A first look at browser-based cryptojacking
As the years passed and a few key cryptocurrencies emerged as the market leaders, the concept of browser mining largely became forgotten. Today, the most common way for the average person to acquire cryptocurrencies is to purchase them. It came as a surprise to many when stories began to circulate on popular media outlets this year about websites mining cryptocurrencies through browsers again. Figure 1 shows how the searches for “browser mining” have changed since Bitcoin was launched. Websites like The Pirate Bay  experimented with browser mining as a way to add a new revenue stream, while others like Showtime.com  claimed they had the code injected after they were discovered.
This paper tells the story behind the rejuvenation of browser-based mining. It is centred on cryptojacking (also known as coinjacking and drive-by mining), a term coined to refer to the invisible use of a vulnerable user’s computational resources to mine cyptocurrencies. Technically in-browser mining is a subset of cryptojacking, although most uses of the term apply to browser-based mining. In this case, mining happens within the client browser when the user visits the website. We have also seen the term cryptojacking applied to malware that mines cryptocurrencies, or in the situation where malware renders a machine as an unwitting participant in a botnet, and the botnet is rented for the purposes of mining crypcurrencies (cf. ). The resource consumption of in-browser cryptojacking can noticeably degrade a computer’s performance.
2 Preliminaries and Related Work
2.1 Browser-based Mining
2.1.1 Early days
In addition to unprofitability, browser-based mining faced legal challenges. In May 2015, the New Jersey Attorney General’s office reached a settlement with the developers of “Tidbit“, a browser-based Bitcoin miner. Terms of the settlement included ceasing operations of Tidbit. Then acting Attorney General John J. Hoffman stated “No website should tap into a person’s computer processing power without clearly notifying the person and giving them the chance to opt out.“ .
2.1.2 From one CPU to ASICS and mining pools
The first Bitcoin block mined on a GPU happened on July 18th, 2010 by a user named ArtForz , by using a private mining code that he developed himself. It was not until mid-2011 that others started implementing and releasing open source GPU-based mining tools. These tools greatly increased mining efficiency due to the hashing power of a GPU and the massive parallelizing possible with multiple GPUs (also known as mining rigs). The move from software to hardware followed shortly after. First, programmable FPGA chips resulting in custom-built circuits specifically for mining888Custom FPGA Board for Sale! (August 18, 2011) https://bitcointalk.org/index.php?topic=37904.0. Then by mid-2012, companies started selling ASICs designed specifically for Bitcoin mining. After delay of about a year in delivering ASIC products, Bitcoin mining started transitioning from GPUs to ASICs where it remains today. Consequently, the hashing power of the Bitcoin network increased and the mining difficulty followed. To illustrate the change, consider a desktop PC CPU mining at 10 MH/s: on expectation, it will take 425 years before mining a single block .
In parallel to the evolving technology, collective action emerged through the use of mining pools. A mining pool is a collective of individual miners. Participants receive a slice of work for mining the current block on behalf of the pool. If a member of the pool mines the block, the block reward is split amongst the participants of the pool pro rata according to their computational effort . As an aside, a very elegant protocol for reporting ‘near-solutions’ to the pool enables participants to prove, without trust, the level of effort they are contributing to the pool at all times. In general, a mining pools cannot amplify earnings, they only change their shape. An income stream from a pool is a steady trickle, while solo-mining results in sporadic dumps of income. The first Bitcoin block found on a mining pool was on December 16, 2010 that was a beta implementation of a pool operated by a user named slush.
Launched in April 2014, Monero  is a cryptocurrency alternative to Bitcoin. It purportedly offers increased privacy by obfuscating the participants in a transaction, as well as the amounts. This is in contrast to more popular cryptocurrencies like Bitcoin and Ethereum, where a pseudonymous-but-complete transaction graph can be constructed from the public blockchain. Recent research has shown Monero’s obfuscation techniques are less effective than originally claimed [17, 14]. Since regulation on exchanging between cryptocurrencies is lighter than exchanging cryptocurrencies for fiat money, and such services are not geographically bound, obtaining Monero for Bitcoin and vice versa is efficient and enables Monero to be used as a short-term medium of exchange for Bitcoin holders. This approach (and Monero’s acceptance) is particularly popular on so-called dark web markets; markets that do not ban illicit goods and services.
