How to keep your browser and devices safe from cryptojackers
Cryptojacking makes surfing the web similar to walking through a minefield: you never know when you might land on a booby-trapped site.
Stealthy cryptocurrency mining scripts have found their way to a variety of websites – streaming, gaming, online stores, and so on.
The craze started with CoinHive, but copycats have soon started popping up and increasing the probability for users to get their browsers hijacked into mining crypto currency (mostly Monero).
Mining scripts have been found added to popular browser extensions and mobile apps, and themes and plugins for popular content management systems (WordPress, Magento, Joomla and Drupal).
So what can you do to prevent your browsers/devices being hijacked to do the miners’ work?
Solutions
The easiest, more effective solution to prevent in-browser cryptomining is to block your browser from loading JavaScript. But this step can affect the quality of your Internet experience, as many websites use JavaScript.
Some antivirus makers – most notably Malwarebytes and Avast – are already blocking CoinHive’s mining JavaScript from accessing the coinhive.com domain and IP (but offer the option to unblock it), as well as some other mining sites.
Adblock Plus offers the option to enable several filter lists (e.g. NoCoin) that block browser-based miners. Other helpful extensions include uBlock Origin, Coin-Hive Blocker, No Coin, and MineBlock. They mostly work by blocking a list of blacklisted domains, meaning that the list must be constantly updated in order for the extensions to work as promised. Cryptojacking actors are actively trying to thwart those defenses by hosting their own mining intermediary for JavaScript components to call back to.
Some mobile enterprise security solutions have also begun offering the option of blocking access to cryptojacking and other cryptocurrency sites.
For non-enterprise users: if you notice that your mobile device is suddenly heating up more than usual or your battery is draining more rapidly than before, remove the latest app or two that you’ve installed, as chances are that it was an app that secretly mines cryptocurrency.
Chrome developers have been debating whether the browser should block or flag CPU mining attempts since early September, but have yet to reach a consensus.
In the meantime, Opera developers have added cryptocurrency mining protection to the beta version of its next big release of the browser.