I'm Kim Mitchell, Special Defense Coordinator for the City of Columbia Parks and Recreation Department. I'm here to tell you about our monthly bingo for our seniors. Our bingo takes place every second Thursday at the Busbee Community Center from 10 a.m. to 12 p.m.  Busbee Community Center 10 a.m. to 12 p.m. Bingo. It's totally free.


Suicide prevention is a 365-day effort for every soldier serving in the Army. The month of September is a month to remind every member of the armed forces to be there for their battle buddy when they are in need. If you or someone you know needs someone to talk to, you can call or text the Be There Peer Support Line and the Military Crisis Line. Be There.


Excellent. Welcome, everybody. Thank you for attending our talk. Today is going to be a talk about malware in the video game micro economy. We'll explain what that actually means in a little bit here, but first let's get into the agenda. We're going to cover who we are, kind of the history of scamming and gaming, backgrounds for non-gamers in the audience, which should hopefully be very few of you. Some of the interesting stats we got from some of the surveys we did for steam players, looking at the attackers and some of the techniques they use and some of the tools they use, investigating the defenses that Valve and some of the other communities have put into place. And last, forecasting recommendations for the future. Sure. So I'm Zach. This is Rusty. And just before we begin, just wanted to make sure that everyone knows that we're doing this talk in our own volition, has nothing to do with this. Yada, yada, yada, liability. Good stuff. Excellent. We just wanted to get Zach's in face time. So history of scams. Scams have been around pretty much as long as video games have been around. Diablo II, some of the older ones, RuneScape was especially prevalent to this day. I think people still play RuneScape, which confuses me. I stopped playing when I was 13. Eve Online is another interesting one for scamming. Battle Net and Steam are sort of the more prevalent ones these days. So let's dig in. Diablo II. You've got a couple interesting scamming techniques there. D&D, they called it the D&D scam. It was dueling and damage or the Diablo network database where you could meet with other players to trade, join their clans, things like that. So what you do, you would slash type D&D, username and password. And what this actually means is you put a do not disturb up, which responds back with a message, which is your username and password. So the attacker would just message you and congratulations, they have all the account information. Pretty simple but incredibly effective and also very hilarious. Next is a trade window scam. An attacker would come and say, hey, I'm looking to trade this item for you. They would put an item in the trade window. You would say, I'm giving you a million gold or whatever it is.  Here's the actual item, my bad. But it would be different items. They'd just swap it in there for you. Also this rush payment where they would say, hey, I'll rush you through all the dungeons here. Some X amount of gold, half up front, half when we're done.  So it works, I guess. Next, runescape. Here's a great forum post about how to scam people in runescape. You have one buddy. I don't know if you can read this so I'll describe it for you guys. You have one buddy saying, hey, I'm looking for a jug of wine which is like two copper. I'll pay 70K.  Sees he can make a profit but he actually bought a useless item. The bottom there says easy money, not honestly earned, the way I like it. Perfect. WikiHow, how to avoid scams in runescape? Probably pretty good. But on the exact same forum you have had a password scam in runescape. All right, we'll go with that. Eve online, does anyone play? Eve spreadsheets in space? Excellent. CCP, the company who runs Eve, they actually don't regard scamming as a petitionable offense. They say it's part of the game. They do have four caveats for that. They don't allow character sale fraud, impersonation, gaming rookie systems so abusing a new player's lack of knowledge or stealing real life assets. But pretty much everything else is fair game in that universe which is pretty fantastic. If anyone does that. And the last one, this kind of segues into the whole point of this talk is the Steam platform. I assume everyone is familiar with Steam. If you're not, you guys don't belong here. Steam is awesome. It started way back in the day when it was totally shitty but now it's actually pretty good. It's a social media platform with friends, with communities, clans, groups, et cetera. And there's a marketplace which is sort of ripe for the taking for scammers as well as normal players to buy and sell items together. So that segues nicely into the Steam marketplace. So non-functional cosmetic items were introduced in 2009 into Team Fortress 2. In 2010 they released an update that allowed players to trade with each other. So cosmetic hats and weapons. They literally did nothing. Well, the weapons didn't TF2 but the hats. They did nothing.  That's worth $100 for some insane reason. Since then it's been expanded to other games, Counter Strike Go, Dota League of Legends. The picture there is actually of the Burning Flames Team Captain. It is the most expensive hat in TF2 history to this day. It's worth $4,500. All it does is make your character's head catch on fire. It does nothing useful but someone will pay $4,500 for it. So, fantastic. Some more background. This is just a screenshot from Ghost Who Gamers of the top ten available weapons currently in the marketplace. They're all around $400. So there's dozens of sites dedicated to trading, gambling, et cetera. Counter Strike Go, CSGO lounge, CSGO traders, CSGO loot, TF2 has backpack TF. League of Legends is interesting because there's not really a marketplace. But with the skin codes you've got Law Skin Shop as well as things like eBay where you can buy accounts that are either boosted or have skins and stuff unlocked. So very interesting. Lots of potential attack vectors there. And I'll hand it over to Zach to do stats. So to really kind of sell to everyone how serious these gamers get and how serious these communities are, we wanted to go out and we wanted to survey some of the Steam user base. Instead of just going out trying to find as many places as possible all throughout the internet or befriend millions of people on Steam, we went to Reddit. We went to the Dota 2, CSGO, TF2, and a couple trading subreddits just to collect some stats in terms of anything ranging from their inventory prices to if they've ever been scanned before to age just to kind of get a general idea of what we're working with here. So before I begin the problem with collecting stats on the internet is that you make sure that you do form validation for Google Docs. When I opened up the first Excel spreadsheet I had an ASCII caterpillar that almost crashed my computer. So either do form validation or just don't let people put in additional notes. My favorite one is a guy that filled out about five times.  So good way to start this out, right? Okay, let's get into some actual stats. So first one we have here, most of these up front, we have a sample set of 1,100 people. This just shows the general age range of Steam gamers. At least from these gaming subreddits, not the general Steam user base, 90% are between 12 years old to 24 years old. So you can kind of make some inferences there, you know, young, impressionable, especially when it comes to scams. Rusty talked about the runescape scam. In that post they said this works great for 13 year olds, just go after them and scam them. Makes sense. In terms of Steam and these online gaming communities being an investment, this one shows the hours spent per week on video games. So over 56% people play 20 hours or more on Steam. So it really shows like how much people invest into these things. And it's not just something where, you know, you get on, you play a game for three or four hours, they get on, they play a game for 20 hours and they go after these really rare items that are worth hundreds to thousands of dollars and they really put their heart and soul into it, just like anybody else would with a hobby. In terms of the amount spent per month on games, essentially the way this pie chart breaks down is four of the five people that took our survey say they spent at least some amount of money. And we have the breakdown here of people can spend casually, you know, one to ten dollars, that's generally like a huge chunk, but we have people spending at least two percent of that base, $500 a month just on going and purchasing these in-game items and trading with other people. So we talked a lot about purchasing and having these in-game items, right? So we then put out a question, what about inventory prices?  So this is a box plot because I wanted to show this first because of the outliers, there is something out there, $60,000 someone's inventory is worth. So we couldn't believe it at first, so we went and we checked a pretty well-known website for TF2 backpacks, essentially TF2 inventories. And lo and behold, there's somebody there verified about $55,000, their video game profile is worth on Steam. So this is the box plot actually zoomed in. As you can see, there's a red square on there that shows the mean. So from these gaming subreddits, people say on average about $1,000 worth of items in your inventory. So when you think about these things, it really goes to show like when it comes to scams. At first, you know, RuneScape, Diablo, people, they just traded in-game currency back and forth. And now people are attaching dollar amounts to this. And this is a really good target for people that want to scam because then they can steal these items and they can turn them around. So where does this leave us? This is actually a pretty funny picture. Only because this is one of the most expensive guns in Counter-Strike Go right now. It's $1,500. We put this up and I think we got, it was yesterday or two days ago, a good friend of ours randomly got this as a drop while playing the game and he's only played like a couple of hours into it. So he played the game for two hours and just netted an item worth $1,500. We hate him right now. Like a lot. I'm PJ Salt right now. Cool. So kind of how did this all start? I realize this is sort of in the middle of the talk but we needed a lot of background here. So this actually started because we saw a Reddit post with someone having a link to an imager album of them attempted to be scammed. So this was on the front page of the Dota 2 subreddit. There was lots of people in the comments talking about similar experiences and scammers were starting to target gamers. So I'll just describe this because I don't know if everyone could read it but someone messaged them and says, hey can you be the plus one as a stand in? The guy says, yeah we played a couple of days ago. Sure. And the guy is like, alright, well wins the game. And so they trade some details back and forth there. The guy says, hey you need to download mumble. And the guy is like, I already have mumble. So the scammer says which version the player says 1, 2, 4. It shouldn't matter though. And then the scammer says, oh well you need the specific version of mumble in order to talk to us. Let me link you to the mumble software as a good guy. Mumblesoftware.net. Perfect. What is mumblesoftware.net? It's registered in Russia. It looks like this. If anyone's ever downloaded mumble this is not