A second characteristic that distinguishes Monero from Bitcoin is in the mining algorithm it uses. Monero still employs proof-of-work, specifically an algorithm called CryptoNight . However the computational puzzle is designed to be memory-hard: it requires the storage of a large set of bytes and then requires frequent reads and writes from this memory. Such puzzles are optimized for CPUs with low-latency memory-on-chip, and not as well suited for circuits like FPGAs and ASICs. CrypoNight requires approximately 2MB per instance, which fits in the L3 cache of modern processors. Over the course of the next few years, these L3 cache sizes should become mainstream and allow more CPUs, and thus users, to participate in Monero’s ecosystem. It has also been shown that ASICs cannot handle more than 1MB of internal memory, which is less than the size of memory required to calculate a new block. GPUs are also at a disadvantage since GDDR5 memory, which are used in modern GPUs and considered one of the fastest types of memory, is notably slower than L3 cache .
Monero built on its early success and continued to gain in popularity over the years, which caught the attention of some developers who decided to revisit the idea of browser mining. See Table I for a timeline of events. One of the earliest efforts appeared in September 2017 and was called Coinhive . Soon after, a competitor named Crypto-Loot999Crypto-Loot - A web Browser Miner — Traffic Miner — CoinHive Alternative https://crypto-loot.com/ emerged. Both websites provided APIs101010Application Programming Interface to developers for implementing browser mining on their websites that used their visitors’ CPU resources to mine Monero. A portion of mined Monero would go back to the API developer, and the rest would be kept by the website. Not long after their early success, several copycats appeared such as Coin-Have and PPoi  to take part in the reborn practice. It even inspired a new coin specifically designed for browser mining named JSECoin,111111JSEcoin‘s Website Cryptocurrency Mining https://jsecoin.com/ which has yet to find an audience. These developments took place over the course of a few weeks, which signalled the renewed success of browser mining. However, Coinhive’s approach as a legitimate group set it apart from its peers and established itself as the leader in the space. They also launched separate services such as proof-of-work CAPTCHAs and short-links, which could be used to prevent spam while mining Monero .
3 Threat Model
In-browser mining is considered as an abuse unless user’s consent is granted. The attack surface to abuse users’ browsers through cryptojacking is broad, and there are multiple vectors where various entities can inject mining scripts in the website’s codebase. We summarize those here.
3.1 Webmaster initiated
A website administrator can add a mining script to her webpage, with or without informing users. Website owners may do this to monetize their sites, especially when they have been blacklisted or blocked by standard advertising platforms. In one example, a researcher found Coinhive on a large Russian website offering child pornography to users . Revenue estimates, based on the website traffic data available, were roughly $10,000 a month after converting the value of XMR mined to USD.
3.2 Third-party services
3.3 Browser extensions
Cryptojacking was not limited to websites in 2017. The Chrome extension Archive Poster remained on the Chrome Web Store for days while silently cryptojacking an unknown portion of their 100,000+ users. After multiple user reports, followed by multiple news media outlets covering the issue, the extension was removed . Similar cryptojacking extensions has been identified on less popular Mozilla Firefox add-ons as well.
Another recent example of such incident is a breach in a website plugin called Browsealoud161616An accessibility tool to read the content aloud in multiple languages https://www.texthelp.com/en-gb/products/browsealoud/ led to injection of cryptojacking scripts in some United Kingdom governmental websites such as Information Commissioner‘s Office, UK NHS services, Manchester City Council and around 4200 other websites . Within the same month, cryptojacking script was seen on Tesla and LA Times websites through poorly secured cloud configuration .
A user’s web traffic is often routed through intermediaries that may have plaintext access to content. For example, internet service providers or free public wireless routers can inject cryptojacking scripts into non-HTTPS traffic. Advertisement code injection has been seen in practice before  and there have been assertions of similar injections of browser mining scripts at certain Starbucks free Wi-Fi hotspots in Argentina171717https://twitter.com/imnoah/status/936948776119537665.
