Source-linked AI summary
A first look at browser-based Cryptojacking
Shayan Eskandari, Andreas Leoutsarakos, Troy Mursch, Jeremy Clark
TL;DR
The paper examines browser-based Monero mining, especially cryptojacking through Coinhive, where websites use visitors’ browser resources with or without consent. It surveys the ecosystem, measures prevalence and profitability, and considers ethics and defenses; it concludes that non-consensual cryptojacking should be treated as invisible abuse, while consent-based mining remains ethically unsettled.
Problem
Browser mining can consume users’ computational resources and impose costs or performance degradation without clear consent.
Method
The paper surveys browser-mining history and incidents, measures Coinhive prevalence and profitability, and develops ethical and mitigation frameworks.
Results
The paper classifies cryptojacking without user consent as invisible abuse, while finding the ethics of consent-based mining unclear.
Takeaways & Limitations
The paper supports discussion and regulation of non-consensual browser mining and considers browser-level throttling, warnings, and script blocking as possible mitigations.
Takeaways & Limitations
User consent may not establish a fair exchange because users may not understand what they are paying or receiving.
Abstract
from arXiv · showhide
In this paper, we examine the recent trend towards in-browser mining of cryptocurrencies; in particular, the mining of Monero through Coinhive and similar code- bases. In this model, a user visiting a website will download a JavaScript code that executes client-side in her browser, mines a cryptocurrency, typically without her consent or knowledge, and pays out the seigniorage to the website. Websites may consciously employ this as an alternative or to supplement advertisement revenue, may offer premium content in exchange for mining, or may be unwittingly serving the code as a result of a breach (in which case the seigniorage is collected by the attacker). The cryptocurrency Monero is preferred seemingly for its unfriendliness to large-scale ASIC mining that would drive browser-based efforts out of the market, as well as for its purported privacy features. In this paper, we survey this landscape, conduct some measurements to establish its prevalence and profitability, outline an ethical framework for considering whether it should be classified as an attack or business opportunity, and make suggestions for the detection, mitigation and/or prevention of browser-based mining for non- consenting users.
1. Introduction
Browser mining faded as Bitcoin mining shifted toward ASICs and pools, then re-emerged with renewed interest in browser-based mining for other cryptocurrencies. The paper introduces cryptojacking as browser mining that can consume users’ computational resources without consent and degrade performance.
- 1. Introduction: Browser mining re-emerged after fading as Bitcoin mining shifted toward ASICs and collective mining pools.Search interest later spiked to more than 4 times its lifetime average, coinciding with renewed browser mining for non-Bitcoin currencies.
- 1. Introduction: Cryptojacking uses a visitor’s browser to mine cryptocurrency, often invisibly and without consent.The paper distinguishes browser-based mining as a form of cryptojacking while noting that the term also covers other malware-enabled mining arrangements.
- 1. Introduction: In-browser cryptojacking can noticeably degrade a user’s computer performance.
2. Preliminaries and Related Work
Browser mining evolved from early Bitcoin experiments toward specialized hardware and pools, while Monero’s mining design helped renew interest in browser-based mining. Coinhive and competitors then exposed APIs for websites to mine Monero using visitors’ CPU resources.
- 2.1.1. Early days.: Browser-based Bitcoin mining also faced legal challenges, including a New Jersey settlement requiring Tidbit to cease operations.The settlement followed a requirement that users be clearly notified and given an opportunity to opt out.
- 2.1.2. From one CPU to ASICS and mining pools.: Bitcoin mining progressed from CPUs to GPUs, FPGAs, ASICs, and mining pools, making ordinary CPU mining increasingly uncompetitive.A desktop CPU mining at 10 MH/s would be expected to take 425 years to mine a single Bitcoin block.
- 2.2. Monero: Monero offers purportedly stronger transaction privacy than Bitcoin and Ethereum, although research has challenged the effectiveness of its obfuscation.
- 2.2. Monero: Monero uses the memory-hard CryptoNight proof-of-work algorithm, which is better suited to CPUs than FPGAs and ASICs.CryptoNight requires approximately 2 MB per instance, fitting in the L3 cache of modern processors.
- 2.2. Monero: Coinhive and Crypto-Loot revived browser mining in 2017 by providing APIs that let websites use visitors’ CPU resources to mine Monero.The API developers received a portion of the mined Monero while websites kept the remainder; copycats soon followed.
3. Threat Model
Cryptojacking abuses users’ browsers by injecting mining scripts through websites, third-party services, extensions, breaches, or network intermediaries. These vectors can affect users without the knowledge or consent of site owners or visitors.
- 3. Threat Model: Cryptojacking has a broad attack surface because mining scripts can enter websites through administrators, third parties, extensions, breaches, or traffic intermediaries.