what their website looks like. But it looks like sort of a reasonable website and given how pretty shitty voice gaming software is, this is something I would absolutely expect. Not only that, it has great reviews. We've got great quality, good player feedback. It's awesome. So when you actually go download this piece of software there's the actual mumble installer but it comes bundled with some obfuscated JavaScript which looks like this. And for those of you who can't read JavaScript it looks like this. So this is the download file from URL function that exists in that JavaScript file which is eventually called here. So there's three download file from URL functions called. The first one grabs a copy of 7-Zip from a website called copy.com. So first one is 7-Zip. The second one is a 7-Zip encrypted binary installer for team viewer. And the third one is a batch script, decrypt team viewer install it as a service. Start it on startup and then basically just install the rat for the scammer to log into your system. Which is fun. So this is what a hacker looks like if no one is clear on that. Cool. So we're going to go through some of the different samples we found. We've been doing this for about a year now and the evolution of the scammers and the attackers from a year ago until today has been the evolution of the complexity and just the TTPs they're using to go scam people. So this is pretty low level. They just link you to cursevoice-beta.com it installs curse voice but it also installs rat giving persistent access to the victim's computer. Like pretty straightforward. This is something a sample we found called raid call. This is what happens when I tried to execute the drop.js file which was really unfortunate but that's okay. So what raid call does is very similar to the Mumble software we saw earlier. Drops JavaScript it executes W script to sleep for 15 or 1.5 million seconds which is like 62 days which is what most processes do. They don't. Steals private information from browsers, drops files and installs into complex and a little nastier here. Your speaks isn't actually based on anything real. So with all the other samples we found it was based on curse, it was based on Mumble, it was based on Skype, things like that. This was just something that it sounds like it might be a weird voice program that gamers might use which was interesting. So not trying to do homograph attacks and just run on hook, some windows functions, process injection, HTTP request, so less of the remote access tools and more of actual sort of classic malware sort of seeing the evolution there. This was one of the more interesting ones we found. It's got a great logo, pokey steams dealer. So the attacker just runs an auto accept bot and then they go distribute the stub.exe to victims and according to the website this quote is lifted directly from a method of their choosing to distribute to their victims. It creates a file, this QEQ file in user's temp which also tries to sleep for like 60 days probably not a legitimate file. But we have a video with this high quality production value which is fantastic. I'll tab to it as opposed to open it. So he's dragging the steams dealer exe to the middle of his computer and this has a great techno track in the background. I'm sorry you guys are being denied it right now. So executes the file. He's running process explorer like a good citizen. We can see that it's executing. So this is his trade offers that he's sending. So he has to refresh it like 15 times. One more time. There we go. One more. So close baby. Cool. So now that was a trade offer that he just made to a mule somewhere. All of his items. Just because he clicked an executable. Like that's insane. So his CSGO skins there. So here's the site. They believe in quality. Here's your packages. They accept to pay pal on bitcoin. If this isn't the greatest marketing video you've ever seen. Get it now. Perfect. I stumbled across that video and I had to include it in this because it was production value. Cool. So that is the pokey steam stealer which was really interesting. That was incredibly effective before Valve started implementing some of their security fixes which we'll get into a little bit later. But the next sort of iteration of that was called steam stealer which is here. So this is all C sharp and I'll sort of walk you guys through this. This is the main function. It iterates through all of the windows processes currently running for anything named steam. Itirates through all of those and finds any process that I've loaded the steam client.dll which include the oh sweet Jesus. Which include the steam guard key as well as the session cookies for your steam login. So next we iterate through each of the processes. We iterate through their memory and then we pull out the session cookie from memory. So this is pretty cool. I don't know if you guys can see it in the middle there. There's a regex. Wait, do you think the session cookies are cool? Check this out. I love session cookies. I have a Jack Daniels cookie for you. All right. What do first time speakers do? Cheers. Cheers. To DEF CON. To DEF CON.  Back. That's right. Wasn't as bad as my... I would like to say that DEF CON does not condone anything that was just said. The last half hour of this talk. Cool. So the regex in the middle there is actually a seven character or seven digit string that all steam cookies are prepended with. And then the regex for the rest of the stuff in there. So super interesting. You're looping through all the processes. You're looping through memory in the process to pull out the session cookie that we get.  So going to sort of the next part there. For each session cookie that we get because multiple steam instances can be on the same computer.  We want uncommon and rare. So the bottom two lines there. The first one is get items for a steam ID and then the text there is 570 which is the game code for Dota 2. And then the last one there is filtering out any of the common items. So if we go look at the actual request that's being made and I realize you guys actually probably can't see any of this but I'll continue describing. The user agent that's being used is Valve Steam Client. So the malware is attempting to duplicate the same traffic that the Steam Client would do in order to go pull the user's inventory from the Steam Master Server. So that's kind of cool. As I mentioned earlier, 570 is the game app ID for Dota 2. So what does that give you back when you actually make that request? So this is my account. One of the requests I made for a single item. Counter strike go as you see in the top there. The app is 570. This is my 570 monkey business.  It's my favorite item in the game. You can see it's tradable, it's marketable. And I don't have the rarity on there but it's pretty rare. So once we have actually gathered a list of all the items that the player has in their inventory then we go make a giant list of this so we can automatically trade this to our mule. The top line there, we create this divide list. Turns out you can only trade 256 items at a time so they have a hard cap there so if it goes over that they just create multiple requests. We iterate through all of the items we found and we prepare them into the format we need to make the request to the Steam API. So the prepared items list and then the next one underneath is the sent item. So we'll dig into the prepared items. You have your app ID there. The amount, the number of items that you want to trade if they have duplicates. The asset ID is the actual item ID. And so you're just creating this list and just concatenating all these together for your trade offer. The second one is sent items. Using the Steam API trade offer slash new slash send. The session ID that you pulled out of the cookie. The partner is the person you're trading to and then you throw in all your items in there as well. So pretty advanced pretty crazy. Definitely a step away from the low level scamming that we had seen before into like real malware, real value, real production. And we'll get into some of the interesting web stuff that we saw. Thank you. So now that Rusty's talked a lot about the evolution of the malware, I'm going to talk about the evolution of the different type of attack methods via web or the web TTPs. So the attack websites split in two categories sometimes both. We've seen a lot of phishing websites that have been taking the Steam community, taking the front page of it, attaching it to another website, and then essentially just logging use names and passwords. I think we have a slide later that shows kind of how it does that. Malware droppers, much like what we talked about before with the Mumble software.net. On there, they would go get a person to connect to that website and then they'll take every single link on that website and usually they just replace it with the downloadable link and then you get that on there. We've also seen both. So we've seen some websites that essentially it's a Steam community login. You go and you log into your Steam account after you're logged in, it prompts you to say hey, there's new update, there's new software download this now so you can update. So not only do they get your credentials, they also get onto your box to refer your items. In terms of the domain names, those are split into two categories. The first category is called calling a brand abuse. So essentially what we saw before with the VoIP clients, whether it's Mumble or Ventrilo or Curse, think of any type of website that a gamer on Steam would visit whether it's a betting website or it's just the regular Steam website or it's a VoIP website. People perform different variations of those brands because they're very recognizable for women but very different to a machine. So it makes it very easy to trick somebody. Another type, image websites. So a lot of the times these traders, they put a lot of time and energy into this hobby. What they do is they not only trade items to each other, they actually sell items for real world currency. Valve doesn't officially support any type of exchange. They don't run an exchange themselves to kind of broker the deal. So there's player made ones. A lot of the times, and this is feedback coming directly from the traders on these subreddits, is in order to prove that they have some item or some type of funds, they go and they link Guiazzo or Imgur pictures to the person they want to trade with and they say, yep, this is my proof that I have $500 for this gun or I have this amount of money for a skin. But what it really is, it's just a JPEG, a .png or .ser file that shows that the file header is executable. This is really, really important because what I'll show in a little bit is that we do have websites like Imgur and Guiazzo. Those are like trusted. But what a lot of people are doing now and we have a lot of samples of this is just making a fake image website. So it's very discernible, very easy for a human to say, oh, if someone links me img23.com, that might be just some offshoot of Imgur or something that's just not as good. Just to kind of go over some of the brands for betting in trade, so for people that don't know about betting it is actually really, really huge in this community. There are professional matches, there are professional teams and they compete for a lot of money. Right now there's a termit going on called the international and the prize pool is $18 million. So there's five people per team and the first place team gets about $6 million to split between five. People bet on