Ad network uses advanced malware technique to conceal CPU-draining mining ads

Re:Ad network uses advanced malware technique to conceal CPU... by simias on Tuesday February 27, 2018 @09:47AM (#16473726)

Allow me to return the question: how do you prevent scripts from draining CPU resources? How do you distinguish between legitimate resource usage (like a heavy web application that runs a lot of javascript) from a cryptocurrency miner? How do you throttle one without hurting the other?

[ Parent | on HN ]

Re:Ad network uses advanced malware technique to conceal CPU... by 6d6b73 on Tuesday February 27, 2018 @10:06AM (#16473905)

Easy (?) when you install a new browser, it should load few standard pages in the background and check what's their CPU% usage. Get average value for all the tests, multiply it by 2 just to have a little bit of wiggle room. Next time website runs, monitor the usage, if it's over the threshold block the script and ask user if they would like to continue running the script.

I'm not going to file patent for this, thanks in the code will be enough. Enjoy :)

[ Parent | on HN ]

Re:Ad network uses advanced malware technique to conceal CPU... by xbkingx on Tuesday February 27, 2018 @07:02PM (#16479390)

Except that fails if the browser is installed while something else CPU intensive is running, an update is installing, an antimalware process is doing its initial analysis, or the device is in battery saver mode.

As an alternative, you could do a survey at install time - check if a battery is present, get power profiles, run your benchmark js stuff, check CPU, RAM, disk type (HDD/SSD) - then download profiles for that/those configuration(s). Then put a 'sensitivity' slider in the advanced options to allow power users to tweak/turn off the limit.

No need to send me code. Cash will do fine.

[ Parent | on HN ]

Re:Ad network uses advanced malware technique to conceal CPU... by JD557 on Tuesday February 27, 2018 @10:04AM (#16473888)

Most browsers already send you a warning if the main thread appears to be blocked. Maybe they could also add a warning like:

> This page is consuming a lot of resources, do you want to keep executing JavaScript on this page?

> Stop / Allow only this time / Allow always

[ Parent | on HN ]

Re:Ad network uses advanced malware technique to conceal CPU... by simias on Tuesday February 27, 2018 @11:25AM (#16474929)

Possible but if you set the limit too low you're going to have it pop it all the time on heavier websites (especially on less powerful hardware/smartphones). Then you condition the user to dismiss these warnings without thinking about it because of the high rate of false positives.

On the other hand if you set it too high then those websites will aim for that limit to maximize profit without triggering the warning. You'll still waste a ton of resources and you've only mitigated the issue somewhat.

I'm not saying it's impossible, just that "just add a dialog when CPU usage is high" might be a bit naive. There's a subtle balance to these things.

[ Parent | on HN ]

Re:Ad network uses advanced malware technique to conceal CPU... by chendragon on Tuesday February 27, 2018 @10:43AM (#16474348)

Safari already does this kind of. "This webpage was reloaded because it was using significant energy"

[ Parent | on HN ]

Re:Ad network uses advanced malware technique to conceal CPU... by gruez on Tuesday February 27, 2018 @10:23AM (#16474109)

site publishers would resort to social engineering ("click yes on the popup to continue reading)

[ Parent | on HN ]

Re:Ad network uses advanced malware technique to conceal CPU... by xxs on Tuesday February 27, 2018 @09:52AM (#16473770)

You avoid sites with heavy javascript usage.

[ Parent | on HN ]