking going on here besides a lack of security control, but there is a substantially larger story hiding here somewhere.
- Analemma_ 9y agoBecause then the ads would just do what viruses do and check if they’re in a prerelease testing environment before doing the evil thing. There’s no way to stop this completely without human examination of the ads, and at the kind of scale that Google and the other ad networks operate at, manual human examination of everything is not possible.
- 0x0 9y agoAt the very least I'm sure the script checks a few simple conditions before unleashing the miner, such as current date, ip, language prefs, possibly a "go/no-go" boolean hosted on some random webserver, to evade any pre-screening before being accepted into the ad rotation.
- monocasa 9y agoI've heard of something similar whee drivers (partiularly graphics) trying to get WHQL cert will check for a special registry entry, and only if its present will do the ridiculous unsafe things like directly patching the IDT to get the performance they want, but will play nice otherwise so they pass cert.
- bitwize 9y agoThe ad authors will just Volkswagen that shit and code their JS to pass Google's acceptance tests when it's being tested, and do whatever otherwise.
- richdougherty 9y agoThe ads are in iframes with sandbox="allow-scripts". (Seen in https://i2.wp.com/diegobetto.com/site/wp-content/uploads/2018/01/2018-01-25-16_14_23-First-Look_-RC522-RFID-Reader_Writer-4-on-eBay-YouTube.png?w=1618&ssl=1 https://i2.wp.com/diegobetto.com/site/wp-content/uploads/201...) I hereby request more sandbox options so we can limit untrusted code properly: <iframe ... sandbox="allow-scripts limit-cpu=10 limit-gpu=1 limit-bandwidth=5 limit-animation=10"> https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox https://developer.mozilla.org/en-US/docs/Web/HTML/Element/if...
- tomc1985 9y agoHow about get rid of allow-scripts. Kinda like what they did with window.onbeforeunload
- pixelperfect 9y agoFunny idea: a long form journalism site could intentionally and openly embed such a script, allowing readers to make "micropayments" of lent CPU time to the site while they read articles.
- olleromam91 9y agoI'm on board. As long as the CPU time is standardized and data usage is shared.
- infinitybeyond 9y agoHere's one doing exactly that: http://www.creativeapplications.net/mining-for-xmr/ http://www.creativeapplications.net/mining-for-xmr/
- beautifulfreak 9y agoThey use Coinhive, but using it this way seems reasonable. Their strategy is to be open about it, to let users know their CPUs are being used to mine, with care not to drain mobile user's batteries. They only use it on long articles. I'd much rather encounter this than ads. It's much more convenient than a micropayment service, and doesn't preempt additional subscription income. I expect to see bespoke variations that don't trigger antivirus software. As long as mobile users' batteries aren't drained, and users' CPUs aren't overly stressed, it seems an ideal solution to monetize websites.
- mkl 9y agoMy battery life is limited and precious. Any site that uses more than the bare minimum of CPU is malicious. How would such a site make its battery-draining nature clear? And why would it do so, given how many people would leave immediately?
- jzwinck 9y agoThree problems: 1. It would not make sense to run on mobile. 2. Mining this way is inefficient, so if the site gets one penny worth of work done, it costs me five pennies. 3. Unless readers have decent GPUs, it's probably not enough money.
- rhizome 9y agoI'd love it if there was a way to monkeypatch JS functions in the browser (like we do for styling in userChrome.css) so that ones that BTC relies on become no-ops.
- Animats 9y agoWith WebAssembly, such things will be even harder to find!
- anfilt 9y agoJavascript was the bigest mistake to add to the web standards. However, the web standards themselves are unnecessarily complex. W3C and WHATWG are partly to blame. Remember HTML was supposed to be a document that the user could change the styling of similar to how some gopher clients would let user change the look of how you viewed all content. However, that is kinda ancient history these days. However, the web standards need to make a new format that breaks backwards compatibility. An app based format, and a document only format. Sadly, I don't see this happening. --EDIT-- Also a lot of web designed don't care if their site does not work if JS disabled... If I were to rework the standards. I would make any syntax for standard defined languages quite strict. Further, for document based content make sure content is always readable with out freaking stupid dynamic eye candy.
- talmand 9y agoAs per my usual, let's not blame the tool for the bad use of said tool.
- sammoorhouse 9y ago> https://en.wikipedia.org/wiki/Minitel https://en.wikipedia.org/wiki/Minitel Off you pop!
- cup-of-tea 9y agoRemember when Google ads were considered not too bad? Just boxes of text when everything else was flashing and making noises. That was a big part of Google becoming popular and now it's gone.
- api 9y agoAdvertising is always a race to the bottom.
- caresource_ta 9y agoThis tittle is misleading, maybe something like "Attackers abuse ad platform to serve cryptocurreny mining ads on YouTube".