these games all the time and you can bet these items on these different websites. So because they use these a lot and because they're really engaged in this community, they're really engaged into watching these professional matches, it's very easy to trick somebody to thinking that they're visiting these websites. In terms of games, the main Steam website, steamcommunity.com you can go there, log into your profile, just perform various like Steam functions, go and talk to your friends, Dota 2 and CSGO as well. So still very, very effective. You can trick somebody very easily by just changing a letter out on one of those brands. And lastly, we already talked about this a lot but VoIP has been very, very popular as well. So tricking somebody thinking they have an outdated version of Mumble or that they need a special version to connect to a server in order to play in a tournament, that's what they use. The point here that the way they evolve and the way these over time have attacked the different people using this platform, this is an image of the different Steam community homograph and variations that we found. So it's about 100 different domains. The main domain is steamcommunity.com, all one word just like that. But if you go and you can look at this image, they'll replace an M with an N. Or they'll replace an M with an R and like very, very like old techniques. I mean these are things we've seen in the 2000s, right? And it's still useful for today. So of the URLs that we've collected we got about 230. We kind of broke it down a little bit more. I know before I said there were about three main ones but there's a couple that were related to social as well. The large percentage of the URLs that we've classified are actually just image variations. So it's a combination of that img23.com slash 1.png or a number in front and then image afterwards. It's just tricking people to thinking they're connecting to an image website. And when they connect to that and they download it they get the executable. It looks like a screenshot because they replace the icon but when they execute it they're infected. So I know we've talked about problems a lot. It's the Wild West but we're actually going to go into a little bit how Valve has responded to these because unlike traditional information security companies because they're a gaming company that their business model focuses on a micro economy they have implemented really interesting fixes to help combat this. So this is a form post it was on January of this year and essentially the person made a post and said hey I just tried giving away a Dota item to my friends and Steam forced me to check email verification in order to finalize the trade offer. Does anyone know anything about this?  So it was really interesting because instead of going and combating the links getting like antivirus installed in the Steam platform trying to educate their users they just threw this in. Pretty effective method really effective because this is a screenshot from a Reddit thread of the supposed maker of the Steam Stealer and essentially he said you know what one while it lasted I'm not giving out refunds you got to figure out a different way to scam people now we still continue to see it afterwards and the reason for that is because of this little configurable option in the Steam Client so essentially like I said opt in enable disabled but the key sentence here is the second sentence of disabled Steam support will also not provide you with any assistance in recovering items that were stolen from your account for any reason so it's essentially a liability play here the problem with the fix that they implemented it works for a regular user but for your kind of like power users that trade a lot, that bet a lot they actually run automated bots for Steam they would go and they would make tons of requests to trade out for a game they'll hedge items against certain games they'll look at certain investments and trends over time on Steam and how an item dips in price or raises in price based on what data it is they need this if you're looking at people who are just turning this off it was too much of a nuisance for them and because they turned it off Steam Stealer still works and Valve refuses to help them because of that pretty much contract right there so in April this year Valve put out another kind of silent like a silent patch into their system this was an article made on GameSpot on April 19th that essentially said Steam has decided to limit users who haven't spent at least $5 a game in the Steam platform or item from friend requesting people and from trading people so essentially it's increasing the cost a lot of the times these different bots that were used and were constructed there are dozens to hundreds of them they would essentially do a spray and pray do a ton of friend requests they had scripted everything out in terms of what they'll say to the person and how to respond to them and then issuing the link this got rid of that unless the Steam Stealer orders essentially go and spend the $5 per automated bot that they had so knowing that they did this fix we went back out to the trading subreddits and we asked them how many scam friend requests you got per day before the $5 fix and after the $5 fix now it's kind of a weird survey talking with a lot of the traders they said that they can tell based on a friend request on Steam whether or not that person is a scammer or not there are a lot of things they use to judge this as account age number of mutual friends their name the messages that they send them in the friend request so the whole community said that they're really really good at catching these so on the left you have the box plot there before the $5 fix the red square mean about 19 a day for most of these traders there's a pretty high variance in there and a couple outliers are significantly reduced there's not as much variance the mean is reduced by over half and there's still some outliers there as well so it was an effective fix and it's kind of one of those tug of wars that you have with information security problems in general you increase the cost of the attacker the attacker does something else you have to pivot and you have to keep implementing more and more fixes cool so I don't know how many of you were on Steam last week or if you watch Twitch or anybody else there's a password reset bypass that was in the Steam platform that was pretty awesome so for about three hours all of the major streamers on CSGO Dota 2 etc they were locked out of their accounts because attackers were going in and resetting their password and locking them out so this is a gif of how that actually works I'll let it loop back one more time but what you do is if you have their account name that's a reset field then you go and it says yes, reset the account for the e-mail address you click that you usually have to go confirm the e-mail address which is why it's like fstarstarstarstar at gstarstarstar but you could just hit okay and it would take you right past it so he's highlighting the thing it goes okay just right past it and now I get to reset whatever password I want about three hours on the Steam platform before Valve fixed it which was really interesting to hear the streamers sort of take on it because the subreddits were all in an uproar about everyone's going to lose their items and the world is coming to an end because Valve sucks in security the streamers didn't care because of all the previous security fixes that Valve had to put in place anytime your password is reset you are not allowed to trade for five days anytime a new device is connected to your account that device cannot trade for five days there's a few of the other interesting fixes there as well but basically what that meant is all of the password resets and the attackers hitting these accounts couldn't actually monetize the fact that they were able to log into people's accounts which was a serious tip of the hat to Valve so even though thousands of people were compromised nothing of value was actually lost that in the most non-ironically possible which is awesome okay so now that we went over the history of this past year of studying this type of malware and this type of attacks on Steam and on these different gamers we are going to implement a small forecast next 6 to 12 months in terms of the different TTPs we are using and the type of malware first big point is the image site homographs and phishing will be weapon of choice so what I mean by that as I said before instead of just trying to perform a homograph attack which is essentially you take my name Zach for example ZACK and you replace a letter with it people let's just say the A for example with a 4 people and humans can still see that and interpret that and know it's Zach works great for humans works terribly for computers so since we've seen a huge huge increase on these image sites they're going to be the weapon of choice it's a lot easier to generate these types of homographs it's not even technically a homograph just different variations of it screenshots will be used consistently by traders and buyers to verify whatever they need to verify when they're performing these trades next the malware is going to be more than just a stealer if you go and you google some of the malware families that we talked about specifically a steam stealer using more and more additional features specifically key loggers they already had remote access tools but you have someone who has an inventory that's worth thousands of dollars they're probably on a really sweet gaming rig that they spent a couple thousand dollars on they probably have something connected to their bank on their machine in the sense of they have a good enough amount of money that it might be a worthy target to drop something on there like a banking trojan it's more to this market, like I said than just virtual items it'd be great to use some of these as bitcoin miners a lot of these games require some pretty Gucci video cards so if you can go and take advantage of that you can really make some money off of this more than just the sites looks like we forgot one animation so now that we have a forecast we're going to give some recommendations at least it's kind of like recommendations to Valve and also recommendations from us just to the gaming community in general so Valve already has an anti-cheat system it's called VAC they have a security team there they responded in a couple hours to the password reset vulnerability see if they can get a platform security team we couldn't find anything that they did have a platform security team but even if they did something as small as text analytics and URL scanning where they have a Google safe browsing or fish tank-esque type of system it's a place where for every URL passed into a steam message if it's on this blacklist of URLs don't send it pretty low barrier to entry and it reduces the time for people finding these fishing sites and submitting a takedown request to these different domain registrars Valve kind of comes in and chips in for it you report it to Valve or they pull it from Google safe browsing or fish tank they detect it and they remove it people are saved so another recommendation is allow for platform plugins Steam and Valve in general are really really good when it comes to being open with the community in terms of game development so they have something called project greenlight you can go you can develop games for the steaming platform people vote the community votes on the game and then