4.1 Prevalence of Coinhive and alternatives
1SELECT domain, tags, p80.http_www.get.headers.content_language, p80.http_www.get.headers.server, p80.http.get.headers.x_powered_by, p80.http.get.title, p80.http_www.get.body as wwwbody, p80.http.get.body as plainbody
3WHERE STRPOS(p80.http.get.body, coinhive.min.js) > 0 or STRPOS(p80.http_www.get.body, coinhive.min.js) >0)
Based on the fact that Coinhive is the dominant website offering in-browser mining (see Figure 4), we first focus on measuring the prevalence of Coinhive scripts deployed on internet sites. We use the censys.io BigQuery dataset  for the top million sites indexed by Zmap181818https://zmap.io. We simply look for the coinhive.min.js script within the body of the website page. The query we use is in Figure 3 and the results over a two month period are provided in Figure 2. These findings are corroborated by another search engine, PublicWWW191919Search Engine for Source Code https://publicwww.com/, which indexes the source code of publicly available websites. Using PublicWWW’s dataset, over 30,000 websites were found to have the coinhive.min.js library . As seen from our data in Figure 2, the adoption of this script was substantial in the first days of its release. However, progress slowed down at the same time as ad-blockers and organizations started to block Coinhive’s website. The initial purpose of this service, as claimed by Coinhive, was to replace ads and cover server costs for webmasters. As the service did not require that websites receive user consent before running the miner code, it started to be used maliciously in users‘ browsers. This type of usage resulted in Coinhive being included in some company’s top-10 most wanted malware list .
Coinhive has begun to be blocked by enterprises. One example is shown in Figure 7. This blocking seems to have sent Coinhive operators to lesser known alternatives with the same or similar functionality. We used the same methodology on PublicWWW dataset to find the usage of Coinhive and its alternatives on the internet. Table II shows the keywords used to identify these services. The result can be found on Figure 4 and Figure 5.
Coinhive has also reacted by focusing on adding methods to enforce asking for user consent and legitimizing the use of cryptojacking. It introduced another domain and service called Authedmine, which requires user’s consent to start mining in the browser. This service did not get the same attention as the original service, but it did inspire discussions regarding the ethics of such services, which is discussed in Section 6. Using the same methodology, censys.io was used to measure the prevalence of AuthedMine and show the results in Figure 8.
4.2 Client impact
Coinhive developers estimate a monthly revenue of about 0.3 XMR (about $101 USD) for a website with 10-20 active miners . We sought to validate this estimation with a real world data set provided to us212121In collaboration and with thanks to Faraz Fallahi https://github.com/fffaraz. One of the biggest Coinhive campaign operators is a domain parking service. It runs Coinhive on over 11 000 parked websites. While visits to parked domains are considerably shorter than an average website, the data spans a period of three months and gives some insight into the profitability of cryptojacking. During the experimental period of about 3 months, they accumulated 105 580 user sessions for an average of 24 seconds per session. For the period examined, the revenue was 0.02417 XMR (Monero’s currency) which at the time of writing is valued at $7.69 USD. Further detail is provide in Figures 10 and 11. While an A/B test was not setup to determine how much traditional web advertising would have brought in, freely available web calculator tools suggest we might expect an order or two of magnitude greater for comparable traffic.
We discuss the ethics of cryptojacking in the next section, but in the case of cryptojacking without user consent, it is seems natural to us to presuppose users want to be protected. Protection might take a few forms, which we outline here.
5.1 Obtaining consent
Cryptojacking tools might attempt to legitimize the practice by first obtaining user consent on a service provider level. An example of this is the Authedmine service from Coinhive discussed previously. Malicious sites might also opt for a service like Authedmine if it is whitelisted on its users‘ networks and then attempt to circumvent the consent process. For example, consent that requires a click from the user has been shown in some circumstances to be vulnerable to clickjacking attacks .
While cryptojacking is nowhere near the prevalence of tracking cookies, eventually it might grow into a regulatory issue where governmental bodies could use legislative approaches to obtain consent, similar to the provisions many countries now use for cookies (including honouring the ‘do not track’ HTTP header and obtaining click-based consent).
