Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation

Abstract

The proliferation of web applications has essentially transformed modern browsers into small but powerful operating systems. Upon visiting a website, user devices run implicitly trusted script code, the execution of which is confined within the browser to prevent any interference with the user's system. Recent JavaScript APIs, however, provide advanced capabilities that not only enable feature-rich web applications, but also allow attackers to perform malicious operations despite the confined nature of JavaScript code execution.In this paper, we demonstrate the powerful capabilities that modern browser APIs provide to attackers by presenting MarioNet: a framework that allows a remote malicious entity to control a visitor's browser and abuse its resources for unwanted computation or harmful operations, such as cryptocurrency mining, password-cracking, and DDoS. MarioNet relies solely on already available HTML5 APIs, without requiring the installation of any additional software. In contrast to previous browserbased botnets, the persistence and stealthiness characteristics of MarioNet allow the malicious computations to continue in the background of the browser even after the user closes the window or tab of the initial malicious website. We present the design, implementation, and evaluation of a prototype system, MarioNet, that is compatible with all major browsers, and discuss potential defense strategies to counter the threat of such persistent inbrowser attacks. Our main goal is to raise awareness regarding this new class of attacks, and inform the design of future browser APIs so that they provide a more secure client-side environment for web applications.

Browser-Based Deep Behavioral Detection of Web Cryptomining with CoinSpy

“…The intuition as to why these features should scale in future is that, even if some implementation details of Web mining scripts change, they still must use some underlying similar Web APIs whose behaviors are less likely to change [33]. Secondly, it is known that the PoW algorithms used by Web miners must be memory-bound to be profitable to mine on commodity devices [10], [14].…”

“…Our goal is to evaluate CoinSpy over other players in the cryptomining landscape. Thus, we evaluate CoinSpy against cryptomining players identified by existing works [23], [37], [33]. These miners primarily use CryptoNight [10] and ETHash PoWs [44], but span many cryptocurrency blockchains (Monero, JSECoin, UPlexa).…”

“…To perform the evaluation, we inject the scripts from each of these miners into the pages from our benchmark data set for evaluation, hence we only evaluate with accuracy. Although researchers have identified 13 popular miners [23], [37], [33] that use CryptoNight, only the five in Table IV are active at the time of performing our experiments. In fact, CoinHive, the largest Web mining player of 2018 [21], [37] has shut down their service as of March 2019, showing the volatility of the environment.…”

“…The Web is fast becoming a popular platform for cryptocurrency mining [37], [33], a process called "drive-by-mining" or cryptojacking. Cryptojackers exploit resources at the client device when the client is browsing the Web.…”

Melting Pot of Origins: Compromising the Intermediary Web Services that Rehost Websites

“…Lee et al demonstrated cryptocurrency mining in the background that uses malicious service workers, and mined Monero coins through verified 225K transactions in a day [36]. Moreover, Papadopoulos et al developed a monitoring framework to allow malicious service workers to abuse browser resources and found the following harmful operations: DDoS attacks, distributed password cracking, malicious data hosting, proxies of a hidden network, and cryptocurrency mining [47].…”