if it gets enough votes you get into the steam platform and then Valve will kind of publish it with you they should have something similar for plugins there's already a lot of people doing this already in terms of kind of taking the fight back to these steam punks and Valve can also please the marketplace they don't have to let it be the Wild West where anybody can submit an app they can have guidelines they can have different requirements for people when they submit the apps especially if it's a security one that lets them meet some type of standard that they think is worth putting into steam so for recommendations for we the gamers I'm going to say steam URL scanning capabilities but in browser there are a lot of plugins already in chrome and firefox that I use, I know netcraft has one I think mowerbytes has one and there are a couple other ones that essentially do this type of blacklist capabilities every time someone clicks on a link whether it's in team speak when you're connecting to a server and a message of the day comes up or it's in a steam message it opens up your browser steam does have a browser but it only lets plugins you can at least protect yourself from it there are people out there that are dedicating a lot of time to taking these URLs and getting them known to the security community and these extensions take advantage of that there are anti-fishing groups as well these are three right here essentially these are the guys that go out find these scammers, interact with them try to get URLs from them try to get file samples from them and just distribute them out to the security community the fish tank really really dedicated group of people and they also do something above and beyond just URLs a lot of the time scammers are profiled by these communities so trading communities are very tight-knit they know who's a good trader they know who's kind of like a shady trader and websites like FOG and steam rep they do exactly that when you're going out and you're trading if you want to go buy one from somebody go to these websites look up the user name they have a database full of them and then you can tell very quickly whether or not this person is trustworthy so we didn't have time to do it for this talk but one thing we are also releasing it is out now in the Chrome extension store it is a Chrome extension it doesn't do blacklisting capabilities it essentially detects homograph attacks for those different brands that we found very much like Google safe browsing if you use this platform a lot and you use Steam go and look this up on the Chrome store download it anytime there is a detected homograph attack for certain brands like betting sites like CSGO lounge, Dota 2 lounge or Steam community or even image websites this will detect it throw you into a Google safe browsing webpage tell you why it was thrown and then it will give you a couple options of what to do so that pretty much sums it up a couple of shout outs to the different subreddits that helped us out without them we wanted to have this awesome data and also advice banana I don't know his real name it is some dude in Germany but he essentially gets on IRC and just feeds me URLs and new samples and he is really active on the Steam rep website as well so we actually have a lot of interesting samples so if you guys are interested in taking a look at some of the samples and some of the evolution there as well hit me up on Twitter it's been really interesting seeing the evolution over the past year and I'm really glad we got to come here and show you guys so thanks


What's up everybody, welcome back to the channel, I'm EvilRabbit here for another 25 days giveaway episode. This is going to be day 9 here in the 25 days of giveaway of the Christmas and holiday season. So we're here on 4th and 7th and we're going to do some racing today trying to get some more of the career mode done. Before we do that, of course you know it is a poster giveaway so you guys know the rules. By now, if you don't, make sure you check down in the description box for all the rules. Make sure you comment on this video if you want a chance to win this autograph poster card. And today's autograph poster card giveaway is that number 959 Matt Kaufman autograph poster card. That card, ready for war, is an amazing car, loves the new livery on it. So if you guys want a chance to win the Matt Kaufman autograph poster card, make sure you comment down in the video down below, make sure you subscribe to the channel and tap that like button. So like I said, we're going to get into some racing here so we're going to see where we're at in the Forza Driver's Cup. We're definitely far behind. So we're going to just jump into the Masters class where we got Super GT, Xotic, P2, classic muscle, Indy cars, you don't know any of those. Sport compacts, off-road buggies, GT. We could do some things to get cars. We may try the SVT Cobra Hoonigan Autocross first. You know what? Let's do it. Let's try this SVT Hoonigan Autocross. See if we can't get that car. We got this guy, this man talking. Do you? Really? Delete, delete, delete, delete, massive engine. I like it. V8, there's no replacement for displacement. So we're here at the Autocross track here at Homestead. We're going to rip the SVT around to see if we can't get it. Let's see how this works. I haven't driven one of these in Forza 7, so we'll see how this goes. We may be switching to NCAR View. Oh man, this is going to be interesting. It already wants to get sideways. Try not to hit any barrels. I wanted to click the e-brake there and throw the thing sideways, but that's not what we're trying to do here. I probably could have taken that a lot faster. We're just trying to beat it. I'm going to look ahead of myself, not look where I'm going. I'm going to look ahead to the next pylons. That's the biggest thing with Autocross. Always look ahead of where you're going, whether it's Autocross style like this or Autocrossing on a skid pad style. We tapped that. I did do Autocrossing for many years in my rabbit on Skid Pads all over Ohio. I did some in Florida as well where I live there. It's a lot of fun. Definitely going to be rebuilding the rabbit probably for a full blown out Autocross track car since I do have two cars now. Or maybe get rid of that and get a drift car or get a drift car too. Don't know yet, but right now we're ripping this SVT Cobra around. We may be switching. If we don't pass, we're going to try it probably in a different view. Oh, don't get squirrely. It actually handles a lot better than I thought it was going to. I can see a drift build on this car. Okay, we're just going to shoot that straight. Looking ahead of us so we don't miss like that. If I wouldn't have been looking ahead, I would try to take that turn short and I didn't look ahead to that one. I made my own mistake there, but I think we're still good. Look ahead. So we, yep. See, if you don't look ahead, that happens. I was trying to stay on the same path and there goes another one. Oh, this is going to work. I think we're going to have to retry this. Definitely screwed up a few times, but maybe we'll still beat it. Definitely hard on the brakes there. Oh, I thought it was going to get sideways on me. We didn't hit it. We're good. That bank kind of screwed with me a little bit. I'm trying not to let the sideways. Oh, we just flipped it with our mirror and we didn't pass because of all the penalties. If we didn't have the penalties, we probably would have passed it. So we're going to try it again. We're probably going to go in first person now. See, handle our luck in first person. I wanted to retry. I didn't want to continue. You know, let me retry it. Obviously we failed. There we go. All right. Try and give us a shot. We're going to try and get into the right view right away, which this may be harder in first person because we don't have perspective of distance on some of the turns, but we're going to give the shot. There we go. If we do better in first person view, so far so good. Feels a lot better. I feel like perception of where the pylons are is a little better, but I got to make sure I look way ahead of me for stuff like that. We're good. Trying to be smooth on my steering because autocross is not always about the fastest car. It's about smoothness of steering and line choice. Like that was a pretty good line, but we just hit two pylons. Not good. Like we're a lot faster than this section than we were last time. There's a little bit so we don't lose the traction on this car. Probably should downshift it, but we're still going. Autocross, this is not easy in this game. Make sure the cars they give you would be interesting to have little autocross challenge against some friends, some of the team, maybe some subscribers. Oh, God, I thought we were going to hit that and actually build some cars that are really good and stable in a different class and have a little autocross challenge if we can. I think we can. I don't know if we can do time to autocross events or not. I'd have to check. If we can, let me know down in the comment section down below. Maybe I'm trying to do something that's not available. We go hard on the brakes. We go. I think we're looking better, a lot better in first person. I do race a lot better in first person. I should just, I knew I was gonna hit that. I should just stay straight. I don't know why I forced myself to try and go through that pylon. I should just take the five second penalty. Too many penalties already. I don't, yep. Definitely not gonna get it again. We have to try this again. This was so hard. I think if it wasn't for, I think it's the four penalties I had, which is 20 seconds right there. I think it adds the penalties right away. Yeah, yep. So if it wasn't for the penalties, we probably would have had that. So we're gonna have to do this again. We're gonna have to try and do this without getting penalties. We knew autocross was so hard. I mean, it's not easy for sure, especially not in, you know, this style environment. So much for just doing a couple of races. Apparently we're trying to get this autocross down. You guys like to see more 47? Let me know down in the comment section down below, because it also does register you for the Matt Kauffman giveaway. Oh, I, that was, that was, that was ugly.  