5.2 Browser-level mitigation
Browser developers have begun discussion of intervening in cryptojacking222222‘Please consider intervention for high cpu usage js’ https://bugs.chromium.org/p/chromium/issues/detail?id=766068. Potential mitigations include: throttling clientside scripting, warning users when clientside scripting consumes excessive resources, and blocking the sources of known cryptojacking scripts. Determining appropriate for thresholds for client-side processing that are high enough to allow legitimate applications and low enough to deter cryptojacking is an open research problem, as would be the wording of any notifications to the user that would lead the user to make an informed decision about allowing or not allowing resource consumption (cf. SSL/TLS warnings [31, 30, 1]). Browsers such as Opera, have taken a stance against cryptojacking scripts and blocked them via their “NoCoin” blacklist . It is too early to determine the effectiveness of using a blacklist to block such activities.
It is worth noting that some browsers might actually take the exact opposite approach and promote (consensual) in-browser mining, as it enables a form of monetizing websites independent of both (1) ad networks and the user tracking that accompanies the current ad model, and (2) users maintaining some form of credits or currencies for making micropayment to websites they use(e.g., Brave Browser 232323https://brave.com). Browser mining has been shown to not be as efficient as native mining applications today. Therefore, optimizations on how browsers pass system calls to the operating system can be made, or there can even be browsers designed specifically to support efficient browser mining.
While cryptojacking might be relatively new, it fits the pattern of various other technologies deployed on the web that raise ethical questions. In thinking about it, we distinguish a few cases: (1) the use of cryptojacking on a breached website, (2) the use of cryptojacking by the website owner with an attempt at obtaining user consent, and (3) the use of cryptojacking by the website owner without obtaining user consent. We would argue that (1) is clearly unethical; invariant to one’s views on the ethics of hacking, we cannot see a justification for a breach that profits the adversary without any external benefits to anyone else.
The potential harm to users of cryptojacking is higher energy bills, along with accelerated device degradation, slower system performance, and a poor web experience [29, 33]. While consent may be obtained from the user, it is unclear if the user’s mental model of how they are paying can be made clear to them. On the other hand, the privacy disclosures users make in the traditional advertising model are also intangible; it is doubtful users understand what they are consenting to when they, for example, consent through a banner  to the use of tracking cookies; and many websites waste computational resources without consequence through buggy scripting and unnecessary libraries. In short, the ethics are not clear-cut and should be debated.
The third case is the use of cryptojacking without user consent. Moor, in ”What is Computer Ethics?”  introduces the concept of an invisible factor for invisible computer operations in society. Based on his definitions, we would classify cryptojacking that does not gain user consent as invisible abuse: the intentional use of the invisible operations of a computer to engage in unethical conduct. Here the cryptojacker is earning money from unaware users that are being charged on their electricity bill. As discussed before, we already have court cases against such activities  and regulations for activities such as online user tracking , which indicates the need to start discussions and regulation on in-browser mining to fill in this policy vacuum as well.
J. Clark thanks NSERC and FRQNT for partial funding of this research.
-  M. E. Acer, E. Stark, A. P. Felt, S. Fahl, R. Bhargava, B. Dev, M. Braithwaite, R. Sleevi, and P. Tabriz. Where the wild warnings are: Root causes of chrome https certificate errors. In CCS, CCS ’17, pages 1407–1420, New York, NY, USA, 2017. ACM.
-  BBC. Websites hacked to mint crypto-cash. http://www.bbc.com/news/technology-41518351, 2017.
-  BleepingComputer. The internet is ride with in-browser miners and it is getting worse each day. https://www.bleepingcomputer.com/news/security/the-internet-is-rife-with-in-browser-miners-and-its-getting-worse-each-day/, 2012. Accessed: 2017-12-08.
-  CheckPointResearchTeam. October’s most wanted malware: Cryptocurrency mining presents new threat. https://blog.checkpoint.com/2017/11/13/octobers-wanted-malware-cryptocurrency-mining-presents-new-threat/, 2017.
-  Coinhive. Coinhive monetize your business with your users cpu power. https://coinhive.com/, 2017. Accessed: 2017-11-20.
