Re:Fighting cryptojacking and doing good things with content...
by walrus01 on Thursday April 01, 2021 @12:44AM
(#26656757)
What's interesting is that as he points out in the part about the mikrotik routers doing mitm on http traffic, lots of websites out there are not serving the .js, they are just http only sites which are vulnerable. Any user inside the border of one of those hacked mikrotiks requesting any non https page will get the .js from any site.
Re:Fighting cryptojacking and doing good things with content...
by mjgs on Thursday April 01, 2021 @01:08AM
(#26656862)
You’re right, it’s the end user that gets screwed either way, not the website.
Could happen to anyone on http, there’s just no way to know if you’ll be routed through a hacker router.
Even with https there’s no way to know ahead of time that the site isn’t adding the malicious js, though probably will happen less often than on http.
In a future AR/VR world this is the sort of problem that could get quite horrible.
You really would not want a cryptojacked-sites-all-the-way-down situation to develop.
Re:Fighting cryptojacking and doing good things with content...
by walrus01 on Thursday April 01, 2021 @01:20AM
(#26656915)
From an ISP perspective it's an unfortunate side effect of a race to the bottom in pricing and network equipment in the developing world. And cargo cult network engineering where people know just enough to be dangerous, copying and pasting templates of bgp configurations into $800 mikrotiks and calling themselves an ISP.
Unfortunately the cryptojacked website gets screwed either way.
Without a CSP policy, it will have its resources cryptojacked, which depletes its resources, and with the CSP policy it will have to process the violation report, which again depletes its resources.
The only solution is to never visit a cryptojack website, if you’ve come to rely on that site for something then that might prove very difficult, and not visiting it could again deplete resources finding a replacement site.