That was a pretty, that was a pretty good line. Trying not to get gate hits. I think if we slowed down and made sure we didn't hit any of the gates, we should be good on this. I know other people are probably like, I beat that one try, you know, you're driving scrap right now. Well, you know what, maybe it is, but you know what? Not everybody's perfect. Okay. That was a good, that's a good flow line right now. Trying to stay in second gear. I don't want to bog it in third. Well, that's nice. We're good. We're doing good right now. I think this is it. I think this is actually gonna be the money run. Probably could have gained to that with a lot more speed. I want to overshoot these. Don't want to go too quick. There's one gate hit. I think we can do with one gate hit. There's always no to shift thirds in sections. Many times I've done that. Oh, don't hit that. That's 10 seconds added. I still think we could probably still get it with 10 seconds added after the haul. I'm seriously going to overshoot these. That was ugly, but we didn't overshoot it. So we're good. Go trying to be as smooth as I can on this wheel, but this car is definitely fighting me and there's a third one. This is getting frustrating. Now all I want to do is beat this. I don't want to keep doing this as much fun as this is. Oh, we're getting squirrely now. Trying to overshoot it. I mean, we have a faster time this time and there's a gate hit. So we hit four gates. Once again, that's 20 seconds. Oh my gosh. Guess we'll just have to finish it. Good thing I did that because I noticed my handbrake is not set up for Forza right now. So we're gonna switch that real quick. Then we're going to, I guess, give it another shot as much as I don't want to be right now. We got to give this another go. We got to beat this before the end of this episode. That is my goal. I mean, we'll take money. That's cool too. But seriously, like, ah, you're putting yourself under too much strain out there. Ease up on the difficulty until you get your skills to full throttle. Really? Maybe I'm on a hard difficulty. Let's find out. Did it change the time? I think it did. So difficulty a little bit just so we can try and beat this for shake of this video. But of course, you know, we're probably gonna try and slide this thing stock. So now we got three minute timers. There's a two minute 45 second timer. So once again, as long as we stay smoother than we don't get any penalties, we should be good. I keep saying that and then we, you know, rack up. We do good in the beginning and the latter section. We start racking up penalties through some of these sections. So you just got to try and stay smooth. You think I would know this track by now? I have a good, oh, don't hit that. I thought the back bumper was definitely gonna hit that.  You know it's gonna happen. I mean, the power's not really there, but we'll make do. There we go. Remember, I'm going to third gear through that last time. Oh my gosh. How do we not hit that pile on? There we go. All right. Now, I swear to gosh, if we beat this and under 245 this run after we just lower the driver tar difficulty a little bit, I'm gonna be a little triggered. But I think it's because the stress is off now. So I'm trying. I can be a little more smooth, I guess. Remember the shift there. So we're good. That would be dangerous if you hit all those pylons that would just destroy your run right there. I think it's also because these pylons aren't really on the racing line. And I'm trying to look for the racing line. And these pylons are nowhere near racing line. So go. It's better. It's good. No penalties so far. We're doing way better this time. Lowering the drive is hard, difficult. There's one penalty. Oh, I turned into it. Oh, if I would have stayed out of the turn and just let the car drift a little bit, we wouldn't have hit that pile on. But one's not bad. Do I understand? Really? I think we're seriously going to beat 245. I'm going to get triggered if we beat 245. Like, no, we're not going to beat 245. But I think we will beat the three, the three-minute time. So we will be able to beat this. Actually, if we wouldn't have gotten the penalties, seriously? 246. Get wrecked. We would have beaten it, but we did take it this time. Wow. And we would have gotten it on the full one. Oh, get wrecked. So, see?  And next thing you know, you're just, you know, flying through the track. Wow. That's crazy. So, well, we're going to take that. We're going to take that Cobra. I'll take it. Thank you. And then we're going to go get in the Cobra. And we're going to, we're going to try and rip it real quick. We're going to, we're going to send it and see how it does real quick to end this episode off. So that's going to do it for this episode once we rip this out. So like I said, you guys can follow me on Facebook, Twitch, Twitter and Instagram, all of which are found in the description box below as well. Don't forget to comment down below if you want a chance to win the Matt Kaufman autograph poster card. Thank you for that Cobra. Single player free play. We're already at Maple Valley Drift, so we're just going to enter into it. We're going to go with that. And we're going to have a sip of our brew here. Gotta stay hydrated and don't drink and drive though, or drift. Well, it's on a video game. Otherwise, I don't condone it by any means. All right, Maple Valley Circuit. I have a feeling this car is not going to do that great because the power is definitely not there, but we're going to send it anyways, because this is going to end off today's episode here.  So for the sake of longevity of an episode, we're just going to send this SVT. Send it. No power. Yep, no power. Open diff, I believe. Not good on the sweeper. Probably would be a good drift build. If we can get it to do something on these sections. So stock? Not the greatest. But I bet you if we did a build on it, it would probably turn out pretty good. We may have to do a build. If you guys want to see a build on this SVT, let me know down in the comment section down below. That was more than just a tap. I may actually do a drift build on this car. Maybe not. I feel like it needs a lot more power. You would think it would have more power, but it does not. There we go. We get a little slide there. Fastest slide that's cheating. So I think that's good to do here for this episode. Four is the most for seven. If you guys want to see more of this, let me know down in the comment section down below if you guys want to see maybe a drift build on this SVT. Let me know. Get in the ins and outs of a tuning setting for this car. Maybe you can't dial it in. Who knows? Maybe it'll be an amazing drift car that I may end up liking and using. It's got some good steering angle though. I see that already. May use it in ESD8 if I compete this year. I was testing the steering angle. So until next time guys. Oh, I must hanged it. People rabbit and I'm out.


Everybody forced here ripping in 2022 tops chrome black baseball hobby 12 bucks full case number 36 You can check those results anytime the late sports cards calm and I did drop your Lincoln chat as well There's also a Lincoln chat for elite basketball coming up in just a bit four box random team style break The first one of the evening has six to go then the others you know to have about 20 ish And then there's a tiered case as well two teams of spot that one has six to go That is well over halfway full now Like a weird format to They'd be like this. Do I have this team or that's okay? I don't know maybe we should rearrange in here Get some of those. I don't know what even isn't all those other boxes Empty 5,000 counts You forgot these are with you No, we have a whole brand we have another studio next door move into We can detail clean it before we move in here we go Salvador Perez and Ahoy Park rookie followed by a green refractor Jose Ramirez Guardians that was 90 of 99 for the Guardians Jram First auto is a Joe Carter blue jays base auto Legendary Joe Carter I want to pull a super out of this. I don't think I've ever pulled the super out of top strong black baseball Star Wars a few of them Baseball none Max Scherzer Mets with a green refractor rookie Jaron Durand Red Sox to 99 Solid Durand there and a mini diamond purple Bo Bischette to 150 blue jays Durand is 98 of 99 Bischette 35 of 150 and a greener factor out of here a lot of color in this one greener factor auto Red Sox Or not, sorry Red Sox up Cardinal Scott Rowland 99. I wish Scott won't play for the Red Sox at some point But Cardinal Scott Rowland There you go Recently to the Hall of Fame Scott Rowland Kyle Lewis and Marcus Simeon with a purple mini diamond rookie of one yet past for the Cardinals number 98 of 150 Base auto now for the Braves Andrew Jones Who should be in the Hall of Fame? We go Atlanta. All right next box. You got Charlie Blackman and Luis Robert Base refractor Brandon Crawford 34 199 Giants and a rookie auto V the Al Bruhan Tampa Bay VB. All right box five. Come on super fracter. That's what I was gonna kind of think it of a collector Be scary Mount Castle and Madrigal with a refractor Nolan Aronato Cardinals Just call them Romar Scott Rowland and no more 91 of 199. Good. Romar will be fire Romar Romar infield. I mean, we did we did have Devers and Xander for a couple years But now we're gonna get Devers prime without Xander And rookie auto Cardinals Juan Yepes This is not over Xander guys Why would I be dude? They haven't even started regular seasons. It happened yet. So I can't be I'm down bad right now. You don't even have a shortstop healthy one anyway Trevor short is not a shortstop. He's the second baseman. He's also not healthy anyway We're once you can chair us rookie pirates Got him Alina and a great. I know you're gonna ask me and Tom egg Joey vato 84 of 99 for the Reds You exhausted all of your options. That's what I'm saying Vaughn. It's only time like it's gonna be like eventually It's like him like the Xander one's tougher than mookie too and rookie refractor auto white park pirates one of 150 Yeah, it's just it's just time like Like how do I get over the Red Sox low balling daemon and then he goes to the ink How do I get over that? How do I get over the Patriots low balling brady and then he goes to the bucks? And then what's the title? How do I get over that? All right kebrian haze rookie rededmer's Gold mini diamond now dylan carlson cardinals carlson's having a good break one man's trash It's awesome. Don't like when you have 50 cardinals one man's trash Oh, man, Tom Brady and a green rookie auto kyle muller for the braves to 99 so the mag is like See how it's like lifted here There you go braves Thing was like pinched We'll grab an empty box and wrapper for that spot that cards Make sure you bookmark this video braves you want to get that one replaced That's not gonna have a perfect edge. Just wanted to get back in the mag centered so we can close it But you can see it was pinched Jake burger Miguel Cabrera with a blue refractor Miguel Cabrera 56 to 75 for the tigers had to knock him out last night The tiger's in a gold auto here Hey dylan carlson super futures cardinals 19 of 50 do the cardinals continue to do very well here Crushing it yep has the roll in Carlson now parallels as well Super drippers 22 17 and 10 Yeah, he's he's he's pretty good Vaughn just says i'm airing judge in an orange refractor make gal cabrera 16 to 25 with the color match that time Nice card tigers In base rookie auto here Gavin sheets white socks Hey guys sands live on dripper and personals all night tonight Need a personal rip make sure to head on over to drip personals resume on this channel on tuesday Got a wander rookie dylan carlson refractor of latty jr 66 of 199 bat flips and spring training against the Yankees And green refractor auto of a hosier amir as guardians 28 of 99 very nice hit Awesome jram Guardians doing well with that combo spot too Can be tough to hit with them, but got a green parallel and a green auto Got zander seth beer rookie gold refractor bobechette blue jays 23 out of 50 More 25 15 10 games the rest of the combined. Yeah, that makes sense And base auto brewers robin yant Count on yant Right how are we gonna do that in taiwan? Prolific assistant prolific a passer. Yeah, you can do that in taiwan Yeah, if he's not if he's not shooting threes every possession Bellinger sasa zuki rookie variation And a blue refractor rookie jake burger white sox 28 of 75 And base auto alex keraloff twins You go twins All right, let's go ahead and do a quick recap on the autos Presale case few teams did very well Pirates hoy park rookie auto 150 yep has cardinals brujan rays andrew jones braves Green roll in cardinals to 99 Joe Carter blue jays alex keraloff twins robin yant brewers green j ram guardians to 99 Base Gavin sheets gold dylan carlson cardinals to 50 and a green to 99 callum moeller for the braves Thanks again, everybody Got one more baseball break coming up


