How to check for cryptocurrency mining on a website?

Discussion in 'malware problems & news' started by wsfmojosam, Feb 23, 2018.

  1. wsfmojosam

    wsfmojosam Registered Member

    Joined:
    Mar 28, 2013
    Posts:
    16
    Location:
    USA
    Is there a way to check whether a website is running a cryptocurrency miner? I load mastodon.art into Vivaldi and leave it running in the background. After a couple of days, it has pegged my CPU. Sure sounds like a miner to me!

    It doesn't do this in Firefox or Chrome. I have those browsers clamped down pretty hard with uBlock Origin and a few other things. I keep Vivaldi unencumbered by adblockers, so I can open obstinate sites over there that won't render in FF or Chrome. (I keep mastodon.art running in Vivaldi, so it doesn't distract or tempt me while I'm doing important stuff in Firefox.)
     
  2. Sampei Nihira

    Sampei Nihira Registered Member

    Joined:
    Apr 7, 2013
    Posts:
    3,365
    Location:
    Italy
  3. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    Web site's page code looks clean to me. Also didn't see any increased CPU activity on my PC. I obviously didn't log in to the web site.
     
  4. wsfmojosam

    wsfmojosam Registered Member

    Joined:
    Mar 28, 2013
    Posts:
    16
    Location:
    USA
    PublicWWW doesn't list that site as infected, FWIW.
     
  5. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    Do you leave your PC constantly running with Vivaldi also running?
     
  6. wsfmojosam

    wsfmojosam Registered Member

    Joined:
    Mar 28, 2013
    Posts:
    16
    Location:
    USA
    Yes. The CPU load seems normal for a while. I only notice things dragging after a couple of days. It could be a weird bug in Vivaldi, but I haven't heard of bugs that consume CPU.
     
  7. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    Keeping a browser constantly open is a security risk; especially when the PC is unattended. Basically, you have open ports exposed to the world.
     
  8. JoWazzoo

    JoWazzoo Registered Member

    Joined:
    Nov 11, 2008
    Posts:
    241
    Location:
    Ether
    Leaving browsers open for days can in many cases affect CPU, but particularly Memory. You do realize also that they are constantly writing to the disk? And with recent browser versions, the more tabs open the more writing. And of course, itman is spot on.
     
  9. wsfmojosam

    wsfmojosam Registered Member

    Joined:
    Mar 28, 2013
    Posts:
    16
    Location:
    USA
    I guess I assumed that was only a theoretical risk. The browser is supposed to sandbox the tabs (but I guess they're not so good at that). The computer has a firewall running, and it's behind a router. I don't have Flash or Java installed. I don't have any PDFs open in the browser.

    Why would the browser be a bigger risk than any other program? They all phone home these days. It seems like I'm always hearing about how this program or that program is discovered to have open ports with "admin" "admin" credentials.

    I know about memory leaks. I've seen that with other programs. I've never heard of a "CPU leak". That's why I thought something was suspicious.

    I forgot about that. This computer has an SSD.
     
  10. JoWazzoo

    JoWazzoo Registered Member

    Joined:
    Nov 11, 2008
    Posts:
    241
    Location:
    Ether
    Presume the problematic browser is Vivaldi? I am unfamiliar with how it works. If you don't run Vivaldi with mastodon.art site open you don't have this problem?

    For grins next time you run this set up, run the following:

    Task Manager
    Resource Monitor
    or Process Monitor or Process Hacker
    Moo0 Connection Watcher (or TCPView or similar)
    Moo0 File Monitor (or similar)

    Let us know and maybe we can help track things further. I am wondering if there is some art there that is driving this problem? Seems odd - but so is this problem. :)
     
  11. wsfmojosam

    wsfmojosam Registered Member

    Joined:
    Mar 28, 2013
    Posts:
    16
    Location:
    USA
    I left the site open in Chrome for a couple of days, but nothing happened. I have uBlock Origin installed in Chrome, which might somehow be involved. I use Firefox for everyday browsing. Haven't tried it in there for a while.

    Vivaldi is based on Chromium, so I assume 98% of the code is the same.

    I'm on a Mac. I leave Activity Monitor running, which is how I identified the culprit. I don't know if it has any useful diagnostics. I'll investigate those programs you mentioned to see if they run on the Mac or there are equivalents that do.
     
  12. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    24,076
    Location:
    UK
  13. wsfmojosam

    wsfmojosam Registered Member

    Joined:
    Mar 28, 2013
    Posts:
    16
    Location:
    USA
    What do you know! A "CPU leak"!

    I considered that this might be due to a bug in Vivaldi, but since cryptomining is so prevalent right now, that was my number one suspect.

    That's a neat tool! I didn't know it existed. OK, so I just reopened Vivaldi and logged into mastodon.art. I'll just let it run for a while. It seemed to not show up for a couple of days, so I might have to wait.
     
  14. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    Glad to see the "leaking memory" issue was brought up. Other software can also do so. AV realtime executables are notorious for this.
     
  15. wsfmojosam

    wsfmojosam Registered Member

    Joined:
    Mar 28, 2013
    Posts:
    16
    Location:
    USA
    OK. I have left Vivaldi running for three days while logged into mastodon.art. There is no abnormal CPU activity. It should have happened by now. It had been doing it consistently for the past couple of weeks.

    I don't know what to make of this. Same version of Vivaldi. Same website. If there was a cryptominer on there, it isn't there now.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.