Hello, welcome to the Friday, April 2, 2021 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and the I'm recording from Jacksonville, Florida.

And we got again one of Brad's famous quizzes. Now, this time he goes beyond the actual pact captures and has an entire

little forensics challenge for you. You can download the evidence from Pratt's GitHub

repository and well, this month, we also have a price for you. More details about how to submit your answer

and what the exact questions are you can find in the diary. The price will be a raspberry pie,

and please submit your answer before, well, Brad's answer is being posted in about a week,

and we will then select sort of randomly among the correct answers, the winner of the Raspberry Pi. And unlike Brad sort of

guessed in his diary, it's actually a new Raspberry Pi 4 that will be giving away. And remember Coinhive? Coinhive

was a company that set up a service that made cryptojacking really easy by offering JavaScript

that you could inject into a browser to mine Monero with Coin Hive's help.

About two years ago, Coin Hive was dismantled.

The domain no longer resolved in part because of legal pressure,

because a lot of these scripts, of course, were used for legitimate purposes.

Turns out that Troy Hunt was given access to domains related to Coin Hive, and he's now trying to notify remaining victims. Just by essentially

allowing the domain to resolve again, he was able to see that there are

still many, many sites out there that remain compromised by the Coin Hive script.

So what he started doing now is to actually inject a little pop-up box into these sites

by essentially serving his JavaScript instead of the original

Coin Hive JavaScript and notifying visitors that this site is compromised and trying to

launch a crypto coin miner. The hope is to eventually alert, of course, system administrators

for these sites and have these sites cleaned up.

It's, of course, very likely that there's other malicious content in these sites,

...