Good. We will start our talk about the web-based crypto hacking in the wild when your browser is mining coins for other people. It will be by Marius Mush, who is doing a PhD as Technical University Bondschweig on web application security with a focus on client-side attacks and large-scale analysis. Please welcome Marius. Hi, everyone. I'm Marius. Thanks for having me. Today I will talk about web-based crypto-checking. I worked on that project as part of my PhD, together with my colleagues Christian Resneger, Martin Johns, and Konrad Rieck. So unless you have been living under a rock in the past two years, you might have heard about Bitcoin and all the cryptocurrency stuff. So in January 2017, we had Bitcoin at an exchange rate of about $1,000. And it went up all the way to $20,000 in December. And today we are somewhere between $3,000 and $4,000 back again. So just for context, when we worked on this, it was around February when we started on this project. And the final data collection was around May. So it was after the real hype died down, but still cryptocurrencies were somewhat more popular and higher priced than today. So to get you quickly on the same page, I have prepared two slides about mining in general. So mining is the process of creating new coins in cryptocurrency. And what you need is the state of the current network, which also is called the blockchain. And also you need a random number or a nonce. So you take both these things, put them together and calculate a hash over this. And the resulting hash sum is compared to a target. So in the end you basically want a resulting hash that has a very low number. So we have a lot of leading zeros in the case of Bitcoin. You actually want to find a hash that has 19 leading zeros. And this is usually not the case. You repeat this process very, very often. So you brute force a lot of hashes. And in the end you hopefully some day then find such a hash. And then you have basically mined a block. This is what mining is about. And in this process you are trading your computational power and electricity for shiny new coins. So you have the initial investment of hardware. And you have this constant cost of the electricity. And for you mining only really makes sense if the coin is worth more than the electricity you pay for. And we also need to know about mining pools. So the problem is if you are now decide to start mining with your desktop computer and with a normal CPU and you say, yeah, I want to mine Bitcoin now because I've had that's the next new thing. So the problem is this is very inconsistent. Because you could mine for centuries and not mine a single block. So you never get any reward at all but you still have to pay for all the electricity. So what you could do is you could join forces with other miners and you get a more consistent reward. Because if anyone in this pool finds a block then it's shared amongst all the peers in the pool according to their contribution. So the pool has to track who calculated how many hashes and then later you get the payout based on that amount. So it's a lot less random this reward. And so that you better understand how this could work. I have here a simplified protocol of me speaking to the pool. So in the beginning I say, oh yeah, I understand version seven of this protocol and the side key will become relevant later in this talk. So this thing basically ties the hashes you calculate to your account. So it's just some ID that later says, okay, if you then pay me remember these hashes I calculate now belong to this account specified here. And the pool will then say, oh yeah, okay. I know you calculated zero hashes so far. So here this blob is basically the state of the current network that we need. And you know, you've seen that in the previous slide with the nonce. And this contains stuff like the mercury root hash and the current block header and transactions and stuff. So we don't really care what this is. It's just a blob for us, right? And also the pool says here is this target. I want every hash that's lower than this number. So we need two leading zeros in this case. And the thing is now we report, we retry it for a bit and then report to the pool, oh yeah, for this job you gave me, I found this nonce and that resulted in this hash. And so the pool can verify that far. And why do we do this? You see only two leading zeros. This will not result in a new mind block. And the thing is the pool doesn't want to be cheated, right? So if you just say the pool, oh we tried a million hashes and we didn't find anything and the pool says oh yeah, great.  So in this case we report a subset of the hashes. And that is all that have two leading zeros because the pool requested it this way. And because the hashes are basically random, right? We can't predict what's the output. And we know this is hexadecimal. So each position in this hash has 16 possible cases. So 16 gives 265. So basically because we found the hash the pool can now say okay, we probably need it around this amount of tries. So this continues and continues and so on. So far for the basic introduction into mining and the mining pool, just as you know what we are talking about. But now what's this crypto checking? Which is actually what the talk is about. So imagine the story kind of like this. Somebody came up with the idea, okay, so we have this cost as electricity. Why should we pay for this? Maybe somebody else can mine for us, right? So this is basically what externalizing costs is about. That's the technical term. Imagine if you're an energy company which is producing fusion energy or something like that and they create a lot of radioactive waste that they don't care about and they just say oh yeah, the society will deal with it, then they have externalized their costs. And this kind of success model got adopted into the cryptocurrency world in the sense that some people decided well, I could just mine on other people's computers so I don't neither need the hardware nor pay for the electricity, right? So this is rather old news from 2017 actually. The register wrote in May that some cryptocurrency miners were found and they were armed with exploits that were already seen on another malware campaign. And I'm the guy on the right who should rather like okay, this actually rather boring because if you can infect the computer with malware, you achieved arbitrary code execution, obviously you can start a miner, right? You could encrypt the hard disk but then you have to deal with all this payment, maybe this guy has a backup and just wipes his machine and loads the backup so maybe you just start a miner and you have less hassle but it's not really interesting on you in any way. But then we saw this article that was in October in white and they said your browser could be mining cryptocurrency for a stranger and I'm like oh, this is rather interesting actually because now there are no exploits involved, right? We have just normal people visiting a website and they are part of your cryptocurrency mining scheme so you can roll out this much more easily, right? You don't need to infect a lot of computers, you just need a website that's rather popular and that's basically what web-based crypto checking is about.  That's rather the drawback of this case, if they close the website again, then the whole thing stops but on the other hand you can far more easily start the mining because you don't need to really infect somebody, you just need somebody visiting your web page. So okay, we want to do mining in the browser but I'm sure you're kind of skeptical now because there are a lot of problems that we would see, right? So the first thing is fast execution. You think a miner in JavaScript that doesn't really sound great but luckily the solution is WebAssembly, it's a new language supported by the browser, it's a low-level bytecode language and that's executed in a stack-based virtual machine inside the browser. So you can write a code in C++, translate that to WebAssembly and then call that from a JavaScript API. So basically we can execute the hashing function in WebAssembly so that will be really fast and efficient so that's great for us. So one problem less but then also we want to do multi-threaded, right? So if somebody visits with four cores then we want to use all that four cores. Well luckily there's also API for that which we can call from JavaScript, you can say, you can ask a browser how many cores does this visitor have and the browser will happily return to us the correct number and then we can instantiate so-called WebWorkers and basically these spawn multiple threads and these will be even de-active if the user switches the tab as long as he does not close it. So okay we can, we have very efficient and fast execution, we can use all the cores of the machine. What would be also very useful is efficient communication, right? We don't want to talk to the pool over HTTP because we have to send a lot of very small messages that we don't want to really deal with all the HTTP headers and that stuff. So we can use WebSockets and these allow for a full duplex communication without the overhead because you mention if you have like tens of thousands of concurrent visitors to your website you don't want them to DDoS your own mining backend infrastructure, right? That would be bad. So we can use these WebSockets and combining all these things we have a rather good miner actually now but I'm sure some in the audience are still skeptical, right? Because we're in the browser so this proof of work, this hashing function that we have to call very, very often we execute it on the CPU and you might say oh wait mining on the CPU that's like 2011 or something. So that's true, right? But for Bitcoin at least not only. So in Bitcoin the proof of work, this hashing function is a normal char. So the thing is this is much more efficient if executed on a GPU or even on specialized hardware like an ASIC which is an application specific integrated circuit. So it's an imaginary hardware that was specifically designed only to do this hashing function, right? It's not a general purpose thing like the CPU which can execute arbitrary stuff but it only does this hashing functions. But it does them really, really well. So if you combine these numbers you actually see these are just rough estimates but such an ASIC could perform like as much commutation as 12,000 CPUs. So our web-based mining can't really compete with these huge mining farms for Bitcoin which employ these ASICs. So what is the solution here? Well the solution is just to not mine Bitcoin because there are a lot of other cryptocurrencies out there and in this case we take Monero which is of the Kryptonite family. So they use this Kryptonite hashing function which was specifically designed for cryptocurrency. So they invented a new hashing function which is resistant to all these other hardware. So it executes really well on a CPU but if you use a GPU or something else it is not really much faster. And people try to design ASICs but it's really hard because they implemented this algorithm in a way with a special 2 megabyte scratchpad which exactly fits into cache of the CPU and stuff. So ASICs have really problems there and also when one was announced they just changed the algorithm. So somebody said and it was just last month that they actually changed it again. So when somebody announces here we are selling our special Monero mining ASIC you can buy that for $5,000 and they just say oh yeah we do a hard fork. So we changed the algorithm. Now the money you invested to build these things and this is really expensive to build such an ASIC. This is now basically worthless and everybody who bought such a thing is also now broke. Okay so with all these things together with mining this Monero and using the Web SMB and WebWorkers and WebSockets somebody combined all that had this brilliant idea and this was the birth of CoinHive. So CoinHive is a service or infrastructure. They were the first big and are still the largest of them all. They provide you with a JavaScript file you embed that into your web page and then you also add a small configuration script which is which I've shown here.  