-  Cryptonote. Cryptonote technology. https://cryptonote.org/inside.php#equal-proof-of-work, 2017. Accessed: 2017-11-20.
-  DeepDotWeb. Coinhive hacked and launches new opt-in service. https://www.deepdotweb.com/2017/11/11/coinhive-hacked-launches-new-opt-service/, 2017.
-  Z. Durumeric, D. Adrian, A. Mirian, M. Bailey, and J. A. Halderman. A search engine backed by Internet-wide scanning. In ACM CCS, Oct. 2015.
-  European-Commission. Cookies. http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm, 2011. Accessed: 2017-12-08.
-  ExtremeTech. Browser-based mining malware found on pirate bay, others. https://www.extremetech.com/internet/255971-browser-based-cryptocurrency-malware-appears-online-pirate-bay, 2017. Accessed: 2017-11-20.
-  Fortune. Popular google chrome extension caught mining cryptocurrency on thousands of computers. http://fortune.com/2018/01/02/google-chrome-extension-cryptocurrency-mining-monero/, 2017. Accessed: 2018-01-20.
-  D. Y. Huang, H. Dharmdasani, S. Meiklejohn, V. Dave, C. Grier, D. McCoy, S. Savage, N. Weaver, A. C. Snoeren, and K. Levchenko. Botcoin: Monetizing stolen cycles. In NDSS, 2014.
-  M. King, J. Atkins, and M. Schwarz. Internet advertising and the generalized second-price auction: Selling billions of dollars worth of keywords. The American economic review, 97(1):242–259, 2007.
-  A. Kumar, C. Fischer, S. Tople, and P. Saxena. A traceability analysis of moneroâs blockchain. In European Symposium on Research in Computer Security, pages 153–173. Springer, 2017.
-  LiveHelpNow. Security incident nov 23rd, 2017. https://blog.livehelpnow.net/security-incident-nov-23rd-2017/, 2017. Accessed: 2017-12-14.
-  T. Micro. Malvertising campaign abuses googleâs doubleclick to deliver cryptocurrency miners. https://blog.trendmicro.com/trendlabs-security-intelligence/malvertising-campaign-abuses-googles-doubleclick-to-deliver-cryptocurrency-miners/, 2018. Accessed: 2018-01-31.
-  A. Miller, M. Moeser, K. Lee, and A. Narayanan. An Empirical Analysis of Linkability in the Monero Blockchain. Technical report, arXiv, 2017.
-  Monero. MONERO private digital currency. https://getmonero.org/, 2014. Accessed: 2017-11-20.
-  J. H. Moor. What is computer ethics? Metaphilosophy, 16(4):266–275, 1985.
-  T. Mursch. Cryptojacking malware coinhive found on 30,000+ websites. https://badpackets.net/cryptojacking-malware-coinhive-found-on-30000-websites/, 2017. Accessed: 2018-01-20.
-  S. Nakamoto. Bitcoin: A peer-to-peer electronic cash system, 2008.
-  NakedSecurity. Unsecured aws led to cryptojacking attack on la times. https://nakedsecurity.sophos.com/2018/02/27/unsecured-aws-led-to-cryptojacking-attack-on-la-times/, 2018. Accessed: 2018-02-28.
-  A. Narayanan, J. Bonneau, E. Felten, A. Miller, and S. Goldfeder. Bitcoin and Cryptocurrency Technologies: A Comprehensive Introduction. Princeton University Press, 2016.
-  N. J. D. of Consumer Affairs. New jersey division of consumer affairs obtains settlement with developer of bitcoin-mining software found to have accessed new jersey computers without users knowledge or consent. http://nj.gov/oag/newsreleases15/pr20150526b.html, 2015. Accessed: 2018-01-20.
-  Opera. New year, new browser. opera 50 introduces anti-bitcoin mining tool. http://blogs.opera.com/desktop/2018/01/opera-50-introduces-anti-bitcoin-mining-tool/, 2018. Accessed: 2018-01-20.
-  M. Rosenfeld. Analysis of bitcoin pooled mining reward systems. arXiv preprint arXiv:1112.4980, 2011.
