Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1077 Thanks!
[Music]
good we will start our talk about the
web-based crypto hacking in the wild
when your browser is mining coins for
other people it will be by Marius mush
who's doing a PhD as Technical
University
boun on web application security clients
with a focus on client side attacks and
large scale analysis please welcome
Marius hi everyone I'm Arius thanks for
having me um today I will talk about
web-based crypto checking I worked on
that project as part of my PhD together
with my colleagues Christian reneger
Martin Johns and Conrad Rick
so unless you have been living on the
Rock in the past 2 years you might have
heard about Bitcoin and all the
cryptocurrency stuff so in January 20
2017 we had Bitcoin uh at an exchange
rate of about
$1,000 and it went up all the way to
20,000 in December and today we are
somewhere between 3,000 and 4,000 back
again so just for context uh when we
worked on this it was around February
when we started on this project and the
final data collection was around May so
it was after the real hype died down but
still cryptocurrencies were somewhat
more popular uh and higher price than
today so to get you quickly on the same
page um I've prepared two slides about
mining in general so mining is the
process of creating new coins in uh
cryptocurrency and what you need is the
state of the current Network which also
is called the blockchain and also you
need a random number or a nuns so you
take both these things uh put them
together and calculate a hash over this
and the resulting hash sum is compared
to a Target so in the end you basically
want a um resulting hash that has a very
low number so we have a lot of leading
zeros in case of Bitcoin you actually
want to find a hash that has 19 leading
zeros and this is usually not the case
so repeat this process very very often
so you brute force a lot of hashes and
in the end you hopefully somay then find
uh such a hash and then you have
basically mined a block this is what
mining is about and in this process
you're trading your computational power
and electricity for shiny new coins so
you have the initial investment of uh
hardware and you have this constant cost
of the electricity and for you mining
only really makes sense if um the coin
is worth more than the electricity you
pay
for and we also need uh to know about
mining pools so the problem is if you
are now decide to start mining with your
desktop computer and with a normal CPU
and you say yeah I want to mine Bitcoin
now because I've had that's the next new
thing so the problem is this is very
inconsistent because you could mine for
centuries and not mine a single block so
you never get any reward at all but you
still have to pay for all the
electricity so what you could do is you
could join forces with other Miners and
you get a more consistent reward because
if anyone in this pool uh finds a block
then it's shared amongst all the peers
in the pool according to their
contribution so the pool has to track uh
who calculated how many hashes and then
later you get the payout based on that
amount so it's a lot less random uh this
reward and um so that you bit better
understand how this could work I have
here a simplified protocol of uh me
speaking to the pool so in the beginning
I say oh yeah I'm um I understand
version seven of this protocol and uh
the site key will become re later in the
talk so this thing basically ties the
hashes you calculate to your account so
it's just some ID that later says okay
if you if you then pay me remember these
hashes I calculate now belong to this
account specified here and the pool whle
will uh then say oh yeah okay um I know
you you've calculated zero hashes so far
so here this blob um is basically the
state of the current Network that we
need um and you know you've seen that in
the previous slide with the nons um and
this contains stuff like the Merle 3
root uh hash and the current block
header and transactions and stuff so we
don't really care what this is it's just
a blob for us right and also the pool
says um here is this target I want every
hash that's lower uh than this number so
we need two leading zeros in this case
and the thing is um now we report we
retry it for a bit and then report uh to
the pool oh yeah uh for this job you
gave me I found this nuns and that
resulted in this hash and so the the
pool can verify that far and why do we
do this um you see only two leading
zeros there this will not result in a
new mind block and the thing is we the
pool doesn't want to be cheated right so
if you just say the pool oh we tried a
million hashes and uh we didn't find
anything and a pool says oh yeah great
uh that would be a dumb protocol right
so in this case we report a subset of
the hashes and that is all that uh have
two leading zeros because the pool
requested it this way and because um the
hashes are basically random right we
can't predict what's the output and we
know this is hexa so each uh position in
this hash has 16 possible cases so 16 16
gives
265 so basically the because we found a
