"nimiq" cryptominer (resource abuse)

bsdf commented 2 years ago

Prerequisites

[X] This is not a support issue or a question
[X] I performed a cursory search of the issue tracker to avoid opening a duplicate issue
[X] I am running the latest version of uBlock Origin

I tried to reproduce the issue when...

[X] uBO is the only extension
[X] uBO with default lists/settings
[X] using a new, unmodified browser profile

URL(s) where the issue occurs

https://nixfaq.org/

Describe the issue

the site launches a wasm coin miner. more info in the investigation box

Screenshot(s)

No response

uBlock Origin version

1.41.8

Browser name and version

Mozilla/5.0 (X11; Linux x86_64; rv:97.0) Gecko/20100101 Firefox/97.0

Settings

install ublock origin from AMO on a new firefox profile
click update "update now" button to update default ublock lists

Notes

it appears to be using this wordpress plugin: github dot com slash pom75 slash nimiqWP.

i don't really care to look into wtf "nimiq" is, but it first makes a call to their CDN then loads the miner from the previously mentioned WP plugin:

GET /nimiq.js HTTP/1.1
Host: cdn.nimiq.com

GET /wp-content/plugins/nimiq/js/nimiq.js HTTP/1.1
Host: nixfaq.org

Procyon-b commented 2 years ago

At first I didn't see high CPU, but then I noticed a filter in the FRA regional list:

||nimiq.com^$3p

iam-py-test commented 2 years ago

I can reproduce. CPU at 100% Filters:

||cdn.nimiq.com^$all
||/wp-content/plugins/nimiq/js/$all

Procyon-b commented 2 years ago

@iam-py-test apparently, without the ||cdn.nimiq.com^ script, the plugins don't work (for me CPU at 0%)

iam-py-test commented 2 years ago

Hmm... I still saw the other one after blocking the CDN; if it doesn't break anything blocking it, it's worth saving the bandwidth

bsdf commented 2 years ago

personally, i plan on completely blockingnimiq.com, but i don't think that's appropriate for the default list (see: https://github.com/hoshsadiq/adblock-nocoin-list/issues/343)

Yuki2718 commented 2 years ago

||/wp-content/plugins/nimiq/js/$all

BTW || is domain anchor. As the rule doesn't have domain, no need to use || - just make sure to add * to either head or tail (/wp-content/plugins/nimiq/js/*) to prevent it to be a regex filter. Also it's not good to add $all unnecessarily, though this rule has a good token nimiq and thus not a big worry.

uBlockOrigin / uAssets