What would you like with your latte? Cocoa? Cinnamon? Sprinkle of cryptocurrency mining piggybacking off your free Wi-Fi?
Recent visitors to a Buenos Aires Starbucks didn’t actually have a choice: instead, a 10-second delay was foisted on them when they connected to the coffee shop’s “free” Wi-Fi, as their laptops’ power secretly went to mine cryptocoins (of which the Starbucks customers received nary one slim dime, of course).
The mining was noticed by Stensul CEO Noah Dinkin, who took to Twitter on 2 December to ask Starbucks if it was aware of what was going on. He included a screenshot of the code.
Hi @Starbucks @StarbucksAr did you know that your in-store wifi provider in Buenos Aires forces a 10 second delay when you first connect to the wifi so it can mine bitcoin using a customer’s laptop? Feels a little off-brand.. cc @GMFlickinger pic.twitter.com/VkVVdSfUtT
— Noah Dinkin (@imnoah) December 2, 2017
Unauthorized cryptocurrency mining has been around for years, typically showing up in malware. And this isn’t the first time we’ve seen uninvited cryptominers that specifically generate Monero, which is similar to Bitcoin but designed for even greater privacy. That privacy has reputedly made it popular on the dark web, and it’s why the WannaCry authors preferred it to their bitcoins.
Another recent case: one or more malware creators made around $63,000 in five months by invading unpatched IIS 6.0 servers to install their miners. To install the miner, they first hijacked the servers by exploiting the CVE-2017-7269 vulnerability: a good example of the importance of keeping up with patches.
When visitors smelled a cryptomining rat, an admin ‘fessed up. The rationale: hey, it’s this or ads, we gotta make rent money somehow!
We really want to get rid of all the ads. But we also need enough money to keep the site running. Do you want ads or do you want to give away a few of your CPU cycles every time you visit the site?
At any rate, Starbucks confirmed the mining on Monday, saying that it took the issue up with its internet provider to make sure its customers’ processing power isn’t siphoned off any longer:
As soon as we were alerted of the situation in this specific store last week, we took swift action to ensure our internet provider resolved the issue and made the changes needed in order to ensure our customers could use Wi-Fi in our store safely.
— Starbucks Coffee (@Starbucks) December 11, 2017
Judging by the “it’s not our Wi-Fi” statement a Starbucks spokeperson gave Motherboard, it sounds like Starbucks wasn’t knowingly on board with the CPU sucking:
Last week, we were alerted to the issue and we reached out to our internet service provider – the Wi-Fi is not run by Starbucks, it’s not something we own or control. We want to ensure that our customers are able to search the internet over Wi-Fi securely, so we will always work closely with our service provider when something like this comes up.
What to do?
- Watch your CPU. Check Activity Monitor on a Mac or Task Manager on Windows. If your laptop has fans, you might hear them revving up to deal with the extra heat generated by a heavily-loaded CPU chip.
- Find out if your anti-virus detects coinmining tools. For example, Sophos products classify browser-based coinminers as PUAs (potentially unwanted applications). PUAs aren’t malware – they can be blocked or allowed as you choose.
- Patch promptly. Crooks who can break into your servers could add cryptomining code to leech ‘free money’ from all your website visitors, leaving you to bear the brunt of any complaints.