So each calculated hash will be attributed to this account that you write in there in the site key and if you're nice you can also say I don't want to mine at 100% of the CPU but because I don't want to annoy my visitors that much so you can say I only mine about at 70% which is this throttle here. So what you also could do is you could say if we detect a mobile device then we don't start the mining because it will not help very much but you can also skip that step. And they claim that this miner they've implemented actually performs at about 65% of the native miner performance. So it would be still more efficient if you would do this not in the browser but on the machine natively but it's not too bad like you get two thirds of the possible computation in the browser. And Koenheifheis hosts this infrastructure with the web socket backend and the pool communication and all that for you but they take a 30% cut so you don't get all the money. They actually do. It was kind of to be expected that people then started to clone this script they basically just copied the script and modified it a bit and booted up their own backend infrastructure so there are slight modifications of the script but from what we've seen it's actually all the same script that was initially implemented by this Koenheif. And there's also an interesting story behind that which I can't go into detail here but if you're interested look up the block by Brian Krebs where he found out that Koenheifheis actually originated from the German image board program which surely somebody here knows. So if you're interested into that and the story behind that look that up. So we have this great service Koenheif and we have headlines which claim that crypto checking is now the next new thing and oh my god the world is going down and everything but we were wondering is this really the case like is this how often does this happen this crypto checking do they actually make profits this way so what we need is a way to detect this in the wild so what I wanted to do was visit a lot of websites and check if I kind if I kind of find indications that they're using a cryptocurrency miner and I didn't just want to look at Koenheifhe but actually find them in general so also modificated versions of it and before we go into that I want to add a small disclaimer like not all mining is evil right so we see here screenshots of two services which actually ask you before they perform their currency mining in your browser so this would be okay for us we ignore these right when we talk about crypto checking what I mean is mining that starts automatically and without your explicit consent so all others are basically fine for us right so we don't detect them and this off mine even is run by the same guys as Koenheifhe so they noticed that a lot of ad blockers wanted to block them and they started the second service off mine where they asked you first but from what we've seen it's not used very often and also a lot of ad blockers still block that also and another thing is like I don't want to say all mining is evil because it could be interesting as an alternative for ads or trackers or even for captures if you imagine like you have to provide a proof of work instead of a capture for an API that's profit or something so there's there's potential there but sadly what we've seen is mostly people trying to profit from it directly by starting a miner in the form of crypto checking so how could we detect this so we could do some blacklist right so we start with the Koenheif script and if we see that we know it's pretty sure a crypto miner but then we see that people are starting to host these as jQuery or player js or something like that so this doesn't really help us right so we don't do a well based blacklist we could for look for known strings but you know people are just obfuscating their miner right so this doesn't really help us either so as kind of expected the static detection of miners is not really that interesting and also not working perfectly well so what we've done instead is execution traces so this is from the chrome's profiler it's a built-in tool in the two the dev tools of your browser or maybe of another browser and you don't really have to understand what's going on here i've visited google and they execute a lot of javascript you basically see the functions which calls another function another function and so on and after a while the page has loaded and nothing much is happening right here after a while it just stops so you don't have to understand this but rather look at the difference this is a cryptocurrency mining page and what we see here is eight threads so i couldn't expand them all because it wouldn't fit the screen but these bars here are basically the same as these expanded bars here so we see eight different threads which are concurrently executing the same function which is conveniently called hash which calls into a web assembly yeah that's really suspicious i would say because this function is called over and over again and as long as you stay on the page it will be called more often as as long as you stay so this in eight cores or in eight threads in parallel is really a strong indicator for a cryptocurrency mining so we use this and some other indicators to get our results but we did this back in may so may this year we did a stator collection but i also have some two slides about updated results from this month or rather today so we looked at the alexa top one million this is just a list of a million websites which are rather popular and we found about two thousand and five hundred websites which are which had an active miner so we just visited the front page that was the reason why we probably missed a lot of them and there might be various other reasons but it's just so you get an estimate so we found about one in five hundred websites had such a crypto checking script actively and then we made a small plot about is this more in the popular pages on the less popular pages and you have to know that the alexa rank one is google so a low number is high is popular so these are the most popular pages and they also had the most mining scripts but we still see that there's also a minus in the lower or less popular ranks of the alexa right so it's there's a slight trend towards here but there's still a lot going on here then we wanted to do know like what are these websites and we don't want to visit two thousand five hundred websites so we used the service by simantec they have some website categories for you so not every page actually had a category attributed to that and some had multiple but just a rough estimate we found that entertainment and pornography is kind of unsurprisingly most popular for crypto checking and this makes sense intuitively because if you're on a website which shows you videos or a whole movie then it's really worthwhile for the website owner because you stay for a very long time right so the remember the miner is only active during the pay during the time which the tap is open in your browser and so what this means is you're kind of distracted like I was just because you're watching a movie and it plays sound and you don't really notice what what your computer is doing like the the fans might spin up and this is what happens during cryptocurrency miners because they use a lot of your CPU but if you're watching a movie you might not care because you have explosions all around your ears so now the question is do they earn significant amount of money so if you take the top 10 popular pages so the top 10 most popular pages which had a miner and they had on average about 400,000 visitors which stayed for roughly six minutes these are also again very rough estimates because it's very hard to get these numbers there are some services like similar web which can give you some insight but it's unclear how accurate this is and we found that they could earn at that time about 180 dollars I did in euros actually but this is really the top end so an average website in the Alexa top one million which is still not your new personal homepage but it's kind of popular but not really popular had about 25,000 visitors and they could only earn about five euros a day and this is very generous still because we didn't actually we assumed that nobody has an ad blocker and we didn't really calculate how many users are mobile on mobile devices because they also have a much lower hash rate so there are a lot of things that could go wrong also people could just boycott your site if they notice that there's cryptocurrency miner going on maybe somebody posted on Reddit or something so and they stopped visiting your website so there are a lot of reasons why you probably earn less money than that but in case you're wondering is this game over for the smaller websites not exactly so we were wondering maybe a lot of small websites belong to the same guy or are working together and then it could be interesting again like if you have hundreds of these small websites maybe there's some money to make so we tried to track this money but if you know a bit about Monero then or if you look into it then you notice that this thing is infeasible because unlike Bitcoin Monero has a lot more privacy stuff involved so the payments are untraceable you can't really link transactions you don't even know how much money is in a particular wallet from the outside without having a special access key they use a lot of fancy cryptography which i don't know anything about but they have these ring signatures and one-time keys derived from another key and muddling factors and it's crazy so you can't do anything right you can't track money in Monero basically and the next problem is we don't even know the wallet addresses right so we would need the wallet address and then we still couldn't do anything but we can't even do that so with coinhive for example remember there was the side key and the side key was just an ID that coinhive then later maps to a wallet where they pay out the money but we are not running coinhive so we don't know which side key gets paid out to which wallet address and also the side key as the name implies is intended to be unique for each side so if people are running multiple sites then they could just use multiple side keys and we from the outside wouldn't know that they actually mine for the same account but also people make mistakes so we only found 570 side keys on 830 sites so obviously some side keys were used multiple times in fact one of them was used 55 times on different websites and on the in this picture you can see a cluster of 21 pages which had the same side key and then one of these pages actually had a second miner with another side key which linked it to these five other pages so this page maybe was infected