SES the pool can now say okay we we
probably needed around this amount of
tries so this continues and continues
and so on so so far for the basic
introduction into Mining and a mining
pool uh just that you know what we
talking about but now what's this crypto
checking which is actually what the talk
about so imagine the story kind of like
this uh somebody came up with the idea
okay so we have this cost as electricity
why should we pay for this maybe
somebody else can mine for us right so
this is basically what externalizing
costs is about that's the rather
technical term uh imagine if you're U an
energy company which is producing Fusion
Energy or
uh something like that and they create a
lot of radioactive waste that they don't
care about and they just say oh yeah the
society will deal with it um then they
have externalized their costs and this
kind of success model got adapted into
the cryptocurrency world in the sense
that um some people decided Well I could
just mine on other people's computers so
I don't neither need the hardware no pay
nor pay for the electricity
right so this is rather old news from
2017 actually U the register wrote in
May that uh some cryptocurrency miners
were found and they were armed with
exploits that were already seen on
another malware campaign and I'm the guy
on the right who is rather like okay
this actually rather boring um because
if you can infect a computer with
malware you achieved arbitrary code
execution obviously you can start a
minor
right um you could encrypt the hard disk
but then you have to deal with all this
payment maybe this guy has a backup and
just uh wipes this machine and U loads
the back up so maybe you just start a
miner and you have less hassle but it's
not really interesting or New in any way
but then we saw this article that was in
October in W and they said your browser
could be mining cryptocurrency for a
stranger and I'm like oh this is rather
interesting actually because now there
are no exploits involved right we have
just normal people visiting a website
and there are part of your
cryptocurrency mining scheme so this you
can roll out this much more easily right
you don't need to infect a lot of
computers you just need a website that's
rather popular and that's basically
what's webbased crypto checking is about
so you have you have a popular page and
you just insert a small mining script
into the uh HTML small Javascript file
no exploit involved you people visit
your website they mind for you people
leave the website they stop mining
that's rather the the drawback of this
case if they close the website again
then the whole thing stops but on the
other hand you can far more easily start
the mining because you don't need to
really infect somebody you just need
somebody visiting your web
page so okay we want to do mining in the
browser but I'm sure you're kind of
skeptical now because there are a lot of
lot of problems what we would see right
so the first thing is fast execution you
think uh a miner in JavaScript that
doesn't really sounds great but luckily
the solution is web assembly uh it's a
new language supported by the browser um
it's a low-level bite code language and
that's execute in a stack based virtual
machine inside a browser so you can
write a code in C++ translate it to web
assembly and then call that from a
JavaScript API so basically we can
execute uh the hashing function in a web
assembly so that will be really fast and
efficient so that's great for us so one
problem less but then also we want to do
multi-threaded right so if somebody
visits with four course then we want to
use all that four course well luckily
there's also a API for that that we
which we can call from JavaScript we can
say we can ask a browser um how many CS
does this visitor have and the browser
will happy return to us the correct
number and then we can instantiate
so-called web workers and um basically
these spawn multiple threats and these
will be even be active if the user
switches the tab as long as he does not
close it
so okay we can we have very efficient
and fast execution we can use all the
cause of the machine uh what would be
also very useful is efficient
communication right we don't want to
talk to the pool over HTTP because we
have to send a lot of very small
messages um that we don't want to really
deal with all the HTTP headers and that
stuff so we can use websockets and um
these allow for a full duplex
communication with the all the overhead
because imagine if you have like tens of
th000 of concurrent visitors to your
website you don't want them to Dos your
own mining backend infrastructure right
that would be bad so we can use this
websocket and uh combining all these
things we have a rather good minor
actually now but I'm sure some in the
audience are still skeptical right
because we're in the browser so this
this proof of work this hashing function
that we have to call very very often we
execute it on the CPU and you might say
oh wait my on the CPU that's that's like
2011 or something um
so that's true right but for Bitcoin at
