4 ms·

It’s a good writeup. Unfortunately the cryptojacked website gets screwed either way. Without a CSP policy, it will have its resources cryptojacked, which depl

by mjgs 6y ago

It’s a good writeup. Unfortunately the cryptojacked website gets screwed either way. Without a CSP policy, it will have its resources cryptojacked, which depletes its resources, and with the CSP policy it will have to process the violation report, which again depletes its resources. The only solution is to never visit a cryptojack website, if you’ve come to rely on that site for something then that might prove very difficult, and not visiting it could again deplete resources finding a replacement site.

walrus01 6y ago
What's interesting is that as he points out in the part about the mikrotik routers doing mitm on http traffic, lots of websites out there are not serving the .js, they are just http only sites which are vulnerable. Any user inside the border of one of those hacked mikrotiks requesting any non https page will get the .js from any site.
- mjgs 6y ago
  You’re right, it’s the end user that gets screwed either way, not the website. Could happen to anyone on http, there’s just no way to know if you’ll be routed through a hacker router. Even with https there’s no way to know ahead of time that the site isn’t adding the malicious js, though probably will happen less often than on http. In a future AR/VR world this is the sort of problem that could get quite horrible. You really would not want a cryptojacked-sites-all-the-way-down situation to develop.
  - walrus01 6y ago
    From an ISP perspective it's an unfortunate side effect of a race to the bottom in pricing and network equipment in the developing world. And cargo cult network engineering where people know just enough to be dangerous, copying and pasting templates of bgp configurations into $800 mikrotiks and calling themselves an ISP.
    - mjgs 6y ago
      I’m not so worried about the networking, it happens anyway even without the dodgy networking. It’s the wasted resources that worry me.
deleted 6y ago
[deleted]

by mjgs 6y ago

walrus01 6y ago

What's interesting is that as he points out in the part about the mikrotik routers doing mitm on http traffic, lots of websites out there are not serving the .js, they are just http only sites which are vulnerable. Any user inside the border of one of those hacked mikrotiks requesting any non https page will get the .js from any site.

mjgs 6y ago
You’re right, it’s the end user that gets screwed either way, not the website. Could happen to anyone on http, there’s just no way to know if you’ll be routed through a hacker router. Even with https there’s no way to know ahead of time that the site isn’t adding the malicious js, though probably will happen less often than on http. In a future AR/VR world this is the sort of problem that could get quite horrible. You really would not want a cryptojacked-sites-all-the-way-down situation to develop.
- walrus01 6y ago
  From an ISP perspective it's an unfortunate side effect of a race to the bottom in pricing and network equipment in the developing world. And cargo cult network engineering where people know just enough to be dangerous, copying and pasting templates of bgp configurations into $800 mikrotiks and calling themselves an ISP.
  - mjgs 6y ago
    I’m not so worried about the networking, it happens anyway even without the dodgy networking. It’s the wasted resources that worry me.

deleted 6y ago

[deleted]