Wappalyzer: CoinHive Detection in any website

[961Group]

i noticed coinhive is in every website!

something not correct!

i took 3 screenshoots form 3 diff sites (GMail,rand site and youtube

)

[jvoisin]

Are you sure that you don't have an other extension injecting some coinhive widgets into every webpage?

[961Group]

you think i have an addon causing all this?

[jvoisin]

Maybe, do you?
You can check Chrome's tasks manager to see if something weird is going on.

[961Group]

i use FireFox, I opened a report:

https://forums.malwarebytes.com/topic/214257-coinhive-real-issue-now-this-must-be-ended

[jvoisin]

Maybe it's a false-positive on our side, I don't know.

Do you have other extensions installed in your browser?

[961Group]

only these add-ons are working:
-AdBlocker Ultimate
-ColorZilla
-Disable WebRTC
-Grammarly for Firefox
-Secure Password Generator
-Wappalyzer

[jvoisin]

Can you disabled them all and check if Wappalyzer is still detecting coinhive?
If it's the case, enable them one by one until it shows up again :)

[gadcam]

You also add installed (according to the report on forums.malwarebytes.com) :
MetaMask / No Coin - Block miners on the web! / Unpaywall / Bypass Paywalls / Windscribe VPN
Did you installed "No Coin - Block miners on the web!" after the problem occured ?

[961Group]

Did you installed "No Coin - Block miners on the web!" after the problem occured ?
yes i did because i felt something wrong maybe this will prevent any infected script to run
now only the above mentioned ad-dons are running

[961Group]

please look at my last comment here
https://forums.malwarebytes.com/topic/214257-coinhive-real-issue-now-this-must-be-ended/?tab=comments#comment-1179779

[jvoisin]

Wonderful :/

@961Group please do signal it on the Chrome store and on Mozilla, in order to prevent people from being infected too.

[gadcam]

I installed the extension to test it : for the moment I could not reproduce it. What version do you have @961Group ?

[961Group]

@gadcam
to reproduce it they are smart to hide it from FireFox and Chrome, you need to update the listing in options and add any and listing will reproduce it for you, I did it on my chrome and in my testing environment VMware and all passed the test

[961Group]

i have successfully reported to chrome and Firefox please guys do the same thing

[gadcam]

Thank you I needed to update the lists to reproduce it.
I think it is a false positive : Adblocker Ultimate is initialising the Coinhive variable because of this rule (raw text extracted from a JSON file of rules filterrules_2.txt)

"#%#(function(){var c=navigator.language,d=\"AdGuard has detected that this website is trying to use your browser as a blockchain currency miner. It can create significant CPU load. Allow?\";c&&0===c.indexOf(\"ru\")&&(d=\"AdGuard \\u043e\\u0431\\u043d\\u0430\\u0440\\u0443\\u0436\\u0438\\u043b, \\u0447\\u0442\\u043e \\u044d\\u0442\\u043e\\u0442 \\u0441\\u0430\\u0439\\u0442 \\u043f\\u044b\\u0442\\u0430\\u0435\\u0442\\u0441\\u044f \\u0438\\u0441\\u043f\\u043e\\u043b\\u044c\\u0437\\u043e\\u0432\\u0430\\u0442\\u044c \\u0432\\u0430\\u0448 \\u0431\\u0440\\u0430\\u0443\\u0437\\u0435\\u0440 \\u0434\\u043b\\u044f \\u0434\\u043e\\u0431\\u044b\\u0447\\u0438 \\u043a\\u0440\\u0438\\u043f\\u0442\\u043e\\u0432\\u0430\\u043b\\u044e\\u0442\\u044b. \\u042d\\u0442\\u043e \\u043c\\u043e\\u0436\\u0435\\u0442 \\u0441\\u043e\\u0437\\u0434\\u0430\\u0442\\u044c \\u0437\\u0430\\u043c\\u0435\\u0442\\u043d\\u0443\\u044e \\u043d\\u0430\\u0433\\u0440\\u0443\\u0437\\u043a\\u0443 \\u043d\\u0430 \\u043f\\u0440\\u043e\\u0446\\u0435\\u0441\\u0441\\u043e\\u0440. \\u0420\\u0430\\u0437\\u0440\\u0435\\u0448\\u0438\\u0442\\u044c?\"); var b=null;\"undefined\"===typeof sessionStorage?b=!1:\"1\"===sessionStorage.getItem(\"__agch\")?b=!0:\"0\"===sessionStorage.getItem(\"__agch\")&&(b=!1);var a;window.CoinHive=Object.defineProperty({},\"JobThread\",{get:function(){return a},set:function(c){a=function(){if(null==b){b=window.confirm(d);try{b?sessionStorage.setItem(\"__agch\",\"1\"):sessionStorage.setItem(\"__agch\",\"0\")}catch(e){}}var a=c.apply(this,arguments)||this;b||a.stop();return a};a.prototype=c.prototype;a.prototype.constructor=a}})})();"

[gadcam]

Which could be translated as
```js
(function() {
var c = navigator.language,
d = "AdGuard has detected that this website is trying to use your browser as a blockchain currency miner. It can create significant CPU load. Allow?";
c && 0 === c.indexOf("ru") && (d = "AdGuard обнаружил, что этот сайт пытается использовать ваш браузер для добычи криптовалюты. Это может создать заметную нагрузку на процессор. Разрешить?");
var b = null;
"undefined" === typeof sessionStorage ? b = !1 : "1" === sessionStorage.getItem("__agch") ? b = !0 : "0" === sessionStorage.getItem("__agch") && (b = !1);
var a;
window.CoinHive = Object.defineProperty({}, "JobThread", {
get: function() {
return a
},
set: function(c) {
a = function() {
if (null == b) {
b = window.confirm(d);
try {
b ? sessionStorage.setItem("__agch", "1") : sessionStorage.setItem("__agch", "0")
} catch (e) {}
}
var a = c.apply(this, arguments) || this;
b || a.stop();
return a
};
a.prototype = c.prototype;
a.prototype.constructor = a
}
})
})();

[ganzino]

hello, i can see coin hive in every website! I have only sure extensions, it this depending from you or it's just me? Thanks

[jvoisin]

We should report this to Adblocker Ultimate, they might be detected by other tools too.

[ganzino]

I do not have adblocker ultimate, i have ublock origin.

[961Group]

so basically this is a false positive guy?

[ganzino]

the coin-hive website has it for sure (you can find it using the extension AntMiner). I think it's kind a bug

[gadcam]

It is a false positive but because of a strange, if not buggy, behavior of Adblocker Ultimate : we will reach them to know how to solve this.

Edit : The extension is initializing a CoinHive variable in order to block it, even if there is nothing bad running - this should be possible to avoid.

[ameshkov]

Adblocker Ultimate is just an AdGuard clone, and this code comes from us.

It is a false positive but because of a strange, if not buggy, behavior of Adblocker Ultimate : we will reach them to know how to solve this.

This approach is neither strange nor buggy, it allows CoinHive code detection even if it comes from an unknown domain or a proxy.

[ameshkov]

However, I guess we can detect & allow people blocking and avoid false positive detection.

[ameshkov]

The issue is fixed on our side and in a couple of days, there should be no more false positive detections. Tested with Wappalyzer chrome extension.

[jvoisin]

Wonderful ♥

[961Group]

amazing, good i mentioned this, you have to reset your analytics and data mining for coinhive , as all given data are false positive

[gadcam]

@ameshkov Thank for your good work and to take into account Wappalyzer!
What was disturbing me was that you were initializing a variable outside of the scope of your addon, which is not a good practice in my opinion. I was pointing the side effect of the way it was done previously not the method :)
@961Group I think you can now close the issue.
Here is the commit of @ameshkov to fix this issue : https://github.com/AdguardTeam/AdguardFilters/commit/d0cfa496f7f5a847bac6aaf939d4167bda9c0bba

[ameshkov]

Btw, guys, kudos for the software, it seems you've got one more user today:)

Also, I see that there's one more false positive issue caused by the way AG blocks Yandex Metrika tracker (creating a fake Ya object). I'll check what can be done about it.

[ameshkov]

What was disturbing me was that you were initializing a variable outside of the scope of your addon, which is not a good practice in my opinion.

Yeah, I understand your point and it makes sense.

[961Group]

keep the good work guys !

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.