least not only so in Bitcoin we um the
proof of work this the sesing function
is a normal sh so the thing is this is
much more efficient if executed on a GPU
or even on Specialized Hardware like an
ASC which is an application specific
integrated circuit so it's um imagine a
hardware that was specific Al designed
only to do this hashing function right
it's not a general purpose uh thing like
the CPU which can execute arbitrary
stuff but it only does this hashing
functions but it does them really really
well so if you combine these numbers you
actually see these are just rough
estimates but such an AC could uh
perform like like as much commutation as
12,000 CPUs so our webbased mining can't
really compete with these huge mining
farms uh for Bitcoin which employees A6
so what is the solution here well the
solution is just to not mine Bitcoin
because there are a lot of other
cryptocurrencies out there and uh in
this case we take Monero uh which is of
the cryptonite family so they use this
cryptonite hashing function which was
specifically designed for
cryptocurrency um so they invented a new
hashing function which is resistant to
all these uh other Hardware so it
executes really well on a CPU but if you
use a GPU or something else it it's not
really much faster and uh people try to
design as6 but it's really hard because
they've implemented this algorithm in a
way with a special 2 megab scratch Pad
which exactly fits into uh cach of the
CPU and stuff so as6 have really
problems there and also when when one
was announced um they just changed the
algorithm so somebody said and it was
just last month that they actually
changed it again so when somebody
announces yeah we are selling or special
Monero mining Asic you can buy that for
$5,000 and they just say oh yeah we do a
hard for so we change the algorithm now
you all the money you invested to build
this things and this is really much uh
this really expensive to build such an
ASC uh this is now basically worthless
and everybody who bought such a thing is
also now
broke okay so with all these things
together with mining this Monero and
using the web assembly and web workers
and web sockets
somebody combined all that had this
brilliant idea and this was the birth of
coinhive so coinhive is a service or
infrastructure um they were the first
big and are still the largest um of them
all they provide you with a Javascript
file you embed that into your web page
and then you also add a small
configuration script which is uh which
I've shown here so here you see the site
key again so you basically have to
identify your visitors so each
calculated hash will be attri attributed
to this account um that you write in
there in the site key and if you're nice
you can also say I don't want to mine at
100% of the CPU but because I don't want
to annoy my visitors that much so you
can say uh I only mine about at 70%
which is this throttle uh
here so what you also could do is you
could say if if we detect a mobile
device then we don't start the mining
because it will not help Mar watch but
you can also skip that
step and um they claim that this minor
they've implemented actually performs at
about 65% of the Native minor
performance so it would be still more
efficient if you would do this not in
the browser but on the machine natively
but it's not too bad like you get 23ds
of the possible computation in the
browser and um coinhive hosts this
infrastructure with the with the web
socket back end and the cool
communication and all that for you but
they take a 30% cut so you don't get all
the money they actually
do uh it was kind of to be expected that
people then started to clone this uh
script they basically just copied the
script and modified it a bit and uh
booted up their own backend
infrastructure so there are slight
modifications of the script but from
what we've seen it's actually all the
same script that was initially
implemented by this coinhive and there's
also an interesting story uh behind that
which I can't go into detail here but if
you're interested uh look up the block
by Brian KS where he found out that coin
have actually originated from the German
image Port program which surely somebody
here knows so if you're interested into
that and the story behind that uh look
that
up so we have this great service coin
hiive and we have headlines which claim
that crypto checking is now the next new
thing and oh my God the world is going
down and everything but we were
wondering is this really the case like
is this how often does this happen this
crypto checking do they actually make
profits this way so what we need is a
way to detect to detect this in the wild
so what I wanted to do was visit a lot
of websites and check if I kind if I
kind of find indications that they're
using a cryptocurrency minor and I
didn't just want to look at coinhive but
actually find found find them in general
so also modificated versions of it and
uh before we go to that I want to add a
small disclaimer like not all mining is
evil right so we see here screenshots of
two Services which actually ask you
before they perform their currency
mining in your
browser okay so this would be okay for
us we ignore these right um when we talk
about crypto checking what I mean is um
mining that starts automatically and
without your explicit consent so all
others are basically fine for us right
so we don't detect them and this this
off mine even is um run by the same guys
as coinhive so they noticed that a lot
of ad blockers wanted to block them and
they start started the second service
off mine where they asked you first but
from what we've seen it's not used very
often and also a lot of ad blockers
still block that
also and um now the thing is like I
don't want to say all mining is evil
because it could be interesting um as an
alternative for ads or trackers or even
for captures if you imagine like you
have to provide a proof of work uh
instead of a capture for an API that's
throttled or something so there's
there's potential there but sadly what
we've seen is mostly people trying to
profit from it directly by starting a
minor in the form of crypto
checking so how could we detect this so
we could do some blacklists right so we
start with the coinhive script and if
you see that you know it's pretty sure
uh crypto Miner but then we see that
people are starting to host these as
jQuery or player JS or something like
that so this doesn't really help us
right so we don't do a world based
Blacklist we could for look for known
strings but you know people are just
obos skating their minor right so this
doesn't really help us
either so as kind of expected the static
detection of of minus is not really that
interesting and also not working
perfectly well
so what we've done instead is uh
execution traces so this is from the
Chrome's profiler it's a buil-in tool
and the to the def tools of your browser
or maybe of another browser um and you
don't really have to understand what's
going on here I've visited Google and
they execute a lot of JavaScript um you
basically see the functions which calls
another function and another function
and so on and after a while the page has
loaded and nothing much is happening
right here um after a while it just
stops so you don't have to understand
this but rather look at the difference
this is a cryptocurrency mining page and
what we see here is um eight threets so
I couldn't expand them all because it
wouldn't fit the screen but these bars
here are basically the same as these
expanded bars here so we see eight uh
different threads which are concurrently
executing the same function which is
conveniently called hash which calls
into a web assembly yeah that's really
suspicious I would say because this
function is called over and over again
and as long as you stay on the page it
will be called uh more often as as long
as you stay so this in eight chords or
in eight threats in parallel is really
uh strong indicator for a cryptocurrency
mining so we use this and some other uh
indicators to get our results but um we
did this back in May so may this year uh
we did this data collection but they
also have some two slides about updated
results from this month or rather today
um so we looked at the Alexa top 1
million uh this is a just a list of a
million websites which are rather
popular and um we found about 2,500
webites which are which had an active
minor so we just visited the front page
that was the reason why we probably
missed a lot of them and there might be
various other reasons but it's just so
you get an estimate so we found about
one in 500 websites had such a crypto
checking script actively and uh then we
made a small plot about is is more in
the popular Pages or in the less popular
pages and you have to know that the
Alexa rank one is Google so a low number
is uh high is popular so these are the
most popular pages and they also had the
most mining scripts but we still see
that there's also uh minus in the lower
or less popular ranks of the Alexa right
so it's there's a slight Trend towards
here but there's still a lot going on
here then we wanted to know like what
are these websites and we don't want to
visit 2,500 websites so we uh used the
service by simant they have some website
categories um for you so not every page
actually had a a category attributed to
that and some had multiple but just a
rough estimate um we found that
entertainment and pornography is uh kind
of unsurprisingly most popular for
crypto checking and this makes sense
intuitively because if you're on a
website which shows you videos or a
whole movie then uh it's really
worthwhile for the website owner because
you stay for a very long time right so
the remember the minor is only active
during the pay during the time which the
tab is open in your
browser and
so what this means is you're kind of
distractive uh distracted like I was
just um because you watching a movie and
it plays sound and so you don't really
notice uh what the what your computer is
doing like the the fan might spin up and
this is what happens during
cryptocurrency miners because they use a
lot of your CPU but if you're watching a
movie you might not care because you
have explosions all around your
ears so now the question is do they earn
significant amount of money so if you
take the top 10 popular Pages um so the
top 10 most popular Pages which had a
minor yeah and they had on average about
400,000 visitors which stayed for
roughly 6 minutes
these are also again very rough
estimates because it's very hard to get
uh these numbers there are some services
like similar web which can give you some
insight but it's unclear how accurate
this is and we found that they um could
earn at that time about
$180 or I I did in Euros actually um but
this is really the top end so an average
website in the Alexa top 1 million which
is still not your new personal homepage
but it's kind of popular but not really
popular
uh had about 25,000 visitors and they
could only earn about5 a
day and this is very generous still
because we didn't uh actually we assumed
that nobody has an ad blocker and we
didn't really calculate how many users
are Mobile on mobile devices because
they also have a much lower hash rate so
there are a lot of things uh that could
go wrong also people could just uh
boycott your site if they noticed that
there's cryptocurrency miner going on
maybe somebody posted on Reddit or
something so and they stop visiting your
website so there are a lot of reasons
why you probably earn less money than
that but um in case you wondering is
this game over for the smaller websites
not exactly so we were wondering maybe a
lot of small websites belong to the same
guy or are working together and then it
could be interesting again like if you
have hundreds of these small websites
maybe there's some money to make so we
tried to track this money but if you
know a bit about monu then or if you
look into it then you notice that this
is this thing is UN infeasible because
uh unlike Bitcoin Monero has a lot more
privacy stuff involved so the payments
are untraceable you can't really link
transactions you don't even know how
much money is in a particular wallet
from the outside without having special
access key um they use a lot of fancy
cryptography which I don't know anything
about but they have this ring signatures
and onetime keys derived from another
key and muddling factors and it's crazy
so you can't do anything right you can't
track money in Monero
basically and um the next problem is we
don't even know the wallet addresses
right so we would need the wallet
address and then we still couldn't do
anything but we can't even do that so
with coinhive for example remember there
was the site key and the Zite key was
just an ID that coinhive then layer maps
to a wallet where they pay out the money
but we are not running coinhive so we
don't know which Sid key gets paid out
to which wallet address and also the
site key as the name implies is intended
to be unique for each site so if people
are running multiple sites then they
could just uh use multiple site keys and
we from the outside wouldn't know that
they actually mine for the same account
but also people make mistakes so um we
only found uh 570 Sid keys on 830 sides
so obviously some Sid keys were used
multiple times uh in fact one of them
was used 55 times uh on different
websites and on the in this picture uh
you can see cluster of 21 Pages which
had the same Sid key and then one of
these Pages actually had a second minor
with another s key which linked it to
these five other pages so this page
maybe was infected twice we don't really
know that's the problem right because
even this 21 sites with the same site
key um we don't know if they have the
same owner or if they were hacked with
the same exploit or by the same guy or
same campaign so we know these belong
together and that the same person gets
all the money from this 21 sites but we
don't know if that's intentional or not
and this case with this one site which
had two minus on it which doesn't really
make sense kind of indicates that there
was some heck involved but again we
don't really know from the outside which
is kind of sad um there was a last thing
we could do which is probably the most
easy of them all um this is using web
artifacts which means we look at the
mining script so we look at the URL of
the script and if you see the same
script over and over again or the same
websocket back end then it could be that
they belong together but the problem is
that are these pools right so if you see
crypto uh coin high for example multiple
times we don't know anything but on the
other hand there are private pools which
don't have a public website so there's
nothing to register and then we kind of
can conclude that they have to be run by
the same people right so for example um
we we used the scripts or rather the
hashes of the JavaScript Miners and We
clustered them in this picture here
and the biggest obviously is coinhive as
expected so this this huge block here um
basically means there were about 700 or
so script scripts which um were exactly
the same and then there's another block
um we called it advisor St because that
was the uh URL of that minor so we were
wondering We There were 311 sites which
had this minor but when I visited the
web page it just said for O3 forbidden
so there's nothing really there so why
are there so many web pages which used
at minor if there's nothing there like
they it kind of has to be run by those
guys right nobody in their own mind
would come up with the with the exact
URL of the script and then just include
it if you can't register on that page so
we looked into a few of those pages and
then uh we saw that all of them had such
a banner so we noticed that they all
were run by a free UK UK Ukrainian uh
hosting service and they included this
Banner on all the web pages in the
top and uh it even got translated into
German when I visited it so via this
banner and over certain hops of other
domains um which were all registered
through privacy protect and who isard
and such stuff so you can't really find
out who registered this domains but over
this chain um they finally included from
advises that uh the mining script and
the script itself and the socket
communication was Al offis cated like I
shown in before and the miner was only
active on the very first visit after
that it set a cookie and never mind
again or never on the same day mind
again right so they were were really
stealthy about that but on the other
hand there kind of damp their profits
because you know if if you visit the
front page and you click a link and the
miner stops then okay you have maybe a
few seconds of mining I don't know but
they had 300 sites so if you put all
this together they made a bit more money
but it can't be much
right so these were results from May um
but now you might be wondering this is
actually a different chart this is now
the Monero exchange rate and um so when
we did our um our study we were around
here where Monero had worth about
$225 for one
XMR and uh today they're at about
$50
so this means actually the numbers
you've seen before you have to divide
them by four or by five somewhere in
between um and this means it if you
round it down then basically you make €
EUR a day with a average
website and kind of
expected you can expect that that means
people stop mining right
because I only I did this actually today
this graph and I found that only 300
miners were active currently um
and interestingly we also see that uh in
the most popular bin we now see a a
rather larger percentage amount so uh
the the first bar here is actually 25%
of the total and uh in May it was 14% so
the more popular Pages um still do that
while a lot of the smaller ones stop
because if you are here you're really
not going to make any money at
all okay so this already concludes my
talk thank you all for listening and I'm
free for
[Music]
questions thank you for an excellent
talk those of you that have questions
please stand up behind the microphones
and those of you leaving please do so
quietly so we have the q&as there is a
question from microphone number two hi
did you look into uh open source CMS and
their plugins so for example it could be
the approach to put some mining script
into a popular WordPress plug-in and uh
although it would be only uh for each
page like uh maybe 10 visitors per day
it might be in hundreds of websites and
maybe be valuable through
this um I've heard about that story but
we didn't really look into the the
spreading factors because for uh us from
the outside it's very hard like we can't
really tell what's that website hacked
or was that the minor there
intentionally so we yeah we could try
all possible known exploits currently
but that's kind of a slippery slope if I
have to attempt the heck or if I have to
check if the website is actually
vulnerable so we we didn't conclude
anything there right so we just is there
a minor active and we we don't look
further into that right so we don't tell
we can't tell if this uh the website
owner or if it was a hacker so there's
nothing to conclude there sadly from the
outside at least we have a couple of
more questions please please if you're
leaving leave quietly we have question
for microphone number one yes there's
libraries like um webg which lets you um
run code on through your graphic cards
would it it be possible through um
something like to to mine on directly on
the graphics card um I've I've seen a a
prototype implementation of that um but
it was no longer maintained and I didn't
really try if it actually works so for
Monero you there an interesting angle
but uh if you're mining Monero anyways
um you don't really gain that much by
that and also you have to remember most
of your visitors probably don't have
really the the gaming PC so you could
put a lot of effort into creating a GPU
minor but then you kind of lose out on
all the people who are running laptops
uh and don't really have a dedicated
graphics card but still a very decent
CPU so I I guess it's just not worth for
the amount of visitors who are running
good modern graphics cards I've spotted
a question on microphone number five
there's one from the internet as well
please don't be shy we have plenty of
time for questions so stand up behind
the microphones signal Angel what does
the internet want to know thank you um
how could the user prevent crypto
checking in the browser besides of
blocking JavaScript
completely ah
um um what there are certain counter
measures actually prepar that slide
beforehand
uh and then I removed it from the talk
when I noticed that there are only about
300 miners left so the problem with this
detection I've shown you with the
execution traces um is that it involves
a lot of runtime overhead right so if
you have this profile on all the time
you slow down all the websites which
don't have a minor so that doesn't
really make sense for me but there are
some uh extensions uh like uh we tried
three of them a minor block no coin
which are two extensions and the third
is basically just an a special
uh list for ad blockers which you can
subscribe to which is specialized for
mining
scripts and uh these are the number of
minus that they uh detected from the set
of the 2,500 refound so they still miss
a lot but it's kind of expected because
they use this static lists which I've
shown um they kind of work but the
problem is uh that they miss some on the
other hand the overhead is lower so if
you're really concerned about that you
can uh then the most practical thing to
do is install uh such an
extension yeah we have a question from
microphone number
five or did the person move away we have
a question from microphone number
four uh would there be a way that you
could put a crypto Miner in a browser
extension so that it runs on every web
page as long as the browser is
opened totally yeah um with uh
extensions you can uh inject arbitrary
code into the page so if at least if you
have this permission so it would totally
make sense um
to uh create such an extension but you
also have kind of the problem that if
someone reports it then uh it can be be
easily removed from the store of
extensions so yeah it's it's an
interesting approach um but you kind of
don't have as much control as you as if
you hosted on the site your own right
and you also need um this permission to
in uh inject the scripts and that means
basically you already have control over
all the sites that your user is visiting
so that would be a problem anyways right
so you already that's the thing again
you you kind of you need to trick the
user to not install malware but install
a malicious
extension and the real crypto checking
basically which I've shown you about is
the more easier variant where you you
just need somebody to visit your web
page so the the bar is much much lower
right so that's the advantage
here we have a question from microphone
number one have you seen anything like a
popover or an if frame or something that
would allow it to live beyond when you
close the
tab no no we haven't seen that so uh pop
under would work yes uh a normal if
frame no because if you close the page
that is gone but yeah pop under would
really makes sense now maybe someone is
using that but like I said we did this
automatic detection but which means uh
we could visit a lot of webites but on
the other head Sly we might have missed
out on those special techniques or
something which you only would find if
you really look manually into all the
pages uh but the pop under totally makes
sense R because it's just active in the
background uh behind all the
tabs we still have time for questions so
if you are sitting in your seat thinking
hm do we have time for my question
question please get up and move over to
one of the
microphones we have five of them two in
the back one on way on the side and two
up front and the signal Angel tells me
the internet has a
question yes um could Li JS work against
this uh sorry come again uh Libra JS
could it work against this I actually
don't know what it's doing so sadly I
can't tell you uh if it would work again
it okay perhaps the internet can
rephrase the question while we take
question from microphone number two uh
yes you said that one way of detecting
it was uh that it was using eight cores
simultaneously for a long period of time
but wouldn't web pages like Netflix or
like size with online games look the
same
way yeah um especially with games you
have a point um for but you have to
remember that we didn't really look into
uh whether the CPU is used a lot but
rather uh whether a single function in
in all the code of the website uh if a
single function was executed over and
over again so we we really checked if if
it this the same function here and the
same function here and the same function
here um obviously there are also kind of
workarounds if you know that I detected
this way then you can write your code to
do it another way but uh currently we
just did it this and um for a game you
could imag that there's a central update
Loop which uh basically draws all the
Sprites and such but do you really need
to execute this update Loop in in eight
threats in parallel I would say it's
unlikely but surely we can have some
false positives that's true we could
have good if there are no more further
questions and Marius does not have
anything more to add then please thank
Marius for an excellent
talk
[Music]