- nugi 9y agoThe title seems factual to me.
- caresource_ta 9y agoThe original title was something to the effect of "YouTube now using CPU draining cryptocurrency miner in ads."
- yorby 9y agoDoes Chrome's ad blocker block those? I wouldn't know because I don't trust Chrome.
- danjoc 9y agoThis, shortly after youtube went all JS. With JS disabled, it's just a blank page now. I'm glad I disable JS. Saves me a ton of data bandwidth and protects me from advertisers. There's just not a lot of upside to my using JS anymore these days. Some big sites might not work, but that turns out to my benefit. These antics put the whole JS ecosystem at risk. Remember how normies figured out cookies were bad and turned them off? Even Tony Soprano was talking about turning off cookies. This can be much worse. Might actually kill the web and push everyone off to native apps for good.
- nugi 9y agoJS dying would be a boon to the open internet imho.
- DandyDev 9y agoGoogle can build software that can autonomously learn how to beat humans at the hardest games in existence (or buy a company that builds said software), but it cannot detect malicious code in ads before serving those ads... I call bullshit
- slrz 9y agoHow would you go about deciding reliably whether a given Javascript program would perform a malicious computation on certain inputs? As the concept of malice seems somewhat hard to pin down, let's simplify the problem a bit: it's enough to decide whether that JS code stops at all or if it would just run forever. How to get that ad smasher written?
- nugi 9y agoWhy would you put all that power towards denying business? All money is good, figure out the ethics afterward seems to be their MO.
- tbyehl 9y agoWhat is the anti-ad-blocking crusaders' response to Google's inability to keep their content sites free of malicious advertisements? If I can't trust that YouTube won't serve malicious ads to my PC, who the hell could I trust?
- fauigerzigerk 9y agoThe problem with crusaders on either side is that they conveniently ignore or deny the trade-offs. Advertising based business models come with certain dangers and annoyances. Paying for content and services directly also comes with dangers and annoyances. The reason why I don't use ad-blockers (yet) is that I fear complete loss of anonymity and even greater censorship powers for governments if everything becomes a pay service. Payments are the most tightly regulated and monitored thing on the planet. At the same time you're exposed to credit card fraud and identity theft.
- lousken 9y agoanother reason to use youtube-dl
- Scoundreller 9y agoAdsense has a new feature where publishers can turn off low-value ads, and it estimates how much ad revenue you'll keep. (For web publishers, no idea about video pubs) In my case, I can turn off 33% of all ads and still earn 99% of revenue. Turning off 50% will earn me 95% of ad revenues. Turning off 90% of ads will earn me 67% of ad revenues. The pareto principle is strong.
- SubiculumCode 9y agoI'm sure someone is already developing it if it's a good idea, but it seems that instead of ad revenue, internet content could be paid for by cryptomining while consuming their content.
- SubiculumCode 9y agoThe advantage of a cryptomining internet economy instead of an adtracking internet is the privacy benefit.
- rapnie 9y agocould this kind of thing also be on m.huffpost.com? when reading articles there my android cpu goes all-in, phone getting hot.. avoiding the site now :)
- tripzilch 9y agoWhy the hell are YouTube ads allowed to run 3rd party javascript, and since when?? That's the biggest question not answered by Google. Why wasn't there a big outcry when this became possible? They can do all sorts of shit, not just mine crypto. This used to be the single biggest thing not to do. The possibility of running 3rd party Javascript in Google's ad networks used to be one of the biggest nightmare scenarios if it got exploited, but the article (or the Google rep) doesn't mention anything about an exploit, it's as if 3rd party javascript running on their ad network is expected behaviour, just the fact that it's running a crypto miner isn't?! There's no way in hell I am ever going to not block Google's ads after this. "Youtubers" and "Content Creators" can cry all they want over whitelisting their channel or site in particular because of all the hard work etc, but not if they want me to run a hostile ad network's code.
