We’ve recognized the need to think outside the box and include non-traditional ways of finding problems and exploits
REDDING, Calif. (PRWEB) April 26, 2018
The values of cryptocurrencies such as Bitcoin, Litecoin, and Ethereum have skyrocketed over the course of the past year or so, persuading more and more of those who are tech savvy to get into crypto mining. It was perhaps inevitable, then, that some miners would resort to shady tactics to mine their coins.
In late 2017, reports began surfacing of cryptocurrency mining scripts lurking in websites, utilizing unsuspecting users’ web browsers and CPU clock cycles to mine crypto coins. Dubbed “cryptojacking”, the method consists of malicious Javascript inserted into a compromised web page. The script can begin working instantly when the affected page is loaded, without a user’s consent or knowledge of what is happening. The result for a user can mean reduced computer performance and a bigger electric bill.
While some sites such as The Pirate Bay are knowingly running mining scripts in the background to raise funds and reduce the need for ad-based revenue, others have simply fallen victim to third party hackers who have found and taken advantage of a vulnerability. Either way, the discovery of such a script by an end user can be reputation damaging, especially if the user is not given a chance to opt in. And don’t expect things to change anytime soon -- one report cited a “725% increase in the number of domains running scripts on one or more pages -- knowingly or not -- in the four-month period from last September to January 2018.”
Shasta QA recently found a cryptocurrency mining script on one of our clients’ websites -- the script had been inserted into their Javascript by some unknown party -- and while it could have had a dramatic negative impact on the client’s reputation, once they were notified they were able to roll out a fix within a matter of a couple hours.
So, how can you detect whether your site has been compromised? It’s likely easier than you may think. Certain add-ons for Firefox and extensions for Chrome, for example AdGuard or No Coin, can detect and block these types of cryptojacking scripts, and a QA team armed with these kinds of tools and a little due diligence can easily discover a cryptojacking script on your site before the public does, protecting your business and its reputation.
Mike Benton, QA Director at Shasta QA, said, “This is something that goes beyond traditional QA and is typically not going to be found by a regression test. But as business consultants, we’ve recognized the need to think outside the box and include non-traditional ways of finding problems and exploits.”