- 3.2. Third-party services: Third-party JavaScript services, including advertising and analytics systems, can intentionally or unintentionally inject cryptojacking scripts.Coinhive was injected into Movistar and Globovision through Google Tag Manager, and Coinhive advertisements reached YouTube users in several countries.
- 3.3. Browser extensions: Cryptojacking can spread through malicious browser extensions, as illustrated by Archive Poster’s silent mining across an unknown portion of its 100,000-plus users.
- 3.4. Breaches: Attackers can compromise third-party services or website infrastructure to mine across many users’ browsers without site owners’ knowledge.A modified LiveHelpNow SDK caused unsolicited mining across nearly 1,500 websites, while a Browsealoud breach affected around 4,200 websites.
- 3.5. Network intermediaries: Plaintext non-HTTPS traffic can be modified by internet providers or public wireless networks to inject browser-mining scripts.The paper cites assertions of browser-mining injections at certain Starbucks free Wi-Fi hotspots in Argentina.
4. Measurements
The paper measures browser-mining prevalence, alternatives, client impact, and profitability using web-scale datasets, source-code searches, and a real-world campaign. Coinhive adoption was substantial initially but faced blocking, while observed mining commonly used about 25% of users’ CPU and produced limited revenue in the examined campaign.
- 4.1. Prevalence of Coinhive and alternatives: Coinhive adoption was substantial immediately after release, but growth slowed as ad-blockers and organizations began blocking the service.The prevalence measurement searched for coinhive.min.js in the Censys top-million dataset and was corroborated by PublicWWW, which found over 30,000 websites containing the library.
- 4.1. Prevalence of Coinhive and alternatives: The prevalence measurement is expected to become less accurate as services adopt obfuscated JavaScript and randomized URLs to evade detection.Minr is given as an example of automatic obfuscation and frequently changing domains used to circumvent blocklists and anti-malware software.
- 4.1. Prevalence of Coinhive and alternatives: Coinhive’s blocking prompted operators to use lesser-known alternatives, while AuthedMine required user consent and was measured with the same prevalence methodology.The paper reports that the alternatives and AuthedMine were identified through PublicWWW and Censys searches, respectively.
- 4.2. Client impact: Most discovered cryptojacking scripts were configured to use around 25% of the user’s CPU, while Coinhive’s default library used all available CPU unless implementers added throttling.The paper notes early reports of 100% CPU usage and illustrates the browser-with-mining comparison in Figure 9.
- 4.3. Profitability: Over about three months, a domain-parking operator running Coinhive on 11 000 websites earned 0.02417 XMR, valued at $7.69 at the time.The campaign recorded 105 580 sessions averaging 24 seconds; freely available calculators suggested comparable advertising traffic might earn one or two orders of magnitude more, although no A/B test was conducted.
5. Mitigations
The paper discusses consent, browser intervention, and the possibility of supporting consensual mining as responses to cryptojacking. It identifies click-based consent as potentially vulnerable and frames appropriate CPU thresholds and notifications as open design problems.
- 5.1. Obtaining consent: AuthedMine illustrates a consent-based model, but click-based consent can remain vulnerable to clickjacking attacks.The paper also notes that malicious sites might choose a whitelisted consent-based service and attempt to circumvent its consent process.
- 5. Mitigations: Browser mitigations could throttle client-side scripting, warn users about excessive resource consumption, or block known cryptojacking sources.The paper identifies appropriate thresholds that permit legitimate applications while deterring cryptojacking, as well as notification wording, as open research problems.
- 5. Mitigations: Some browsers might instead support consensual in-browser mining as an alternative to advertising networks, tracking, or user-maintained micropayment credits.The paper notes that browser mining is currently less efficient than native mining applications and suggests browser or system-call optimizations as possible directions.
6. Discussion
The paper frames browser-based cryptojacking as an ethically variable practice whose acceptability depends on website compromise, consent, and user understanding. Unconsented mining can impose concrete user costs and creates a policy gap requiring further discussion and regulation.
- Consent-based cryptojacking remains controversial because users may not understand what they surrender or receive, or whether the exchange is fair.Possible returns include ad removal, premium features, paywalled content, or higher-definition video.
- Cryptojacking can increase energy bills, accelerate device degradation, slow systems, and worsen the web experience.
- The ethical assessment is not clear-cut because cryptojacking resembles other web practices that consume resources or collect intangible user value.The paper therefore presents the issue as requiring debate rather than a single universal judgment.
- Video streaming sites are especially exposed because longer user engagement can generate more browser-mining income.The paper cites Showtime.com and UFC.com as sites researchers asserted had deployed Coinhive, while noting uncertainty about Showtime’s implementation.
- Unconsented cryptojacking is characterized as invisible abuse because unaware users fund the miner through their electricity costs.The paper connects this classification to existing court cases and online-tracking regulations, arguing that in-browser mining also warrants policy discussion.