twice we don't really know that's the problem right because even these 21 sites with the same side key we don't know if they have the same owner or if they were hacked with the same exploit or by the same guy or same campaign so we know these belong together and that the same person gets all the money from these 21 sites but we don't know if that's intentional or not and this case with this one side which had two miners on it which doesn't really make sense kind of indicates that there was some hack involved but again we don't really know from the outside which is kind of sad there was a last thing we could do which is probably the most easy of them all and this is using web artifacts which means we look at the mining script so we look at the URL of the script and if you see the same script over and over again or the same web socket backend then it could be that they belong together but the problem is there these pools right so if you see crypto coin high for example multiple times we don't know anything but on the other hand there are private pools which don't have a public website so there's nothing to register and then we kind of can conclude that they have to be run by the same people right so for example we use the scripts or rather the hashes of the javascript miners and we clustered them in this picture here and the biggest obviously is coin hive as expected so there's this huge block here basically means there were about 700 or so script scripts which were exactly the same and then there's another block we called it advisors that because that was the URL of that miner so we were wondering there were 311 sites which had this miner but when I visited the web page it just said 403 forbidden so there's nothing really there so why are there so many web pages which use that miner if there's nothing there like they it kind of has to be run by those guys right nobody in their own mind would come up with the with the exact URL of the script and then just include it if you can't register on that page so we looked into a few of those pages and then we saw that all of them had such a banner so we noticed that they are all were run by a free okay you Ukrainian hosting service and they included this banner on all the web pages in the top and it even got translated into German when I visited it so why are this banner and over a certain hops of other domains which were all registered through privacy protect and who is God and such stuff so you can't really find out who registered these domains but over this chain they finally included from advices that the mining script and the script itself and the socket communication was also obfuscated like I shown it before and the miner was only active on the very first visit after that it set a cookie and never mind again or never on the same day mind again right so they were really stealthy about that but on the other hand there's kind of dampened their profits because you know if if you visit the front page and you click a link and the miner stops then okay you have maybe a few seconds of mining I don't know but they had 300 sites so if you put all this together they made a bit more money but it can't be much right so these were results from me but now you might be wondering this is actually a different chart this is now the Monero exchange rate and so when we did our our study we were around here where Monero had worth about 225 dollars for one XMR and today they're at about 50 dollars so this means actually the numbers you've seen before you have to divide them by four or by five somewhere in between and this means if you round it down then basically you make one euro a day with an average website and kind of expected you can expect that that means people stopped mining right because I only I did this actually today this graph and I found that only 300 miners were active currently and interestingly we also see that in the most popular bin we now see a rather larger percentage amount so the the first bar here is actually 25 percent of the total and in May it was 14 percent so the more popular pages still do that while a lot of the smaller ones stop because if you're here you're really not going to make any money at all okay so this already concludes my talk thank you all for listening and I'm free for questions those of you that have questions please stand up behind the microphones and those of you leaving please do so quietly so we have the q and a's there is a question from microphone number two hi did you look into open source cms and their plugins so for example there could be the approach to put some mining script into a popular WordPress plugin and although it would be only for each page like maybe 10 visitors per day it might be in hundreds of websites and maybe be valuable it's through this I've heard about a story but we didn't really look into the the spreading factors because for us from the outside it's very hard like we can't really tell was that website hacked or was that the miner there intentionally so we yeah we could try all a possible known exploits currently but that's kind of a slippery slope if I have to attempt the hack or if I have to check if the website is actually vulnerable so we we didn't conclude anything there right so we just is there a miner active and we we don't look further into that right so we don't tell we can't tell if this the website owner or if it was a hacker so there's nothing to conclude there sadly from the outside at least we have a couple of more questions please please if you're leaving leave quietly we have a question from microphone number one yes there's libraries like webgl which lets you run code or through your graphic cards would this it be possible through something like to to mine on directly on the graphics card I've seen a prototype implementation of that but it was no longer maintained and I didn't really try if it actually works so for Monero you there's an interesting angle but if you're mining Monero anyways you don't really gain that much by that and also you have to remember most of your visitors probably don't have really the gaming PC so you could put a lot of effort into creating a GPU miner but then you kind of lose out on all the people who are running laptops and don't really have a dedicated graphics card but still a very decent CPU so I I guess it's just not worth for their amount of visitors who are running good modern graphics cards I've spotted a question a microphone number five there's one from the internet as well please don't be shy we have plenty of time for questions so stand up behind the microphones signal angel what does the internet want to know thank you how could a user prevent cryptojacking in the browser besides of blocking javascript completely what there are certain counter measures actually prepared that's like beforehand and then I removed it from the talk when I noticed that there are only about 300 miners left so the problem with this detection I've shown you with the execution traces is that it involves a lot of runtime overhead right so if you have this profile on all the time you slow down all the websites which don't have a miner so that doesn't really make sense for me but there are some extensions like we tried three of them a minor block no coin which are two extensions and the third is basically just an a special list for ad blockers which you can subscribe to which is specialized for mining strips and these are the number of miners that they detected from the set of the 2500 we found so they still miss a lot but it's kind of expected because they use this static lists which I've shown they kind of work but the problem is that they miss some on the other hand the overhead is lower so if you're really concerned about that you can then the most practical thing to do is install such an extension yeah we have a question from microphone number five did the person move away we have a question from microphone number four would there be a way that you could put a crypto miner in a browser extension so that it runs on every web page as long as the browser is opened totally yeah with extensions you can inject arbitrary code into the page so if at least if you have this permission so it would totally make sense to create such an extension but you also have kind of the problem that if someone reports it then it can be easily removed from the store of extensions so yeah it's an interesting approach but you kind of don't have as much control as if you host it on the site your own right and you also need this permission to inject the scripts and that means basically you already have control over all the sites that your user is visiting so that would be a problem anyways right so you already that's the thing again you you kind of you need to trick the user to not install malware but install a malicious extension and the real crypto checking basically which I've shown you about is the more easier variant where you just need somebody to visit your web page so the the bar is much much lower right so that's the advantage here we have a question from microphone number one have you seen anything like a pop over or an iframe or something that would allow it to live beyond when you close the tab no no we haven't seen that so uh pop under would work yes uh a normal iframe no because if you close the page that is gone but yeah pop under would really make sense now maybe someone is using that but like I said we did this automatic detection but which means we could visit a lot of websites but on the other hand sadly we might have missed out on those special techniques or something which you only would find if you really look manually into all the pages uh but the pop under totally makes sense rear because it says active in the background uh behind all the tabs we still have time for questions so if you are sitting in your seat thinking do we have time for my question please get up and move over to one of the microphones we have five of them two in the back one on way on the side and two up front and the signal angel tells me the internet has a question yes um could j s work against this uh sorry come again uh libre j s could it work against this I actually don't know what it's doing so sadly I can't tell you uh if it would work against it okay perhaps the internet can rephrase the question while we take question from microphone number two yes you said that one way of detecting it was that it was using eight cores simultaneously for a long period of time but wouldn't web pages like Netflix or like sites with online games look the same way yeah um especially with games you have a point um for but you have to remember that we didn't really look into uh whether the CPU is used a lot but rather uh whether a single function in all in all the code of the website uh if a single function was executed over and over again so we we really checked if if it is the same function here and the same function here and the same function here um obviously there are also kind of uh workarounds if you know that I detected this way then you can write write your code to do it another way but currently we just did this and um for a game you could imagine that there's a central update loop which uh basically draws all the sprites and such but do you really need to execute this update loop in in eight threads in parallel I would say it's unlikely but surely we can have some false positives that's true we could have good if there are no more further questions and Marius does not have anything more to add then please thank Marius for an excellent talk