- deleted 9y ago[deleted]
- stinky613 9y agoGoogle has served malicious ads at least as far back as last spring: https://www.reddit.com/r/sysadmin/comments/6rm5ig/alert_fullscreen_scam_sites_have_started/ https://www.reddit.com/r/sysadmin/comments/6rm5ig/alert_full... https://news.ycombinator.com/item?id=14140756 https://news.ycombinator.com/item?id=14140756
- tripzilch 9y agoCool, thanks :) But I'm actually even more interested since when Google started allowing 3rd party javascript, because the moment when it first got exploited maliciously was just a matter of time. I mean I seriously want to read Google's announcement of this "feature", because I'm honestly scratching my head "wtf were they thinking??". Just so I got this right: You can buy a particular type of ads on Google's ad-platform, that will appear on sites and things depending on your target criteria. AFAIK you used to be able control these aspects of the ad: The text shown if it's a text ad, a picture if it's a banner ad, where the ad should link to, and probably a few cosmetic details. Any tracking cookies and analysis would be done either by generic Google Ads javascript (the results of which you can query in your Ads dashboard/control panel) and by whatever additional tracking javascript you set up yourself on the destination site the ad links to. But apparently, at some point, advertisers got the ability to run their own (3rd party) javascript that will get executed on any site that displays your ad. I'm assuming they use a clever subdomain/iframe trick so that the security context of the JS is just that one domain and doesn't UXSS the world. And sure let's assume this is perfectly watertight. If it wasn't we would be talking about worse stuff than crypto-miners. Then still this script is apparently not prohibited from doing whatever calculations (for mining or whatever), accessing whichever browser fingerprinting variables, mouse tracking and whatnot, you can load and execute remote scripts based on this fingerprinting and easily sidestep any of Google's scrutiny whether your script is up to no good. Not that they do this "because it doesn't scale", but it would be useless any way. And then, this script is able to ex-filtrate all this tracking or mining data. I'm aware that disallowing these abilities strictly and securely is just not really possible in JS, there's too many strange ways to access objects and functions, weird tricks, etc. Did I get this right so far? Because I'm really a bit with my jaw on the floor, how the hell did they approve this and not realize it's a landmine? I'm nearly certain that it must be possible to do other nasty tricks besides consuming 80% CPU for inefficient crypto-mining. If it's that many people (by now let's call them zombie nodes or a botnet, which is what Google Ads apparently gives you) all running your code, you can also use them to DDoS a site. But if you're just a dick, you can also attack the people themselves. Most browsers have the cross-domain security down tight, but nearly all of them have multiple "vulnerabilities" that DoS the browser itself, make it unresponsive, make it crash (yeah multiple tabs, even if they have their own threads) or even make the whole system (yeah outside the browser) unstable, unresponsive or crashy. Maybe not your tweaked/bolted down Linux system, but the average user's mildly clogged up Win10, easy. Can these scripts also track and log keypresses or is that somehow separated because of cross-domain / iframe protection? (it's been a while since I got real deep into JS security) Because that would be a vulnerability. So. Many. Possibilities. For. Fuckery.
- tripzilch 9y agoIn addition to simply being rather pissed off about all of this, I was just wondering (don't worry--I'd rather just block ads than actually be arsed to implement it): If your browser becomes a node in a crypto-mining network, it'll start number crunching and occasionally send the results to some central server for collection. What if your browser doesn't play nice? What if it sends bad or misleading data? I'm not sure how Monero exactly does its thing, but I know that for Bitcoin it goes a little something like this[0]: You start out with a quasi-random "salt", I think it comes from the previous block. Then you append a bunch of random bytes to that salt, and hash it (SHA256? or some popular hash function, anyway). The goal is to find just the right random bytes so that the hashed value has the longest run of ones as its least-significant bits. If the length of that run is equal or longer than the current "difficulty level", then you're the lucky winner and you just mined a block of bitcoin! These correct random bytes are hard to find, you have to bruteforce them, but super easy to check: just one hash and see if it has a long enough run of ones. Because even on decent hardware, odds of personally mining a block are in the order of once-a-year-maybe, people often join mining pools that share the profit. I'm not sure how they make sure everyone in the pool plays fair and divide up the profit based on the amount of work they put in (or amount of hashes they checked). The crypto-miner obviously joins a pool because with the shitty performance of stolen CPU-time over millions of people visiting an infected site for a few seconds, they kind of have to if they want a payout more often than once-a-decade-perhaps-not-even. Can you mess this up for whoever owns the pool account that the distributed cryptominers send their data to? I suppose if that miner's account tries to scam the pool and report way more hashes checked than they actually did, or something like that, would it ban the account and lose all profit up till then? What if your browser just reports any bunch of random bytes as "nope, that's not it", without even bothering to hash it? What if one of those just happens to be the winning bytes and it gets discarded and never tested again? Does it even work like that or do the JS miners just pick a random value to append to the salt, hash and test (with the risk of trying certain values more than once). Even then, I'm certain that you can bugger up whatever protocol these hostile JS miners use, and cause all sorts of "interesting" and costly misbehaviour in the pool. Though I should read up on how these things actually work, the above is just vague guesses based on what I know about bitcoin's crypto/protocol/algorithm (I actually did read the whitepaper once, but it was maybe a decade ago or so) and even vaguer guesses on how these mining pools work (that I haven't digged in to very much). [0] I'm probably wrong about some details because it's been a while since I read that whitepaper, so correct me if they're interesting details :)