Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 18 submissions in the queue.
posted by Fnord666 on Wednesday September 27 2017, @10:43PM   Printer-friendly
from the follow-the-monero dept.

Showtime, a premium cable, satellite, and streaming television service owned by CBS, included JavaScript on two of its domains that used users' web browsers to mine the cryptocurrency Monero:

The websites of US telly giant CBS's Showtime contained JavaScript that secretly commandeered viewers' web browsers over the weekend to mine cryptocurrency.

The flagship Showtime.com and its instant-access ShowtimeAnytime.com sibling silently pulled in code that caused browsers to blow spare processor time calculating new Monero coins – a privacy-focused alternative to the ever-popular Bitcoin. The hidden software typically consumed as much as 60 per cent of CPU capacity on computers visiting the sites.

The scripts were written by Code Hive, a legit outfit that provides JavaScript to website owners: webmasters add the code to their pages so that they can earn slivers of cash from each visitor as an alternative to serving adverts to generate revenue. Over time, money mined by the Code-Hive-hosted scripts adds up and is transferred from Coin Hive to the site's administrators. One Monero coin, 1 XMR, is worth about $92 right now.

However, it's extremely unlikely that a large corporation like CBS would smuggle such a piece of mining code onto its dot-coms – especially since it charges subscribers to watch the hit TV shows online – suggesting someone hacked the websites' source code to insert the mining JavaScript and make a quick buck.

The JavaScript, which appeared on the sites at the start of the weekend and vanished by Monday, sits between HTML comment tags that appear to be an insert from web analytics biz New Relic. Again, it is unlikely that an analytics company would deliberately stash coin-mining scripts onto its customers' pages, so the code must have come from another source – or was injected by miscreants who had compromised Showtime's systems.

Also at PCMag.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by JNCF on Thursday September 28 2017, @12:47AM (1 child)

    by JNCF (4317) on Thursday September 28 2017, @12:47AM (#574123) Journal

    He did say "while I work." I used to run SETI@home on a company computer overnight, but the company was aware.

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 1, Funny) by Anonymous Coward on Thursday September 28 2017, @05:29PM

    by Anonymous Coward on Thursday September 28 2017, @05:29PM (#574453)

    My company did the same thing for awhile thanks to some perverse incentives. They paid a flat rate for a set number of kWh per day (4 A.M. to 4 A.M.) to get a break on rates, with overages being charged at insane rates. Well, they were in a use it or lose it situation, so the IT department would have the machines boot into Linux and run various SMART and other diagnostics, along with BOINC in a VM. The central manager would issue stop orders at 4 A.M. or when they got too close to the kWh limit, whichever came first and the machines would reboot in time for work the next day. Suffice to say, that arrangement only lasted the minimum amount of time before getting terminated by the managing company because by the end of it, most companies in the building started doing various things like that, which resulted in a drastic increase in power usage bills to the managing company.