-  S. Ruwhof. Massive child porn site is hiding in plain sight, and the owners behind it. https://sijmen.ruwhof.net/weblog/1782-massive-child-porn-site-is-hiding-in-plain-sight-and-the-owners-behind-it, 2017. Accessed: 2018-01-20.
-  G. Rydstedt, E. Bursztein, D. Boneh, and C. Jackson. Busting frame busting: a study of clickjacking vulnerabilities at popular sites. In IEEE SSP, volume 2, 2010.
-  D. Sillars. The performance impact of cryptocurrency mining on the web. https://discuss.httparchive.org/t/the-performance-impact-of-cryptocurrency-mining-on-the-web/1126, 2017. Accessed: 2017-12-20.
-  A. Sotirakopoulos, K. Hawkey, and K. Beznosov. On the challenges in usable security lab studies: Lessons learned from replicating a study on SSL warnings. In SOUPS, 2011.
-  J. Sunshine, S. Egelman, H. Almuhimedi, N. Atri, and L. F. Cranor. Crying wolf: An empirical study of SSL warning effectiveness. In USENIX Security, 2009.
-  R. Tahir, M. Huzaifa, A. Das, M. Ahmad, C. Gunter, F. Zaffar, M. Caesar, and N. Borisov. Mining on someone else’s dime: Mitigating covert mining operations in clouds and enterprises. In RAID, 2017.
-  TheGuardian. Ads dont work so websites are using your electricity to pay the bills. https://www.theguardian.com/technology/2017/sep/27/pirate-bay-showtime-ads-websites-electricity-pay-bills-cryptocurrency-bitcoin, 2017. Accessed: 2017-11-20.
-  ThePirateBay. The galaxys most resilient bittorrent site. https://thepiratebay.org/blog/242, 2017. Accessed: 2017-11-20.
-  TheRegister. Cbs’s showtime caught mining crypto-coins in viewers’ web browsers. https://www.theregister.co.uk/2017/09/25/showtime_hit_with_coinmining_script/, 2017. Accessed: 2018-01-20.
-  TheRegister. Crypto-jackers enlist google tag manager to smuggle alt-coin miners. https://www.theregister.co.uk/2017/11/22/cryptojackers_google_tag_manager_coin_hive/, 2017. Accessed: 2018-01-20.
-  TheRegister. Lets get ready to grumble! ufc secretly choke slams browsers with monero miners. https://www.theregister.co.uk/2017/11/07/ufc_coin_hive/, 2017.
-  TheRegister. Uk ico, uscourts.gov… thousands of websites hijacked by hidden crypto-mining code after popular plugin pwned. https://www.theregister.co.uk/2018/02/11/browsealoud_compromised_coinhive/, 2018. Accessed: 2018-02-28.
-  TheVerge. Hotel caught injecting advertising into webpages on complimentary wi-fi network. https://www.theverge.com/2012/4/7/2931600/hotel-caught-injecting-advertising-into-web-pages-on-complimentary-wi, 2012. Accessed: 2017-12-08.
-  TheVerge. Showtime websites secretly mined user cpu for cryptocurrency. https://www.theverge.com/2017/9/26/16367620/showtime-cpu-cryptocurrency-monero-coinhive, 2017. Accessed: 2017-11-20.
-  N. van Saberhagen. Cryptonote v 2. 0. https://bytecoin.org/old/whitepaper.pdf, 2013.
-  WallStreetJournal. Your computer may be making bitcoinâ for hackers. https://www.wsj.com/articles/hackers-latest-move-using-your-computer-to-mine-bitcoin-1509102002, 2017. Accessed: 2018-01-20.
-  Washingtonpost. Hackers have turned politifact’s website into a trap for your pc. https://www.washingtonpost.com/news/the-switch/wp/2017/10/13/hackers-have-turned-politifacts-website-into-a-trap-for-your-pc, 2017. Accessed: 2018-01-20.
-  V. Wikipedia. Important milestones of the bitcoin project. https://en.bitcoin.it/wiki/Category:History, 2009. Accessed: 2018-01-18.
-  J. Wyke. The zeroaccess botnet: Mining and fraud for massive financial gain. Sophos Technical Paper, 2012.