Re: [PLUG] Mining for Cycles

[Rich Freeman <r-plug@thefreemanclan.net>]

On Wed, Jan 23, 2019 at 11:09 PM jeff <jeffv@op.net> wrote:
>
> On 1/23/19 3:55 PM, Soren Harward wrote:
> > Jeff: your explanation of a javascript exploit seems like a case of
> > confirmation bias: it's possible, but you've been looking for evidence
> > to support your current theory,
>
> Correct me if I'm mistaken, but trying to figure out what's wrong
> without a clue doesn't qualify as a theory.
>
> I found a number of resources indicating it was quite likely.
> 6 different engines had different results, the rest didn't even trigger,
> so it was difficult to pin down with 100% certainty.
>

It isn't surprising that you found a cryptominer.  I suspect there is
also a general rootkit with a command/control interface so that
somebody can run arbitrary stuff on your system.

My point is just that we really can't tell based on what was presented
so far how it got there.

You have a cryptominer.  There happen to be javascript-based
cryptominers.  That doesn't mean that your cryptominer got there via
some javascript exploit.

IMO there isn't really much to be done here unless it is just to
satisfy your curiosity.  Keep your software up to date with security
updates, don't run stuff from untrusted sources, and if you're
concerned about zero days you can try hardening your browser to
minimize your attack surface.

-- 
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug