Protecting sites from Cryptojacking with CSP and SRI

Once upon a time I was a little ol' kiddie "compromising" websites. One day I thought to myself, what am I doing? Why don't I just replace their ads with mine and reap the benefits. So I did. I had hundreds of dollars overnight from online advertising that I had stolen.

Google sent me a nice email saying they had known what I did and should pay the money back. If I did it again or my account was caught in any kind of fraud it would be banned.

Cryptojacking is no different, it isn't some new hacking technique, it's not a new method or exploit, vulnerability or whatever you want to call it. Giving it a name like this gives it power and recognition and will let other "script kiddies" start using this when they infect the server with their gibberish.

Basically it's an rfi/lfi, but with their js miner instead of a "shell". I hope more researchers and enthusiests don't feed this, but they will, and it will be nothing but negative and draw a younger crowd into hacking (which could be good, since that seems to be how the industry draws in new 'good' researchers).

This makes me wonder what happens when a popular nodejs library get used in this way. What could hackers do with thousands of compromised nodejs servers?

Presumably, the "[Warning] Do not copy or self host this file, you will not be supported" is because they change the script reasonably often, meaning that using SRI will require them to change their hashes on every linked page every time the script changes or it will stop working --- probably not what they want.

when visiting the ICO website

That is... amusingly ironic.

Here's a list of hundreds of sites using that JS library https://nerdydata.com/search?query=www.browsealoud.com%2Fplu...