This year, CCN reported Pirate Bay’s efforts to use visitors’ CPU’s to monetize Monero traffic and replace ads on its pages. The torrent index site used CoinHive, a JavaScript code that permits webmasters to provide cryptocurrency centered on anonymity with visitor CPU’s.
Since Pirate Bay has tested Coinhive on its website, different actors are starting to use the code to take advantage of the other CPU’s, leading to Monero madness, where the code was even placed on Google Chrome extensions and a Pass subscription service, belonging to the martial arts final battle championship (UFC).
The most recent case of an organization using the CoinHive code to dig Monero with people processors is that of a Starbucks in Buenos Aires, whose Wi-Fi provider forced a 10-second delay when connected so that they can mine cryptocurrency to people’s laptops.
The problem was found by the chief executive of a technology company in New York, Noah Dinkin, who noticed something was stopped when he was connected to the service. Then he used Twitter to share what he found.
While Noah Dinkin believed that his laptop was forced to dig Bitcoin, users saw that CoinHive only works with Monero, a cryptocurrency that has been optimized for CPU exploitation, which has reached a record high of over 300 USD and has expanded this year by more than 1,500%, according to data provided by CoinMarketCap.
A few days after Noah Dinkin distributed his findings on Twitter, and Starbucks replied. The company recognized the problem and announced that it had been resolved.
As soon as we were alerted of the situation in this specific store last week, we took swift action to ensure our internet provider resolved the issue and made the changes needed in order to ensure our customers could use Wi-Fi in our store safely.
— Starbucks Coffee (@Starbucks) December 11, 2017
A spokesman later clarified that it was an isolated incident and that the problem came from the Internet service provider and not Starbucks. Speaking with the motherboard, the spokesman replied that Starbucks wants to make sure that its customers can securely browse the internet via Wi-Fi and that the company is, therefore, working closely with the service provider.
Information security experts Don Smith, while talking to the BBC, have revealed that the incident shows that Wi-Fi public users should make sure they use upgraded software while they are looking for suspicious activity. He said:
Always be careful when connecting to misty networks and Wi-Fi public hotspots are not trusted, even if a trusted brand provides them. Indeed, joining to these systems gives the provider the opportunity to intercept your communications. However, we should not misuse ourselves unnecessarily, they can be useful services, and the abuse of these services is absolutely the exception, not the rule.
In a later tweet, Noah Dinkin showed that the code was located in three separate Starbucks locations over several days and that the Terms of Service of the Internet Service (TOS) do not mention Monero’s mining code.